joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403e70
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
mov eax, dword [0x46946c]
push ebx
xor eax, ebp
push esi
mov esi, ecx
mov dword [esp + 0x120], eax
mov eax, dword [esi + 0x1ac4]
test eax, eax
push edi
jne 0x403ffb
mov eax, dword [esi + 0x1abc]
cmp eax, 3
push 0
jne 0x403ebc
push str._local_
push str.proxy
push eax
push str.Mozilla_4.0__compatible__MSIE_5.00__Windows_98__Rising_
jmp 0x403ece
test eax, eax
push 0
push 0
jne 0x403ec7
push eax
jmp 0x403ec9
push 1
push str.VCSoapClient
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 0x1ac0], eax
je 0x404012
cmp dword [esi + 0x1abc], 3
mov ebx, dword [sym.imp.WININET.dll_InternetSetOptionA]
jne 0x403f54
mov edx, dword [esi + 0x125c]
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x18], al
mov dword [esp + 0x14], eax
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x1260]
stosw word es:[edi], ax
push ecx
push edx
stosb byte es:[edi], al
lea eax, [esp + 0x20]
push str._s:_d
push eax
mov dword [esp + 0x1c], 3
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esi + 0x1ac0]
add esp, 0x10
push 0xc
lea edx, [esp + 0x10]
push edx
push 0x26
lea ecx, [esp + 0x24]
push eax
mov dword [esp + 0x20], ecx
call ebx
mov eax, dword [esi + 0x1264]
test eax, eax
lea edi, [esi + 0x1264]
je 0x403f8e
mov ecx, dword [esi + 0x1ac0]
push 4
push edi
push 2
push ecx
call ebx
mov edx, dword [esi + 0x1ac0]
push 4
push edi
push 6
push edx
call ebx
mov eax, dword [esi + 0x1ac0]
push 4
push edi
push 5
push eax
call ebx
mov edx, dword [esi + 0x1ac0]
push 0
push 0x200
xor eax, eax
mov ax, word [esi + 0x122a]
push 3
push 0
push 0
lea ecx, [esi + 0x25]
push eax
push ecx
push edx
call dword [sym.imp.WININET.dll_InternetConnectA]
cmp dword [esi + 0x1abc], 3
mov dword [esi + 0x1ac4], eax
jne 0x403ff1
mov ecx, dword [esi + 0x1ab4]
mov edx, dword [ecx - 0xc]
test edx, edx
je 0x403ff1
inc edx
push edx
push ecx
push 0x2b
push eax
call ebx
mov eax, dword [esi + 0x1ab8]
mov ecx, dword [eax - 0xc]
mov edx, dword [esi + 0x1ac4]
inc ecx
push ecx
push eax
push 0x2c
push edx
call ebx
mov eax, dword [esi + 0x1ac4]
test eax, eax
je 0x404012
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, ebp
call fcn.00458c53
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.00402c90
mov ecx, dword [esp + 0x124]
pop edi
pop esi
xor ecx, ebp
mov eax, 0x80004005
pop ebx
call fcn.00458c53
mov esp, ebp
pop ebp
ret
Function at 0x4051b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x459558
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x28], edi
call fcn.00404dd0
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.00402e90
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x405242
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x406750
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4596db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
mov eax, dword [0x46946c]
xor eax, ebp
mov dword [esp + 4], 0
mov dword [esp + 0x114], eax
mov eax, dword [0x469480]
mov ecx, dword [eax - 0xc]
test ecx, ecx
push esi
mov esi, dword [ebp + 8]
push edi
jne 0x406876
mov byte [esp + 0x10], 0
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
push 0x104
lea ecx, [esp + 0x14]
stosw word es:[edi], ax
push ecx
push str.autohelp.dll
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x10]
push 0x5c
push edx
call dword [sym.imp.MSVCR71.dll__mbsrchr]
mov byte [eax], 0
add esp, 8
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
call fcn.00405f80
push 0xb
push str._system.ini
lea ecx, [esp + 0x14]
mov dword [esp + 0x134], 0
call fcn.00405320
mov ecx, dword [esp + 0xc]
push ecx
push 0x104
lea edx, [esp + 0x18]
push edx
push str.http:__report.rising.com.cn_KakaUserInterface_RsKaUserInterface.asmx
push str.WebSample
push str.Links
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406834
sub eax, edx
push eax
lea eax, [esp + 0x14]
push eax
mov ecx, 0x469480
call fcn.00404ad0
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x12c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406876
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [0x469480]
add eax, 0xfffffff0
push eax
call fcn.00402e90
mov ecx, dword [esp + 0x128]
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x11c]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00458c53
mov esp, ebp
pop ebp
ret
Function at 0x4068b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x459706
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x120
mov eax, dword [0x46946c]
xor eax, ebp
push ebx
xor ebx, ebx
mov dword [esp + 0x11c], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], ebx
mov ecx, dword [0x46948c]
mov dword [esp + 0xc], eax
cmp dword [ecx - 0xc], ebx
push esi
push edi
jne 0x406a5d
mov byte [esp + 0x18], bl
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
push 0x104
lea edx, [esp + 0x1c]
stosw word es:[edi], ax
push edx
push str.autohelp.dll
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x18]
push 0x5c
push eax
call dword [sym.imp.MSVCR71.dll__mbsrchr]
add esp, 8
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x10]
mov byte [eax], bl
call fcn.00405f80
push 9
push str.user.ini
lea ecx, [esp + 0x14]
mov dword [esp + 0x13c], ebx
call fcn.00405320
lea edx, [esp + 0xc]
push edx
mov ecx, 0x46949c
call fcn.00404d60
mov eax, dword [0x469890]
mov ecx, 0x469890
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
mov eax, dword [esi - 4]
mov ecx, 1
mov byte [esp + 0x134], cl
sub ecx, eax
mov eax, dword [esi - 8]
sub eax, 0x100
or eax, ecx
jge 0x4069b7
push 0x100
lea ecx, [esp + 0x14]
call fcn.004038d0
mov esi, dword [esp + 0x10]
mov ecx, dword [0x46949c]
push ecx
push 0x100
push esi
push str.Unknownupload_rising.com.cn
push str.mailbox
push str.autohelpmon
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp esi, ebx
jne 0x4069e1
xor eax, eax
jmp 0x4069f5
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4069e6
sub eax, edx
js 0x406a9c
cmp eax, dword [esi - 8]
jg 0x406a9c
lea edx, [esp + 0x10]
mov dword [esi - 0xc], eax
push edx
mov ecx, 0x46948c
mov byte [eax + esi], bl
call fcn.00404d60
lea eax, [esi - 0x10]
mov byte [esp + 0x134], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406a34
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x134], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406a5d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [0x46948c]
add eax, 0xfffffff0
push eax
call fcn.00402e90
mov ecx, eax
mov eax, dword [esp + 0x18]
add ecx, 0x10
mov dword [eax], ecx
mov ecx, dword [esp + 0x130]
add esp, 4
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x124]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00458c53
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00401ff0
int3
Function at 0x40dce0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
mov eax, dword [0x46946c]
xor eax, ebp
mov dword [esp + 0x11c], eax
push ebx
xor eax, eax
cmp edx, eax
push edi
mov ebx, ecx
je 0x40dded
cmp esi, eax
je 0x40dded
mov byte [esp + 0x18], al
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push str.SOFTWARERising_s
push eax
mov dword [esp + 0x1c], 1
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x24]
push edx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ddcb
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 0
push str.datapath
push edx
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40dd90
sub eax, edx
mov dword [esp + 0x14], eax
je 0x40ddc0
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40dda4
sub eax, edx
sub ebx, eax
dec ebx
push ebx
push 0x45c238
push esi
call dword [sym.imp.MSVCR71.dll__mbsnbcat]
add esp, 0xc
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ddd0
sub eax, edx
pop edi
pop ebx
mov ecx, dword [esp + 0x11c]
xor ecx, ebp
call fcn.00458c53
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x124]
pop edi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00458c53
mov esp, ebp
pop ebp
ret

Function at 0x40de80
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x118
mov eax, dword [0x46946c]
xor eax, ebp
mov dword [esp + 0x114], eax
mov eax, dword [ebp + 8]
push ebx
push edi
mov dword [esp + 0xc], eax
mov ebx, ecx
xor eax, eax
mov byte [esp + 0x10], 0
mov ecx, 0x40
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push edx
mov eax, 0x104
lea ecx, [esp + 0x14]
call fcn.0040de10
add esp, 4
test eax, eax
je 0x40def9
mov edx, dword [ebp + 0xc]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop ebx
mov ecx, dword [esp + 0x114]
xor ecx, ebp
call fcn.00458c53
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x11c]
pop edi
xor ecx, ebp
or eax, 0xffffffff
pop ebx
call fcn.00458c53
mov esp, ebp
pop ebp
ret
Function at 0x40df10
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x46946c]
xor eax, ebp
mov dword [esp + 0x220], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov dword [esp + 0xc], eax
mov esi, ecx
xor eax, eax
mov byte [esp + 0x120], 0
mov ecx, 0x40
lea edi, [esp + 0x121]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push edx
mov eax, 0x104
lea ecx, [esp + 0x124]
mov dword [esp + 0x14], 0xffffffff
call fcn.0040de10
add esp, 4
test eax, eax
je 0x40e026
xor eax, eax
xor ebx, ebx
mov byte [esp + 0x18], bl
mov ecx, 0x41
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x120]
push ecx
push 0x104
lea edx, [esp + 0x20]
push edx
push 0x45baa4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [esp + 0x10], eax
cmp byte [esp + 0x18], bl
je 0x40e026
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_CharUpperA]
mov esi, dword [sym.imp.MSVCR71.dll_sscanf]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push 0x45c268
push eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], ebx
call esi
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, ebx
ja 0x40e029
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x1c]
push str.0X_X
push edx
call esi
mov eax, dword [esp + 0x18]
add esp, 0xc
cmp eax, ebx
ja 0x40e029
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push 0x45c25c
push ecx
call esi
mov eax, dword [esp + 0x1c]
add esp, 0xc
cmp eax, ebx
ja 0x40e029
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00458c53
mov esp, ebp
pop ebp
ret

Function at 0x40e040
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
mov eax, dword [0x46946c]
xor eax, ebp
mov dword [esp + 0x11c], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
xor eax, eax
mov byte [esp + 0x18], 0
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 0x14]
stosb byte es:[edi], al
push edx
mov eax, 0x104
lea ecx, [esp + 0x1c]
call fcn.0040de10
add esp, 4
test eax, eax
je 0x40e0cf
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
pop edi
pop ebx
mov ecx, dword [esp + 0x11c]
xor ecx, ebp
call fcn.00458c53
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x124]
pop edi
xor ecx, ebp
or eax, 0xffffffff
pop ebx
call fcn.00458c53
mov esp, ebp
pop ebp
ret
Function at 0x40e160
Capabilities:
Delete file
Get file size
Move file
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x46946c]
xor eax, ebp
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov dword [esp + 0x224], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [esp + 0x10], eax
xor eax, eax
test esi, esi
mov ecx, 0x41
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
je 0x40e1fc
cmp byte [esi], 0
je 0x40e1fc
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll__mbschr]
add esp, 8
test eax, eax
jne 0x40e231
push 0x105
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x18]
push 0x5c
push edx
call dword [sym.imp.MSVCR71.dll__mbsrchr]
add esp, 8
test eax, eax
je 0x40e1e1
mov byte [eax + 1], 0
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, 0x105
sub ecx, eax
push ecx
push esi
lea edx, [esp + eax + 0x20]
push edx
jmp 0x40e22b
push 0x105
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, 0x105
sub edx, eax
push edx
push str..log
lea eax, [esp + eax + 0x20]
push eax
call ebx
lea esi, [esp + 0x18]
push 0
push 0x20
push 4
push 0
push 3
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40e35f
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp + 0x10]
shl ecx, 0xa
cmp eax, ecx
jbe 0x40e328
cmp eax, 0xffffffff
je 0x40e328
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x105
push esi
lea edx, [esp + 0x128]
xor eax, eax
mov byte [esp + 0x128], 0
mov ecx, 0x41
lea edi, [esp + 0x129]
push edx
rep stosd dword es:[edi], eax
call ebx
lea eax, [esp + 0x120]
push 0x2e
push eax
call dword [sym.imp.MSVCR71.dll__mbsrchr]
add esp, 8
test eax, eax
je 0x40e2bb
mov byte [eax], 0
lea ecx, [esp + 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, 0x105
sub edx, eax
push edx
push str.2.log
lea eax, [esp + eax + 0x128]
push eax
call ebx
push 0x80
lea ecx, [esp + 0x124]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [esp + 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x120]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
push 0x20
push 4
push 0
push 3
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push 2
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00458c53
mov esp, ebp
pop ebp
ret
Function at 0x40ed70
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x459aa8
push eax
mov eax, dword [esp + 0x14]
test eax, eax
mov dword fs:[0], esp
push esi
mov esi, ecx
push edi
mov dword [esi + 8], eax
mov ecx, SysReAllocStringLen
jne 0x40ed9e
mov ecx, 0xc0000000
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x18]
push 0
push 0x80
push 3
push 0
push edx
mov dword [esi + 0xc], eax
mov eax, dword [edi]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x40edfc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_in_call_to_CreateFile__GetLastError_returned__d_n
push 1
call fcn.0040e8c0
add esp, 0xc
mov ecx, esi
call fcn.0040eba0
xor eax, eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0xc
ret 0x14
lea ecx, [esp + 0x1c]
push ecx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi + 0x20], eax
jne 0x40ee4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_in_call_to_GetFileSize__GetLastError_returned__d_n
push 1
call fcn.0040e8c0
add esp, 0xc
mov ecx, esi
call fcn.0040eba0
xor eax, eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0xc
ret 0x14
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x40ee59
push str.File_size_is_greater_than_4GB__Memory_mapping_this_file_size_will_not_work_until_CMemMapFile_supports_Win64____n
jmp 0x40ee62
test eax, eax
jne 0x40ee88
push str.File_size_is_0__not_attempting_to_memory_map_the_file_n
push 1
call fcn.0040e8c0
add esp, 8
mov ecx, esi
call fcn.0040eba0
xor eax, eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0xc
ret 0x14
mov edx, dword [esp + 0x28]
push edx
push edi
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
call fcn.0040ea00
lea ecx, [esi + 0x14]
push eax
mov dword [esp + 0x14], 0
call fcn.00404d60
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov dword [esp + 0x10], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40eed1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi]
push eax
mov ecx, esi
call fcn.0040ec90
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 0x14

Function at 0x40f130
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push 0xc
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 4]
push edx
mov esi, eax
mov eax, dword [esp + 0x14]
push 0
push esi
push 0x40f110
push 0
push 0
mov dword [esi + 8], eax
mov dword [esi + 4], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi], eax
jne 0x40f175
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop esi
pop ecx
ret
mov eax, esi
pop esi
pop ecx
ret
Function at 0x411020
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov esi, eax
mov eax, dword [0x4696fc]
test eax, eax
jne 0x411088
call fcn.00410f50
mov eax, dword [0x4696fc]
test eax, eax
jne 0x411070
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x4695c0], eax
jne 0x411066
mov ecx, dword [0x4696f0]
dec ecx
push 0x4696d0
mov dword [0x4696f0], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop esi
ret
mov dword [0x4696fc], 1
mov ecx, dword [0x4696f0]
dec ecx
push 0x4696d0
mov dword [0x4696f0], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x4695c0]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test esi, esi
mov ebx, eax
jle 0x4110dd
test ebx, ebx
jne 0x411113
push 0xc
call dword [sym.imp.MSVCR71.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x411113
mov edx, dword [0x45c9d8]
mov ecx, ebx
mov dword [ecx], edx
mov eax, dword [0x45c9dc]
mov dword [ecx + 4], eax
mov eax, dword [0x4695c0]
mov edx, dword [0x45c9e0]
push ebx
push eax
mov dword [ecx + 8], edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, ebx
pop ebx
pop esi
ret
test ebx, ebx
je 0x411113
test esi, esi
jge 0x411113
push edi
mov ecx, 3
mov edi, 0x45c9d8
mov esi, ebx
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
pop edi
jne 0x411113
push ebx
call dword [sym.imp.MSVCR71.dll_free]
mov eax, dword [0x4695c0]
add esp, 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
ret

Function at 0x419570
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ecx
push ebx
push esi
push edi
mov ebx, eax
mov dword [esp + 0xc], 0
call fcn.00410c80
test eax, eax
je 0x419590
call fcn.004193d0
mov edi, eax
jmp 0x4195ad
call fcn.004193d0
mov esi, eax
test esi, esi
je 0x4195b1
push esi
call fcn.00419500
push esi
mov edi, eax
call dword [sym.imp.MSVCR71.dll_free]
add esp, 8
test edi, edi
jne 0x4195bb
pop edi
pop esi
mov eax, 7
pop ebx
pop ecx
ret
push ebp
call fcn.00410c80
test eax, eax
push edi
je 0x41960b
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call ebx
mov esi, eax
test esi, esi
jne 0x419649
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
lea ebx, [ebx]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x419649
mov eax, dword [esp + 0x10]
mov ecx, eax
inc eax
cmp ecx, 3
mov dword [esp + 0x10], eax
jge 0x419649
push 0x64
call ebp
push edi
call ebx
mov esi, eax
test esi, esi
je 0x4195e0
jmp 0x419649
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call ebx
mov esi, eax
test esi, esi
jne 0x419649
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x419649
mov eax, dword [esp + 0x10]
mov edx, eax
inc eax
cmp edx, 3
mov dword [esp + 0x10], eax
jge 0x419649
push 0x64
call ebp
push edi
call ebx
mov esi, eax
test esi, esi
je 0x419620
push edi
call dword [sym.imp.MSVCR71.dll_free]
add esp, 4
xor eax, eax
test esi, esi
setne al
pop ebp
pop edi
pop esi
pop ebx
dec eax
and eax, 0xa
pop ecx
ret
Function at 0x419670
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebx, eax
call fcn.00410c80
test eax, eax
mov ebp, dword [sym.imp.MSVCR71.dll_free]
je 0x41968e
call fcn.004193d0
mov esi, eax
jmp 0x4196a7
call fcn.004193d0
mov edi, eax
test edi, edi
je 0x4196ab
push edi
call fcn.00419500
push edi
mov esi, eax
call ebp
add esp, 8
test esi, esi
jne 0x4196b5
pop edi
pop esi
pop ebp
mov eax, 7
pop ebx
ret
call fcn.00410c80
test eax, eax
push esi
je 0x4196dc
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
push esi
mov edi, ecx
call ebp
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor edx, edx
cmp eax, 0xffffffff
setne dl
push esi
mov edi, edx
call ebp
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret