joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f36d
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x496980]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push edi
mov edi, 0x104
xor ebx, ebx
push edi
push ebx
push eax
call fcn.00440bf0
add esp, 0xc
mov dword [ebp - 0x10c], ebx
test esi, esi
je 0x40f46a
cmp byte [esi], 0x30
je 0x40f46a
mov eax, ebx
cmp eax, edi
jae 0x40f550
mov byte [ebp + eax - 0x108], bl
inc eax
cmp eax, edi
jl 0x40f3b9
push edi
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.0042f204
lea eax, [ebp - 0x108]
push 0x22
push eax
call fcn.0042e25b
mov ebx, dword [ebp + 0xc]
add esp, 0x14
test ebx, ebx
je 0x40f431
push 0xf83
push str.C:UsersOfficeDocumentsVisual_StudioHoodSoftUpdateFile.c
push str.CreateDirectorySuper
xor ecx, ecx
lea eax, [ebp - 0x108]
push ecx
push ecx
push eax
push 0x40f556
push ecx
push ecx
call fcn.0040fc60
mov edi, eax
test edi, edi
jne 0x40f47b
push str._GetLastError_
push eax
push esi
push str.:8:CreateDirectorySuper___FAILED_to_create_thread_to_create_directory___s_._NumThreads_d:__s
call fcn.0040d324
add esp, 0x10
push 0
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
test eax, eax
je 0x40f548
cmp eax, 0x50
je 0x40f548
cmp eax, 0xb7
je 0x40f548
cmp eax, 0x4c7
je 0x40f548
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043f5c5
leave
ret
call fcn.00435f53
mov dword [ebp - 0x110], eax
jmp 0x40f4ab
cmp dword [ebp - 0x10c], 0x103
jne 0x40f4ea
call fcn.00435f53
sub eax, dword [ebp - 0x110]
cmp eax, ebx
ja 0x40f4bf
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x10c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x40f488
jmp 0x40f4ea
push esi
call fcn.00435f53
sub eax, dword [ebp - 0x110]
push eax
push str.:5:CreateDirectorySuper___timed_out_after__ldms_while_creating___s_
call fcn.0040d7f3
add esp, 0xc
mov dword [0x49fe80], 0x5b4
and dword [ebp - 0x10c], 0
push 0xfb7
push str.C:UsersOfficeDocumentsVisual_StudioHoodSoftUpdateFile.c
push str.CreateDirectorySuper
push edi
call fcn.0040e841
push dword [0x49fe80]
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
call edi
cmp dword [ebp - 0x10c], 0
jne 0x40f548
push esi
call fcn.004116f7
pop ecx
test eax, eax
jne 0x40f53b
push dword [0x49fe80]
push str._GetLastError_
push ebx
push esi
push str.:3:FYI:_CreateDirectorySuper__s___lu___FAILED:__s_ld
call fcn.0040d7f3
add esp, 0x14
push dword [0x49fe80]
call edi
jmp 0x40f46a
xor eax, eax
inc eax
jmp 0x40f46c
call fcn.0043f77b
int3
Function at 0x40fb3d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x496980]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x148]
push 0x104
push 0
push eax
call fcn.00440bf0
push 0x40
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.00440bf0
add esp, 0x18
test esi, esi
je 0x40fc04
push esi
call fcn.0042d261
mov dword [esp], 0x21e88e
push 0xde
call fcn.004190f6
push eax
push str.P2_Tmp__d
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.0042ef5e
add esp, 0x18
lea eax, [ebp - 0x148]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x40fbcc
push str._GetLastError_
push str.:2:CreateTempFile___FAILED:_GetTempPath___FAILED:__s
jmp 0x40fbfd
push esi
push 0
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x40fbf3
push esi
call fcn.0042dd5b
pop ecx
test eax, eax
jne 0x40fbf3
mov eax, esi
jmp 0x40fc06
push str._GetLastError_
push str.:2:CreateTempFile___FAILED:_GetTempFileName___FAILED:__s
call fcn.0040d324
pop ecx
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043f5c5
leave
ret
Function at 0x40fc60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x496980]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push ebx
mov dword [ebp - 0x110], eax
mov eax, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp + 0x20]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp + 0x24]
push 0x104
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x108]
push 0
push eax
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x118], edi
call fcn.00440bf0
push 0x1c8
push 1
call fcn.0044a2f4
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x40fce1
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x40fe05
mov eax, dword [0x4a1a28]
test eax, eax
jne 0x40fcf4
call fcn.00427911
mov dword [0x4a1a28], eax
push ebx
push eax
call fcn.00427c73
cmp dword [0x4a1a28], 0
pop ecx
pop ecx
jne 0x40fd19
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
call fcn.0044a2ff
jmp 0x40fe04
mov dword [ebx], esi
lea eax, [ebx + 4]
test esi, esi
je 0x40fd35
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x114]
mov edi, dword [ebp - 0x118]
jmp 0x40fd42
push 0xc
push 0
push eax
call fcn.00440bf0
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x110]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp - 0x10c]
push 0x40
push dword [ebp - 0x11c]
mov dword [ebx + 0x20], eax
lea eax, [ebx + 0x24]
push eax
mov dword [ebx + 0x10], edi
call fcn.0042f204
push 0x104
push dword [ebp - 0x120]
lea eax, [ebp - 0x108]
push eax
call fcn.0042f204
lea eax, [ebp - 0x108]
push eax
call fcn.0042e4f7
push 0x40
lea eax, [ebp - 0x108]
push eax
lea eax, [ebx + 0x64]
push eax
call fcn.0042f204
mov eax, dword [ebp + 0x28]
and dword [ebx + 0xb0], 0
mov dword [ebx + 0xa4], eax
call fcn.00435f53
mov dword [ebx + 0xb4], eax
lea eax, [ebx + 0xb8]
push eax
call fcn.0042d261
and dword [ebx + 0xac], 0
add esp, 0x2c
push dword [ebp - 0x10c]
push dword [ebp - 0x110]
push ebx
push 0x40fc13
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 0xa8], eax
test eax, eax
jne 0x40fe07
push ebx
call fcn.0040fe18
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043f5c5
leave
ret 0x24
Function at 0x40fe68
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x496980]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push edi
mov ebx, 0x104
xor edi, edi
push ebx
push edi
push eax
call fcn.00440bf0
push ebx
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.0042f204
lea eax, [ebp - 0x108]
push eax
call fcn.0042e5c3
push edi
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.0042e549
add esp, 0x28
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40ff68
test al, 0x10
je 0x40ff40
push edi
push 0x410d21
push 1
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.00412436
push edi
lea eax, [ebp - 0x108]
push 1
push eax
call fcn.0040ff81
add esp, 0x20
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
jne 0x40ff3d
lea eax, [ebp - 0x108]
push eax
call fcn.0041007a
pop ecx
test eax, eax
je 0x40ff3d
push ebx
push str._GetLastError_
lea eax, [ebp - 0x108]
push eax
push esi
push str.:3:DeleteDirectory___s___FAILED:_DeleteFiles___s___1__0__FAILED:__s_ld
call fcn.0040d324
add esp, 0x14
push ebx
jmp 0x40ff6a
cmp eax, 0xffffffff
je 0x40ff68
push esi
call fcn.0041007a
pop ecx
test eax, eax
je 0x40ff68
push esi
call fcn.0041005d
pop ecx
test eax, eax
jne 0x40ff68
push esi
push str.:3:DeleteDirectory___s___FAILED:_The_given_file_is_not_a_directory_
call fcn.0040d324
pop ecx
pop ecx
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043f5c5
leave
ret

Function at 0x41005d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x410076
shr eax, 4
and eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4102e3
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
mov eax, dword [0x496980]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
mov ebx, 0x104
push ebx
push 0
push eax
call fcn.00440bf0
push ebx
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00440bf0
push 0x140
lea eax, [ebp - 0x34c]
push 0
push eax
call fcn.00440bf0
add esp, 0x24
test esi, esi
je 0x4103c8
cmp byte [esi], 0
je 0x4103c8
push ebx
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0042f204
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0044a360
lea eax, [ebp - 0x108]
push eax
call fcn.0042e4f7
mov eax, dword [0x49fe88]
add esp, 0x18
mov ecx, dword [0x49fe84]
add eax, 0xf
cmp ecx, eax
jle 0x4103a0
push ecx
push str.:8:DoesFileExist_Helper___has_determined_that_over__d_helper_threads_may_be_stuck_
mov dword [0x49fe88], ecx
call fcn.0040d7f3
pop ecx
pop ecx
mov ecx, dword [0x49fe84]
lea eax, [ebp - 0x34c]
inc ecx
push eax
lea eax, [ebp - 0x20c]
mov dword [0x49fe84], ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
dec dword [0x49fe84]
mov esi, eax
cmp esi, 0xffffffff
jne 0x410438
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0043f5c5
leave
ret 4
cmp byte [ebp - 0x320], 0x2e
je 0x410426
lea eax, [ebp - 0x320]
push eax
call fcn.0042dd5b
pop ecx
test eax, eax
jne 0x410426
cmp byte [ebp - 0x108], 0x2a
jne 0x410441
cmp byte [ebp - 0x106], 0x2a
jne 0x410441
mov al, byte [ebp - 0x107]
cmp al, 0x3f
je 0x410441
movsx eax, al
push eax
lea eax, [ebp - 0x320]
push eax
call fcn.00441160
pop ecx
pop ecx
test eax, eax
jne 0x410441
lea eax, [ebp - 0x34c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x410450
cmp dword [0x478138], 0
jne 0x4103da
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
jmp 0x4103ca
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4103c8
Function at 0x410b39
Capabilities:
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x496980]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.0042dd5b
pop ecx
test eax, eax
jne 0x410c9a
push esi
call fcn.0042dd5b
pop ecx
test eax, eax
jne 0x410c9a
push edi
call fcn.0044a680
mov ebx, 0x104
pop ecx
cmp eax, ebx
jae 0x410c53
push esi
call fcn.0044a680
pop ecx
cmp eax, ebx
jae 0x410c53
mov ebx, dword [ebp + 0x10]
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x410c4e
push esi
call fcn.0041005d
pop ecx
test eax, eax
je 0x410c1d
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00440bf0
push 0x104
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.0042f204
lea eax, [ebp - 0x108]
push eax
call fcn.0042e4f7
lea eax, [ebp - 0x108]
push eax
call fcn.0042dd5b
add esp, 0x20
test eax, eax
jne 0x410c9a
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.0042dfe8
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x108]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
jmp 0x410c9c
test ebx, ebx
jne 0x410c9a
push esi
call fcn.0041007a
pop ecx
test eax, eax
je 0x410c9a
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 3
je 0x410c9a
and eax, 0xfffffffc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push esi
jmp 0x410c14
xor eax, eax
inc eax
jmp 0x410c9c
push edi
call fcn.0042cc5f
push esi
mov ebx, eax
call fcn.0042cc5f
mov edi, eax
pop ecx
pop ecx
test ebx, ebx
je 0x410c8f
test edi, edi
je 0x410c8c
push dword [ebp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push ebx
mov esi, eax
call fcn.0044a2ff
push edi
call fcn.0044a2ff
pop ecx
pop ecx
mov eax, esi
jmp 0x410c9c
push ebx
jmp 0x410c94
test edi, edi
je 0x410c9a
push edi
call fcn.0044a2ff
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043f5c5
leave
ret

Function at 0x410cab
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0042dd5b
pop ecx
test eax, eax
jne 0x410cff
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x410cfa
push esi
call fcn.0041007a
pop ecx
test eax, eax
je 0x410cfa
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 3
je 0x410cff
and eax, 0xfffffffc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x410d01
xor eax, eax
inc eax
jmp 0x410d01
xor eax, eax
pop esi
pop ebp
ret
Function at 0x410d3c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x496980]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x90], eax
call fcn.0042dd5b
pop ecx
test eax, eax
je 0x410d72
xor eax, eax
jmp 0x410f51
push edi
call fcn.00435f53
push ebx
push esi
xor edi, edi
mov dword [ebp - 0x8c], eax
push edi
push 0x80
push 3
push edi
push 7
push connect
push dword [ebp - 0x90]
call fcn.0040f703
add esp, 0x24
mov dword [ebp - 0x88], eax
cmp eax, 0xffffffff
jne 0x410e79
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x94], eax
test ebx, ebx
je 0x410dc3
cmp dword [ebx], edi
jne 0x410ddc
test esi, esi
je 0x410de2
call fcn.00435f53
sub eax, dword [ebp - 0x8c]
cmp eax, esi
jb 0x410de2
mov eax, dword [ebp - 0x94]
push eax
jmp 0x410e6e
push ebx
push esi
push edi
push 0x80
push 3
push edi
push 7
push 0x2000000
push dword [ebp - 0x90]
call fcn.0040f703
add esp, 0x24
mov dword [ebp - 0x88], eax
cmp eax, 0xffffffff
jne 0x410e79
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x88], eax
test ebx, ebx
je 0x410e21
cmp dword [ebx], edi
jne 0x410e68
test esi, esi
je 0x410e34
call fcn.00435f53
sub eax, dword [ebp - 0x8c]
cmp eax, esi
jae 0x410e68
mov ebx, dword [ebp - 0x90]
push esi
push ebx
call fcn.00410129
pop ecx
pop ecx
test eax, eax
je 0x410e68
mov eax, dword [ebp - 0x88]
push eax
push str._GetLastError_
push eax
push dword [ebp - 0x94]
push ebx
push str.:8:GetFileSizeTimeOut___Seems_to_have_failed_because_of_an_access_rights_problem_:___s_:__u:_u:__s_ld
call fcn.0040d324
add esp, 0x18
push dword [ebp - 0x88]
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x410f2b
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x94], eax
cmp eax, 0xffffffff
jne 0x410eb9
test ebx, ebx
je 0x410e92
mov edi, dword [ebx]
push str._GetLastError_
push edi
push esi
push dword [ebp - 0x90]
push str.:7:GetFileSizeTimeOut___s____ld___d__FAILED:__s
call fcn.0040d7f3
mov edi, dword [ebp - 0x88]
add esp, 0x14
push 0x104f
jmp 0x410f1b
test eax, eax
je 0x410f2f
push edi
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x8c], edi
mov edi, dword [ebp - 0x88]
push eax
push 0x80
lea eax, [ebp - 0x84]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x410ef1
cmp dword [ebp - 0x8c], 0
jne 0x410f35
push str._GetLastError_
push dword [ebp - 0x8c]
push dword [ebp - 0x94]
push esi
push dword [ebp - 0x90]
push str.:7:GetFileSizeTimeOut___s____ld__FAILED:_GetFileSize___returned__ld_but_ReadFile_____ldBytesRead__FAILED:__s
call fcn.0040d324
add esp, 0x18
push 0x105b
push str.C:UsersOfficeDocumentsVisual_StudioHoodSoftUpdateFile.c
push str.GetFileSizeTimeOut
push edi
call fcn.0040e841
xor eax, eax
jmp 0x410f50
mov edi, dword [ebp - 0x88]
push 0x1060
push str.C:UsersOfficeDocumentsVisual_StudioHoodSoftUpdateFile.c
push str.GetFileSizeTimeOut
push edi
call fcn.0040e841
mov eax, dword [ebp - 0x94]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0043f5c5
leave
ret
Function at 0x411736
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.0042dd5b
pop ecx
test eax, eax
jne 0x41178a
push eax
push eax
push esi
call fcn.00410d3c
mov edi, eax
add esp, 0xc
mov dword [ebp - 4], edi
test edi, edi
je 0x41178a
push 0x138d
push str.C:UsersOfficeDocumentsVisual_StudioHoodSoftUpdateFile.c
push 0x4634fc
push esi
call fcn.00412892
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x411791
push esi
push str.:6:LoadFileToMemory___s___FAILED:_fopen___failed_even_after_GetFileSizeTimeOut___succeeded___
call fcn.0040d324
pop ecx
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
lea eax, [edi + 0xe]
push eax
call fcn.0044a70b
mov edi, eax
pop ecx
test edi, edi
jne 0x4117ba
push dword [ebp - 4]
push esi
push str.:5:LoadFileToMemory___s___FAILED:_malloc___failed_to_allocate_over__u_bytes:_OUT_OF_MEMORY.
call fcn.0040d324
push ebx
call fcn.00412707
add esp, 0x10
jmp 0x41178a
mov esi, dword [ebp - 4]
lea eax, [edi + 4]
push ebx
push esi
push 1
push eax
call fcn.00444a17
add esp, 0x10
mov dword [ebp - 4], eax
cmp eax, esi
jae 0x4117e6
push ebx
call fcn.004440d3
mov esi, dword [ebp - 4]
neg eax
pop ecx
sbb eax, eax
and esi, eax
jmp 0x4117e8
mov esi, eax
push ebx
call fcn.00412707
pop ecx
test esi, esi
jne 0x4117fb
push edi
call fcn.0044a2ff
jmp 0x411789
mov dword [edi], esi
mov eax, edi
jmp 0x41178c

Function at 0x411801
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x496980]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x10c], 0
lea eax, [ebp - 0x108]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x104
push 0
push eax
call fcn.00440bf0
test esi, esi
lea ebx, [ebp - 0x10c]
push edi
cmovne ebx, esi
call fcn.0042dd5b
add esp, 0x10
test eax, eax
je 0x411859
and dword [ebx], 0
xor eax, eax
jmp 0x4118ef
mov esi, 0x104
lea eax, [ebp - 0x108]
push esi
push edi
push eax
call fcn.0042f204
lea eax, [ebp - 0x108]
push eax
call fcn.0042e4f7
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.0044a460
add esp, 0x18
test eax, eax
jne 0x4118b2
push edi
push eax
push eax
call fcn.00427507
pop ecx
pop ecx
push eax
push 0x465c7c
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.0042ef5e
add esp, 0x14
lea edi, [ebp - 0x108]
push 0x1524
push str.C:UsersOfficeDocumentsVisual_StudioHoodSoftUpdateFile.c
push 0x4634fc
push edi
call fcn.00412892
and dword [ebx], 0
mov edi, eax
add esp, 0x10
test edi, edi
je 0x411852
push edi
push 1
push 4
push ebx
call fcn.00444a17
push edi
mov esi, eax
call fcn.00412707
add esp, 0x14
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043f5c5
leave
ret
Function at 0x411c71
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x496980]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push edi
mov edi, dword [ebp + 0xc]
mov ebx, 0x104
push ebx
push 0
push eax
call fcn.00440bf0
push ebx
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00440bf0
push esi
call fcn.0042dd5b
add esp, 0x1c
test eax, eax
jne 0x411dc2
push edi
call fcn.0042dd5b
pop ecx
test eax, eax
jne 0x411dc2
push ebx
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.0042f204
lea eax, [ebp - 0x108]
push eax
call fcn.0042e684
lea eax, [ebp - 0x108]
push eax
call fcn.0042e5c3
lea eax, [ebp - 0x108]
push eax
call fcn.0044a680
add esp, 0x18
jmp 0x411d21
cmp byte [ebp + eax - 0x108], 0x5c
jne 0x411d26
cmp eax, ebx
jae 0x411dd3
mov byte [ebp + eax - 0x108], 0
dec eax
test eax, eax
jg 0x411d07
lea eax, [ebp - 0x108]
push eax
call fcn.0042e4f7
push ebx
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0042f204
lea eax, [ebp - 0x20c]
push eax
call fcn.0042e684
lea eax, [ebp - 0x20c]
push eax
call fcn.0042e5c3
lea eax, [ebp - 0x20c]
push eax
call fcn.0044a680
add esp, 0x1c
jmp 0x411d7f
cmp byte [ebp + eax - 0x20c], 0x5c
jne 0x411d84
cmp eax, ebx
jae 0x411dd3
mov byte [ebp + eax - 0x20c], 0
dec eax
test eax, eax
jg 0x411d69
lea eax, [ebp - 0x20c]
push eax
call fcn.0042e40d
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0042dfe8
add esp, 0xc
lea eax, [ebp - 0x108]
cmp dword [ebp + 0x10], 0
je 0x411dbe
push 0xb
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
jmp 0x411dc4
push 0xa
jmp 0x411db4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043f5c5
leave
ret
call fcn.0043f77b
int3

Function at 0x4121a1
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [0x4a1a28]
xor edi, edi
call fcn.00427a05
mov ebx, dword [ebp + 8]
mov esi, edi
jmp 0x4121d7
cmp esi, 0x56ce
jge 0x4121e0
cmp ebx, dword [eax + 0xa8]
je 0x4121de
push dword [0x4a1a28]
call fcn.00427a68
inc esi
pop ecx
test eax, eax
jne 0x4121bb
jmp 0x4121e0
mov edi, eax
push edi
call fcn.0040fe18
pop ecx
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x41cee3
Capabilities:
Get hostname
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x496980]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x194]
push 0x190
push 0
push eax
call fcn.00440bf0
add esp, 0xc
mov esi, 0x104
cmp dword [ebp + 0xc], 0
cmovge esi, dword [ebp + 0xc]
test edi, edi
je 0x41cf5f
test esi, esi
jle 0x41cf5f
lea eax, [ebp - 0x194]
mov byte [edi], 0
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x41cf5b
push esi
push edi
call sub.WSOCK32.dll_gethostname
mov esi, eax
call sub.WSOCK32.dll_WSACleanup
test esi, esi
jne 0x41cf5b
push edi
call fcn.0044a680
pop ecx
test eax, eax
jne 0x41cf5f
xor eax, eax
jmp 0x41cf61
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043f5c5
leave
ret

Function at 0x41e1ab
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x496980]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x104
lea eax, [ebp - 0x108]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.00440bf0
add esp, 0xc
push str.lnd.reg
push ebx
push ebx
call fcn.00427507
pop ecx
pop ecx
push eax
push 0x465c7c
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.0042ef5e
push 0x2ea9
push str.C:UsersOfficeDocumentsVisual_StudioHoodSoftUpdateNetwork.c
lea eax, [ebp - 0x108]
push 0x4634fc
push eax
call fcn.00412892
mov edi, eax
add esp, 0x24
test edi, edi
je 0x41e263
call fcn.0041b285
mov esi, eax
test esi, esi
je 0x41e263
push edi
push 0x1a
push 0x27c
push esi
call fcn.00444a17
add esp, 0x10
cmp eax, 0x1a
je 0x41e24f
push eax
push 0x1a
push str.:4:LoadLndDataArchive___FAILED:_fread___s_b__d_but_ret__d.
call fcn.0040d324
add esp, 0xc
push edi
call fcn.00412707
push ebx
push esi
call fcn.0041dc89
add esp, 0xc
mov eax, esi
jmp 0x41e265
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043f5c5
leave
ret