joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408720
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x484964]
mov dword [ebp - 4], ecx
cmp eax, 0xffffffff
jne 0x408744
push 0
push 0
push 0x4e
push str.C:p_roboform_6_9_9_roboformStringsRfTls.h
call fcn.0040e7e0
add esp, 0x10
mov eax, dword [0x484964]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
push edi
push eax
call ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40877a
push 0x50
push str.C:p_roboform_6_9_9_roboformStringsRfTls.h
push 0x4534a4
push 0x453494
call fcn.0040b8a0
add esp, 0x10
test esi, esi
jne 0x4087fa
mov ecx, dword [0x484964]
push ecx
call ebx
mov esi, eax
test esi, esi
jne 0x4087fa
push 0x2c
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x4087ae
push eax
push eax
push 0x3c
push str.C:p_roboform_6_9_9_roboformStringsRfTls.h
call fcn.0040e7e0
add esp, 0x10
mov edx, dword [0x484964]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x4087d9
push 0x3e
push str.C:p_roboform_6_9_9_roboformStringsRfTls.h
push 0x4534a4
push 0x453494
call fcn.0040b8a0
add esp, 0x10
test esi, esi
jne 0x4087fa
push 0x55
push str.C:p_roboform_6_9_9_roboformStringsRfTls.h
push 0x4534a4
push 0x453494
call fcn.0040b8a0
add esp, 0x10
xor edi, edi
jmp 0x4087fd
mov edi, dword [esi + 0x1c]
mov eax, dword [0x484964]
inc edi
cmp eax, 0xffffffff
jne 0x40881b
push 0
push 0
push 0x65
push str.C:p_roboform_6_9_9_roboformStringsRfTls.h
call fcn.0040e7e0
add esp, 0x10
mov eax, dword [0x484964]
push eax
call ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x408848
push 0x67
push str.C:p_roboform_6_9_9_roboformStringsRfTls.h
push 0x4534a4
push 0x453494
call fcn.0040b8a0
add esp, 0x10
test esi, esi
jne 0x4088d2
mov ecx, dword [0x484964]
push ecx
call ebx
mov esi, eax
test esi, esi
jne 0x4088d2
push 0x2c
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x408880
push eax
push eax
push 0x3c
push str.C:p_roboform_6_9_9_roboformStringsRfTls.h
call fcn.0040e7e0
add esp, 0x10
mov edx, dword [0x484964]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x4088ab
push 0x3e
push str.C:p_roboform_6_9_9_roboformStringsRfTls.h
push 0x4534a4
push 0x453494
call fcn.0040b8a0
add esp, 0x10
test esi, esi
jne 0x4088d2
push 0x6c
push str.C:p_roboform_6_9_9_roboformStringsRfTls.h
push 0x4534a4
push 0x453494
call fcn.0040b8a0
mov eax, dword [ebp - 4]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov dword [esi + 0x1c], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4088e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x484964], 0xffffffff
jne 0x4088fc
push 0
push 0
push 0x4e
push str.C:p_roboform_6_9_9_roboformStringsRfTls.h
call fcn.0040e7e0
add esp, 0x10
mov eax, dword [0x484964]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
push edi
push eax
call ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x408932
push 0x50
push str.C:p_roboform_6_9_9_roboformStringsRfTls.h
push 0x4534a4
push 0x453494
call fcn.0040b8a0
add esp, 0x10
test esi, esi
jne 0x4089b2
mov ecx, dword [0x484964]
push ecx
call ebx
mov esi, eax
test esi, esi
jne 0x4089b2
push 0x2c
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x408966
push eax
push eax
push 0x3c
push str.C:p_roboform_6_9_9_roboformStringsRfTls.h
call fcn.0040e7e0
add esp, 0x10
mov edx, dword [0x484964]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x408991
push 0x3e
push str.C:p_roboform_6_9_9_roboformStringsRfTls.h
push 0x4534a4
push 0x453494
call fcn.0040b8a0
add esp, 0x10
test esi, esi
jne 0x4089b2
push 0x55
push str.C:p_roboform_6_9_9_roboformStringsRfTls.h
push 0x4534a4
push 0x453494
call fcn.0040b8a0
add esp, 0x10
xor edi, edi
jmp 0x4089b9
mov edi, dword [esi + 0x1c]
test edi, edi
jg 0x4089cc
push 0
push 0
push 0x26
push str.C:p_roboform_6_9_9_roboformStringsRfErrorCatcher.cpp
call fcn.0040e7e0
add esp, 0x10
mov eax, dword [0x484964]
dec edi
cmp eax, 0xffffffff
jne 0x4089ea
push 0
push 0
push 0x65
push str.C:p_roboform_6_9_9_roboformStringsRfTls.h
call fcn.0040e7e0
add esp, 0x10
mov eax, dword [0x484964]
push eax
call ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x408a17
push 0x67
push str.C:p_roboform_6_9_9_roboformStringsRfTls.h
push 0x4534a4
push 0x453494
call fcn.0040b8a0
add esp, 0x10
test esi, esi
jne 0x408a97
mov ecx, dword [0x484964]
push ecx
call ebx
mov esi, eax
test esi, esi
jne 0x408a97
push 0x2c
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x408a4b
push eax
push eax
push 0x3c
push str.C:p_roboform_6_9_9_roboformStringsRfTls.h
call fcn.0040e7e0
add esp, 0x10
mov edx, dword [0x484964]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x408a76
push 0x3e
push str.C:p_roboform_6_9_9_roboformStringsRfTls.h
push 0x4534a4
push 0x453494
call fcn.0040b8a0
add esp, 0x10
test esi, esi
jne 0x408a97
push 0x6c
push str.C:p_roboform_6_9_9_roboformStringsRfTls.h
push 0x4534a4
push 0x453494
call fcn.0040b8a0
add esp, 0x10
pop edi
pop esi
pop ebx
ret
mov dword [esi + 0x1c], edi
pop edi
pop esi
pop ebx
ret
Function at 0x409160
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x20]
push 0x1c
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40924b
mov eax, dword [ebp - 0x1c]
mov edi, eax
test eax, eax
mov dword [ebp - 4], edi
je 0x40924b
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push edx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, eax
test esi, esi
jbe 0x40924b
cmp esi, 0x104
jae 0x40924b
lea edx, [esi - 1]
test edx, edx
jl 0x4091d2
cmp byte [edx + ebx], 0x5c
je 0x4091d2
dec edx
jns 0x4091c9
inc edx
xor eax, eax
cmp edx, esi
jge 0x4091f3
mov edi, edx
mov ecx, ebx
sub edi, ebx
mov bl, byte [ecx + edx]
inc eax
mov byte [ecx], bl
inc ecx
lea ebx, [edi + ecx]
cmp ebx, esi
jl 0x4091df
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
mov byte [eax + ebx], 0
mov eax, dword [edi + 0x3c]
add eax, edi
je 0x40924b
xor ecx, ecx
mov cx, word [eax + 0x14]
lea edx, [ecx + eax + 0x18]
test edx, edx
je 0x40924b
mov ebx, dword [ebp + 8]
xor ecx, ecx
mov cx, word [eax + 6]
sub ebx, edi
test ecx, ecx
mov dword [ebp + 0xc], 0
jbe 0x40924b
lea eax, [edx + 0x10]
mov edx, dword [eax]
mov esi, dword [eax - 8]
mov edi, dword [eax - 4]
cmp edx, esi
ja 0x409233
mov edx, esi
cmp ebx, edi
jb 0x40923d
add edx, edi
cmp ebx, edx
jbe 0x409254
mov edx, dword [ebp + 0xc]
add eax, 0x28
inc edx
cmp edx, ecx
mov dword [ebp + 0xc], edx
jb 0x409225
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
inc edx
sub ebx, edi
mov dword [eax], edx
pop edi
mov dword [ecx], ebx
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409c40
Capabilities:
Get file attributes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x442be8
push 0x423b60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [0x483d74], edi
jne 0x409dab
xor ebx, ebx
cmp dword [0x483d6c], edi
je 0x409c8c
push str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x483d74], edi
jne 0x409d7f
cmp dword [0x483d6c], edi
jne 0x409cad
call fcn.00407570
test eax, eax
je 0x409d84
mov eax, dword [0x451140]
mov dword [ebp - 0x48], eax
mov eax, dword [0x48af10]
cmp eax, edi
jne 0x409d71
xor esi, esi
cmp dword [0x48af14], edi
jne 0x409cfe
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x409cf4
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x48af18], eax
mov dword [0x48af14], 1
mov eax, dword [0x48af18]
cmp eax, edi
je 0x409d19
push str.ActivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
jne 0x409d62
mov eax, dword [0x48af1c]
cmp eax, edi
jne 0x409d54
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x409d3e
mov ecx, dword [str.Kernel32.dll]
push ecx
call dword [0x4429b8]
jmp 0x409d4b
mov edx, dword [0x4429c4]
push edx
call dword [0x4429bc]
cmp eax, edi
je 0x409d62
mov dword [0x48af1c], eax
push str.ActivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, esi
mov dword [0x48af10], eax
cmp esi, edi
jne 0x409d71
xor eax, eax
jmp 0x409d7b
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x48]
push edx
call eax
cmp eax, edi
je 0x409d84
mov ebx, 1
cmp ebx, edi
jne 0x409dab
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7f
je 0x409d98
cmp eax, 0x78
jne 0x409da3
mov ebx, 1
mov dword [0x483d74], ebx
cmp ebx, edi
jne 0x409dab
xor eax, eax
jmp 0x409db0
mov eax, 1
cmp eax, edi
jne 0x409dca
xor ax, ax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
call fcn.00409dff
mov ax, word [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x409dff
Capabilities:
Get file attributes

Disassembly:
cmp dword [0x483d74], edi
jne 0x409ef5
xor ebx, ebx
cmp word [ebp - 0x1c], di
sete bl
cmp ebx, edi
je 0x409e23
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
jmp 0x409e26
mov dword [ebp - 0x2c], edi
mov edi, dword [ebp - 0x24]
mov eax, dword [0x48af20]
test eax, eax
jne 0x409ee2
xor esi, esi
mov eax, dword [0x48af14]
test eax, eax
jne 0x409e73
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x409e69
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x48af18], eax
mov dword [0x48af14], 1
mov eax, dword [0x48af18]
test eax, eax
je 0x409e8e
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x409ed7
mov eax, dword [0x48af1c]
test eax, eax
jne 0x409ec9
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x409eb3
mov ecx, dword [str.Kernel32.dll]
push ecx
call dword [0x4429b8]
jmp 0x409ec0
mov edx, dword [0x4429c4]
push edx
call dword [0x4429bc]
test eax, eax
je 0x409ed7
mov dword [0x48af1c], eax
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, esi
mov dword [0x48af20], eax
test esi, esi
je 0x409ee7
push edi
push 0
call eax
test ebx, ebx
je 0x409ef5
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
ret
Function at 0x40c6d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f628
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
call fcn.00408720
mov dword [ebp - 4], ebx
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0040c660
mov edi, dword [0x4879bc]
push str.GetWatcherWnd
lea ecx, [ebp - 0x38]
call fcn.00436970
push ebx
push 0x484ad0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
mov dword [ebp - 0x34], 0x484ad0
call fcn.00422160
mov eax, dword [0x484ad8]
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 3
mov dword [ebp - 0x24], eax
call fcn.00416690
mov ecx, dword [edi + 0xe4]
mov esi, dword [sym.imp.USER32.dll_IsWindow]
mov bl, 4
push ecx
mov byte [ebp - 4], bl
call esi
test eax, eax
jne 0x40c7be
push str.SetWatcherWnd
lea ecx, [ebp - 0x50]
call fcn.00436970
push 0
push 0x484ad0
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 5
mov dword [ebp - 0x4c], 0x484ad0
call fcn.00422160
mov edx, dword [0x484ad8]
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 6
mov dword [ebp - 0x3c], edx
call fcn.00416690
xor eax, eax
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], bl
mov dword [edi + 0xe4], eax
mov dword [edi + 0xda0], eax
call fcn.00403a60
mov edi, dword [edi + 0xe4]
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 8
call fcn.00416de0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 7
call fcn.004221b0
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.004368f0
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], edi
call fcn.0040c6c0
jmp 0x40c816
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
call fcn.004088e0
push edi
call esi
test eax, eax
je 0x40c8f0
push edi
xor ebx, ebx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne 0x40c8b6
push edi
call fcn.004172b0
add esp, 4
push eax
call dword [sym.imp.USER32.dll_GetLastActivePopup]
mov esi, eax
cmp esi, edi
je 0x40c8b0
cmp esi, ebx
je 0x40c8b0
mov eax, dword [0x4804ec]
mov ebx, esi
mov dword [ebp - 0x14], eax
push 0x40
push 0x40
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xa
call fcn.00436e70
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.00436ef0
push 0
push 2
push 0x111
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.004368f0
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x40c83d
mov esi, dword [sym.imp.USER32.dll_IsWindow]
push 0
push 0
push 0x10
push edi
call dword [sym.imp.USER32.dll_PostMessageA]
push edi
xor ebx, ebx
call esi
test eax, eax
je 0x40c8f0
call fcn.00417170
inc ebx
cmp ebx, 0x32
jge 0x40c906
push 1
push 1
push 0x64
call fcn.00406b00
add esp, 0xc
test eax, eax
je 0x40c906
push edi
call esi
test eax, eax
jne 0x40c8cc
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c920
Capabilities:
Enumerate gui resources

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x14]
cmp eax, edi
je 0x40c933
mov eax, dword [eax]
cmp eax, edi
jne 0x40c92d
mov ecx, dword [esi + 0x24]
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], edi
call fcn.00430bf0
mov ecx, esi
mov dword [esi + 0x24], edi
call fcn.0040c660
mov eax, dword [esi + 0xc]
cmp eax, edi
mov eax, 0x40cf50
jne 0x40c962
mov eax, 0x40c980
push esi
push eax
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, esi
call fcn.0040c6c0
mov ecx, dword [esi + 0x1c]
xor eax, eax
cmp ecx, edi
pop edi
setg al
pop esi
ret

Function at 0x40d770
Capabilities:
Get geographical location

Disassembly:
push esi
push edi
push 0x3c
push 0x3c
mov ecx, 0x484974
call fcn.00436e70
push eax
push 3
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0xffffffffffffffff
mov ecx, 0x484974
call fcn.00436ef0
push 0xffffffffffffffff
push 0x7be
mov ecx, 0x484878
call fcn.00430cf0
push 0xffffffffffffffff
push 0x7be
mov ecx, 0x484860
call fcn.00430cf0
mov eax, dword [str.RFS_CODEPAGE]
mov esi, 0x45468c
test eax, eax
je 0x40d827
xor edi, edi
mov eax, esi
sub eax, 0x45468c
and al, 0xfc
cmp eax, 0x3df4
jge 0x40d827
cmp edi, 0x1ef8
jl 0x40d7f7
push 0
push 0
push 0x2b
push 0x47a180
call fcn.0040e7e0
add esp, 0x10
mov eax, dword [esi]
mov ecx, dword [0x48487c]
push eax
add ecx, edi
add esi, 4
call fcn.00436ae0
mov edx, dword [0x484864]
mov eax, dword [esi]
push eax
add esi, 4
lea ecx, [edi + edx]
call fcn.00436ae0
mov eax, dword [esi]
add edi, 4
test eax, eax
jne 0x40d7cc
pop edi
pop esi
ret
Function at 0x40f760
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43fbe7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [ebp + 0xc]
push ebx
push esi
push 1
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1c], 0
call fcn.0042fa80
push 0x3a
lea ecx, [ebp - 0x14]
push eax
push ecx
mov dword [ebp - 4], 1
call fcn.0042fad0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.004368f0
mov edx, dword [0x4804ec]
mov dword [ebp + 0xc], edx
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x28]
push eax
push ecx
mov byte [ebp - 4], 4
call fcn.0040fa40
add esp, 8
mov esi, eax
push str.Path
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 5
call fcn.00436970
push esi
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 6
call fcn.0040e8e0
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 9
call fcn.004368f0
mov bl, 8
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.004368f0
push 0x47a7b4
lea ecx, [ebp - 0x18]
call fcn.00436970
push str.BinPath
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xa
call fcn.00436970
lea edx, [ebp - 0x18]
lea ecx, [ebp + 0xc]
push edx
push ecx
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0xb
call fcn.0040ebc0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xa
call fcn.004368f0
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.004368f0
lea edx, [ebp + 0xc]
push edx
call fcn.004067a0
add esp, 4
lea ecx, [ebp + 0xc]
push 0x5c
call fcn.004306a0
lea eax, [ebp - 0x14]
push 0x5c
lea ecx, [ebp - 0x2c]
push eax
push ecx
call fcn.0042fad0
lea edx, [ebp + 0xc]
mov byte [ebp - 4], 0xc
push edx
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00436bc0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xe
call fcn.004368f0
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x18]
push ecx
push edx
call fcn.00406800
add esp, 8
lea ecx, [ebp - 0x18]
call fcn.004368f0
lea eax, [ebp - 0x10]
push str.AiRoboform_Portable.bin
lea ecx, [ebp - 0x18]
push eax
push ecx
call fcn.00436c50
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40f8d8
test al, 0x10
jne 0x40f8d8
mov esi, 1
jmp 0x40f8da
xor esi, esi
lea ecx, [ebp - 0x18]
call fcn.004368f0
test esi, esi
je 0x40f8fd
mov esi, dword [ebp + 8]
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
call fcn.00436750
mov dword [ebp - 0x1c], 1
jmp 0x40f90e
mov esi, dword [ebp + 8]
mov eax, dword [0x4804ec]
mov dword [ebp - 0x1c], 1
mov dword [esi], eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.004368f0
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 4
call fcn.0040e940
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 3
call fcn.004368f0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.004368f0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40f950
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43fc08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
movsx eax, bl
push eax
call fcn.0042435b
add esp, 4
test eax, eax
jne 0x40f98e
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 1
push ebx
lea ecx, [ebp - 0x18]
call fcn.0042fa80
push 0x47a7e4
lea ecx, [ebp - 0x14]
push eax
push ecx
mov dword [ebp - 4], 0
call fcn.00436c50
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40f9c8
test al, 0x10
je 0x40f9c8
mov eax, 1
jmp 0x40f9ca
xor eax, eax
test eax, eax
lea ecx, [ebp - 0x14]
sete bl
call fcn.004368f0
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.004368f0
test bl, bl
je 0x40f9fb
xor eax, eax
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push esi
lea eax, [ebp - 0x10]
push edx
push eax
call fcn.0040f760
mov edx, dword [ebp - 0x10]
add esp, 8
xor ecx, ecx
mov eax, dword [edx - 8]
test eax, eax
setne cl
mov esi, ecx
lea ecx, [ebp - 0x10]
call fcn.004368f0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40fa40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43fcad
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x14], 0
call fcn.00415700
test eax, eax
je 0x40fa87
mov ebx, 1
push ebx
call fcn.00415920
push eax
lea ecx, [ebp - 0x24]
call fcn.0042fa80
mov dword [ebp - 0x14], ebx
jmp 0x40faa7
mov eax, dword [ebp + 0xc]
push 1
mov ecx, dword [eax]
mov dl, byte [ecx]
lea ecx, [ebp - 0x20]
mov byte [ebp - 0x1c], dl
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0042fa80
mov ebx, 2
mov dword [ebp - 0x14], ebx
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.00436750
test bl, 2
mov dword [ebp - 4], 5
je 0x40facd
and ebx, 0xfffffffd
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x14], ebx
call fcn.004368f0
test bl, 1
mov dword [ebp - 4], 4
je 0x40fae7
and ebx, 0xfffffffe
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], ebx
call fcn.004368f0
push 0x47a7e8
lea ecx, [ebp - 0x2c]
call fcn.00436970
mov esi, eax
push 0x47a7f8
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.00436970
lea ecx, [ebp - 0x18]
push eax
lea edx, [ebp - 0x1c]
push ecx
push edx
mov byte [ebp - 4], 7
call fcn.00436bc0
push esi
push eax
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 8
push eax
call fcn.00436bc0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xc
call fcn.004368f0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xb
call fcn.004368f0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xa
call fcn.004368f0
mov ecx, dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push ecx
call edi
cmp eax, 0xffffffff
je 0x40fb7a
test al, 0x10
jne 0x40fb7a
mov esi, dword [ebp + 8]
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
call fcn.00436750
or ebx, 4
mov dword [ebp - 0x14], ebx
jmp 0x40fc28
push str.Portable.ini
lea ecx, [ebp - 0x3c]
call fcn.00436970
mov esi, eax
push 0x47a80c
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0xd
call fcn.00436970
push eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x34]
push eax
push ecx
mov byte [ebp - 4], 0xe
call fcn.00436bc0
push esi
lea edx, [ebp - 0x30]
push eax
push edx
mov byte [ebp - 4], 0xf
call fcn.00436bc0
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x10
call fcn.00436a80
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xf
call fcn.004368f0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xe
call fcn.004368f0
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0xd
call fcn.004368f0
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0xa
call fcn.004368f0
mov eax, dword [ebp - 0x10]
push eax
call edi
cmp eax, 0xffffffff
je 0x40fc17
test al, 0x10
jne 0x40fc17
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
call fcn.00436750
jmp 0x40fc22
mov esi, dword [ebp + 8]
mov edx, dword [0x4804ec]
mov dword [esi], edx
or ebx, 4
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.004368f0
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.004368f0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret