joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407c50
Capabilities:
Check if file exists
Get file attributes
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a1046
mov eax, dword fs:[0]
push eax
sub esp, 0x308
mov eax, dword [0x5f537c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, esi
mov edi, dword [ebp + 0xc]
cmp dword [esi + 0x14], 8
jb 0x407c8e
mov eax, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x407ca3
xor al, al
jmp 0x407da1
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x407cad
mov eax, dword [edi]
push eax
call ebx
cmp eax, 0xffffffff
setne cl
jne 0x407d9f
xorps xmm0, xmm0
mov dword [ebp - 0x2d0], 0
movups xmmword [ebp - 0x2e4], xmm0
mov dword [ebp - 0x2cc], 0x18
mov dword [ebp - 0x2d4], 0x400
lea eax, [ebp - 0x2fc]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.0046af30
mov esi, eax
cmp dword [esi + 0x14], 8
jb 0x407d03
mov esi, dword [esi]
push 0x2b4
lea eax, [ebp - 0x2c4]
push 0
push eax
call fcn.0056c750
add esp, 0xc
lea eax, [ebp - 0x2c4]
xor ebx, ebx
push 0x100
push 0x2b4
push eax
push ebx
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov esi, dword [ebp - 0x2c4]
test eax, eax
je 0x407d56
mov dword [ebp - 0x2dc], ebx
mov ebx, esi
mov dword [ebp - 0x2e4], esi
mov dword [ebp - 0x2e0], 0x20
lea ecx, [ebp - 0x2fc]
call fcn.00406670
lea eax, [ebp - 0x314]
mov ecx, edi
push eax
call fcn.0046af30
push eax
push esi
mov byte [ebp - 4], 1
call fcn.0040a390
add esp, 8
mov byte [ebp - 0x2c5], al
lea ecx, [ebp - 0x314]
call fcn.00406670
test ebx, ebx
je 0x407d99
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
mov cl, byte [ebp - 0x2c5]
mov al, cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045a8ed
mov esp, ebp
pop ebp
ret
Function at 0x407dc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a10be
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x5f537c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x21c], 0
movq qword [esi], xmm0
mov dword [esi + 8], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x21c], 1
call fcn.0056c750
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x407f09
xor eax, eax
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407e90
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.0040cb10
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x250]
call fcn.00463350
mov ecx, eax
mov eax, dword [esi + 4]
mov byte [ebp - 4], 2
push ecx
cmp dword [esi + 8], eax
je 0x407ee7
mov ecx, eax
call fcn.00463330
add dword [esi + 4], 0x18
jmp 0x407eef
push eax
mov ecx, esi
call fcn.00403830
lea ecx, [ebp - 0x250]
call fcn.00406670
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 0
call fcn.00406670
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0056c750
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x19
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x407fd7
xor eax, eax
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407f62
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.0040cb10
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 3
push eax
lea ecx, [ebp - 0x250]
call fcn.00463350
mov ecx, eax
mov eax, dword [esi + 4]
mov byte [ebp - 4], 4
push ecx
cmp dword [esi + 8], eax
je 0x407fb9
mov ecx, eax
call fcn.00463330
add dword [esi + 4], 0x18
jmp 0x407fc1
push eax
mov ecx, esi
call fcn.00403830
lea ecx, [ebp - 0x250]
call fcn.00406670
lea ecx, [ebp - 0x234]
call fcn.00406670
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045a8ed
mov esp, ebp
pop ebp
ret
Function at 0x408ae0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a1238
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x5f537c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
mov edi, dword [ebp + 8]
xor bl, bl
push 0x5b1710
push esi
mov dword [ebp - 0x14], edi
push eax
mov dword [ebp - 0x14], 0
call fcn.004092a0
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0
cmp dword [eax - 0xc], 0
jne 0x408b7c
push str.LocationRoot
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.004092a0
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00406bb0
mov edx, dword [ebp - 0x18]
or eax, 0xffffffff
mov byte [ebp - 4], bl
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408b7c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
jne 0x408bc5
push 0x5b174c
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.004092a0
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00406bb0
mov edx, dword [ebp - 0x18]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408bc3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov bl, 1
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x408bed
push 0x5b19d4
push 0x5b2150
lea ecx, [ebp - 0x14]
call fcn.0040a130
test bl, bl
je 0x408bed
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x408c5c
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x408c5c
mov eax, dword [ebp - 0x14]
mov esi, dword [eax - 0xc]
test esi, esi
js 0x408cd8
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, esi
or ecx, edx
jge 0x408c32
push esi
lea ecx, [ebp - 0x14]
call fcn.00409ff0
mov eax, dword [ebp - 0x14]
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00570f7a
mov eax, dword [ebp - 0x14]
add esp, 8
cmp esi, dword [eax - 8]
jg 0x408cd8
mov dword [eax - 0xc], esi
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov word [eax + esi*2], cx
mov edx, dword [ebp - 0x14]
jmp 0x408c61
mov edx, 0x5b19d4
mov ecx, edx
mov dword [edi + 0x10], 0
xor eax, eax
mov dword [edi + 0x14], 7
mov word [edi], ax
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408c80
sub ecx, esi
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.0040cb10
mov eax, dword [ebp - 0x14]
or ecx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x408cba
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045a8ed
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00407940
int3
Function at 0x4092a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a12f1
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5f537c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], eax
mov dword [edi], 0
call fcn.00408cf0
mov ecx, eax
test ecx, ecx
je 0x409434
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
push 0x5b19d4
mov ecx, edi
mov dword [ebp - 4], 1
call fcn.00407960
test al, al
jne 0x40932f
push 0
push 0x5b19d4
mov ecx, edi
call fcn.0040a9f0
push 0x208
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 1
call fcn.0045aa1f
mov esi, eax
add esp, 4
test esi, esi
je 0x409362
push 0x208
push 0
push esi
call fcn.0056c750
add esp, 0xc
jmp 0x409364
xor esi, esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x208
push eax
push esi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 1
push eax
push 0
push dword [ebp - 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
jne 0x4093e0
push esi
call fcn.0045aa28
mov eax, dword [ebp - 0x14]
xor ebx, ebx
add eax, eax
mov ecx, 2
mul ecx
seto bl
neg ebx
or ebx, eax
push ebx
call fcn.0045aa1f
mov esi, eax
add esp, 8
test esi, esi
je 0x4093c7
push ebx
push 0
push esi
call fcn.0056c750
add esp, 0xc
jmp 0x4093c9
xor esi, esi
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x24]
push 0
push esi
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x409409
test esi, esi
jne 0x4093ec
xor ecx, ecx
jmp 0x409400
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4093f1
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.0040a9f0
test esi, esi
je 0x409416
push esi
call fcn.0045aa28
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045a8ed
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00407940
int3
Function at 0x409780
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a10be
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x5f537c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x21c], 0
movq qword [esi], xmm0
mov dword [esi + 8], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0xb
push 0
mov dword [ebp - 0x21c], 1
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4098aa
xor eax, eax
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409835
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.0040cb10
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x250]
call fcn.00463350
mov ecx, dword [esi + 4]
mov byte [ebp - 4], 2
push eax
cmp dword [esi + 8], ecx
je 0x409888
call fcn.00463330
add dword [esi + 4], 0x18
jmp 0x409890
push ecx
mov ecx, esi
call fcn.00403830
lea ecx, [ebp - 0x250]
call fcn.00406670
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 0
call fcn.00406670
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x16
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x409961
xor eax, eax
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4098f0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.0040cb10
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 3
push eax
lea ecx, [ebp - 0x250]
call fcn.00463350
mov ecx, dword [esi + 4]
mov byte [ebp - 4], 4
push eax
cmp dword [esi + 8], ecx
je 0x409943
call fcn.00463330
add dword [esi + 4], 0x18
jmp 0x40994b
push ecx
mov ecx, esi
call fcn.00403830
lea ecx, [ebp - 0x250]
call fcn.00406670
lea ecx, [ebp - 0x234]
call fcn.00406670
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045a8ed
mov esp, ebp
pop ebp
ret
Function at 0x409980
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a13b1
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x5f537c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
movq qword [ebp - 0x224], xmm0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
push 0x104
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x409a24
mov ecx, dword [ebp - 0x220]
mov eax, dword [ebp - 0x224]
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 0x21c]
mov dword [edi], eax
mov dword [edi + 8], ecx
jmp 0x409b15
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.Sysnative
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.Tasks
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor eax, eax
mov dword [ebp - 0x230], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x22c], 7
mov word [ebp - 0x240], ax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409a80
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x240]
call fcn.0040cb10
lea eax, [ebp - 0x240]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x258]
call fcn.00463350
mov ecx, dword [ebp - 0x220]
mov byte [ebp - 4], 2
push eax
cmp dword [ebp - 0x21c], ecx
je 0x409ad9
call fcn.00463330
add dword [ebp - 0x220], 0x18
jmp 0x409ae5
push ecx
lea ecx, [ebp - 0x224]
call fcn.00403830
lea ecx, [ebp - 0x258]
call fcn.00406670
lea ecx, [ebp - 0x240]
call fcn.00406670
mov eax, dword [ebp - 0x224]
mov dword [edi], eax
mov eax, dword [ebp - 0x220]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x21c]
mov dword [edi + 8], eax
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
call fcn.00406860
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045a8ed
mov esp, ebp
pop ebp
ret
Function at 0x409b60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a1418
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x5f537c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], 0
movq qword [esi], xmm0
mov dword [esi + 8], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0x1a
push 0
mov dword [ebp - 0x21c], 1
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x409c98
push str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor eax, eax
mov dword [ebp - 0x228], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x224], 7
mov word [ebp - 0x238], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409c27
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x238]
call fcn.0040cb10
lea eax, [ebp - 0x238]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x250]
call fcn.00463350
mov ecx, dword [esi + 4]
mov byte [ebp - 4], 2
push eax
cmp dword [esi + 8], ecx
je 0x409c7a
call fcn.00463330
add dword [esi + 4], 0x18
jmp 0x409c82
push ecx
mov ecx, esi
call fcn.00403830
lea ecx, [ebp - 0x250]
call fcn.00406670
lea ecx, [ebp - 0x238]
call fcn.00406670
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045a8ed
mov esp, ebp
pop ebp
ret
Function at 0x40ab40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40ab99
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40ab99
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40ab8a
cmp esi, edx
jae 0x40ab99
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x40ab78
cmp esi, edx
jae 0x40ab99
cmp word [esi], 0
je 0x40ab99
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x40b900
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a0d50
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5f537c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.0045a8af
mov edi, eax
add esp, 4
test edi, edi
je 0x40b9b2
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00456502
mov dword [edi + 4], eax
add esp, 4
mov dword [esi + 0x30], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40f3f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x40f414
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040f4e0
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x40f435
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x40f437
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x40f4bf
jg 0x40f44a
test esi, esi
je 0x40f4bf
test ecx, ecx
jl 0x40f48c
jg 0x40f454
test eax, eax
je 0x40f48c
cmp ebx, ecx
jg 0x40f466
jl 0x40f45e
cmp esi, eax
jae 0x40f466
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.0056cbe0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x40f492
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x40f4bf
jg 0x40f49c
test esi, esi
je 0x40f4bf
cmp dword [edi + 0x4c], 0
je 0x40f4bf
mov ecx, edi
call fcn.0040c180
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.00571ca9
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40f9f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a1768
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x5f537c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.0045a8af
mov edi, eax
add esp, 4
test edi, edi
je 0x40fa93
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00456502
add esp, 4
mov dword [edi + 4], eax
jmp 0x40fa95
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.00404db0
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx edi, ax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x40faf5
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x40faf5
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov word [esi + 0x40], di
jne 0x40fb19
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x40fb3b
cmp byte [ebp + 0xc], 0
je 0x40fb28
push esi
call fcn.004568e8
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x40fb47
mov esi, str.ios_base::badbit_set
jmp 0x40fb57
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.0040df50
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.00405f20
push 0x5e156c
lea eax, [ebp - 0x30]
push eax
call fcn.0056c336
int3
Function at 0x4112b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a1968
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x5f537c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 0x1c]
lea edi, [ebx + 0x1c]
mov dword [ebp - 4], 0
test eax, eax
je 0x4112f3
cmp eax, 0xffffffff
jne 0x411369
cmp dword [ebx + 0x18], 8
lea esi, [ebx + 4]
mov eax, esi
jb 0x411300
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4113a5
cmp dword [esi + 0x14], 8
jb 0x411317
mov esi, dword [esi]
push 0
push 0x42000000
push 3
push 0
push 7
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp dword [edi], esi
je 0x411359
mov ecx, edi
call fcn.00410d90
test esi, esi
je 0x411359
cmp esi, 0xffffffff
je 0x411359
mov dword [edi], esi
call fcn.00471890
push eax
mov eax, dword [ebp + 4]
push eax
push edi
push esi
call fcn.00478bf0
add esp, 0x10
mov esi, dword [edi]
call fcn.0047d220
push ebx
push esi
mov ecx, eax
call fcn.00475870
lea eax, [ebp + 8]
push eax
lea ecx, [ebx + 0x38]
call fcn.00410770
mov ecx, dword [edi]
test ecx, ecx
je 0x4113a5
cmp ecx, 0xffffffff
je 0x4113a5
push 0
lea eax, [ebx + 0x20]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x14]
push eax
push 3
push 1
push 0x2800
lea eax, [ebx + 0x60]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
mov ecx, dword [ebp + 0x2c]
test ecx, ecx
je 0x4113bd
mov edx, dword [ecx]
lea eax, [ebp + 8]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045a8ed
mov esp, ebp
pop ebp
ret 0x28