joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403a30
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x52055b
mov eax, dword fs:[0]
push eax
sub esp, 0x308
mov eax, dword [0x56b338]
xor eax, esp
mov dword [esp + 0x300], eax
push ebx
push esi
push edi
mov eax, dword [0x56b338]
xor eax, esp
push eax
lea eax, [esp + 0x318]
mov dword fs:[0], eax
mov eax, ecx
cmp dword [eax + 0x1c], 8
jb 0x403a7d
mov eax, dword [eax + 8]
jmp 0x403a80
add eax, 8
push eax
push str.CRunCloudTaskCmd_cmd___s
call fcn.0041a280
xor ebx, ebx
push 0x206
lea eax, [esp + 0x112]
push ebx
push eax
mov word [esp + 0x118], bx
call fcn.00436020
add esp, 0x14
xor eax, eax
lea ecx, [ecx]
movzx ecx, word [eax + str.SmartCloudWB]
mov word [esp + eax + 0x104], cx
add eax, 2
cmp cx, bx
jne 0x403ab0
lea edi, [esp + 0x104]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x403ad1
mov ecx, 6
mov esi, 0x560e78
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x104]
push ecx
push 1
push ebx
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [esp + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
cmp eax, 0xb7
setne dl
mov eax, edx
mov dword [esp + 0x14], eax
cmp eax, ebx
mov dword [esp + 0x320], ebx
jne 0x403b3c
cmp esi, ebx
je 0x403b35
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x403bbd
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xc
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push str.RunCloudTask
mov byte [ecx + 4], bl
call fcn.004054c0
call fcn.004085f0
add esp, 0x20
lea eax, [esp + 0x1c]
push eax
call fcn.0042c640
lea ecx, [esp + 0xfc]
push ecx
push ebx
lea edx, [esp + 0x24]
push edx
push 0x42c720
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
mov dword [esp + 0x100], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x1c]
call fcn.0042c6b0
cmp esi, ebx
je 0x403bb8
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [esp + 0x318]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x300]
xor ecx, esp
call fcn.0042f3aa
mov esp, ebp
pop ebp
ret
Function at 0x403bf0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x520516
mov eax, dword fs:[0]
push eax
sub esp, 0x308
mov eax, dword [0x56b338]
xor eax, esp
mov dword [esp + 0x300], eax
push ebx
push esi
push edi
mov eax, dword [0x56b338]
xor eax, esp
push eax
lea eax, [esp + 0x318]
mov dword fs:[0], eax
mov eax, ecx
cmp dword [eax + 0x1c], 8
jb 0x403c3d
mov eax, dword [eax + 8]
jmp 0x403c40
add eax, 8
push eax
push str.CRunOnceTaskCmd_cmd___s
call fcn.0041a280
xor ebx, ebx
push 0x206
lea eax, [esp + 0x112]
push ebx
push eax
mov word [esp + 0x118], bx
call fcn.00436020
add esp, 0x14
xor eax, eax
lea ecx, [ecx]
movzx ecx, word [eax + str.SmartCloudWB]
mov word [esp + eax + 0x104], cx
add eax, 2
cmp cx, bx
jne 0x403c70
lea eax, [esp + 0x104]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x403c91
mov ecx, dword [0x560e48]
mov edx, dword [0x560e4c]
mov dword [eax], ecx
mov ecx, dword [0x560e50]
mov dword [eax + 4], edx
mov edx, dword [0x560e54]
mov dword [eax + 8], ecx
mov ecx, dword [0x560e58]
mov dword [eax + 0xc], edx
mov edx, dword [0x560e5c]
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], edx
lea eax, [esp + 0x104]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
mov eax, ecx
mov dword [esp + 0x14], eax
cmp eax, ebx
mov dword [esp + 0x320], ebx
jne 0x403d23
cmp edi, ebx
je 0x403d1c
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x403de1
call fcn.004024a0
test al, al
je 0x403d31
call fcn.00402500
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xb
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push str.RunOnceTask
mov byte [ecx + 4], bl
call fcn.004054c0
call fcn.004085f0
add esp, 0x20
lea edx, [esp + 0x1c]
push edx
call fcn.0042c640
lea ecx, [esp + 0x1c]
mov byte [esp + 0x320], 1
call fcn.0042d060
lea esi, [esp + 0x1c]
call fcn.0042d540
test al, al
je 0x403dc1
push 1
mov eax, esi
push eax
lea ecx, [esp + 0x34]
call fcn.0042c830
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x34]
lea ecx, [esp + 0x70]
call fcn.004020b0
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x54]
lea ecx, [esp + 0x90]
call fcn.004020b0
mov cl, byte [esp + 0x48]
mov byte [esp + 0x84], cl
lea eax, [esp + 0x1c]
call fcn.0042c6b0
cmp edi, ebx
je 0x403ddc
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [esp + 0x318]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x300]
xor ecx, esp
call fcn.0042f3aa
mov esp, ebp
pop ebp
ret
Function at 0x403e10
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x520516
mov eax, dword fs:[0]
push eax
sub esp, 0x308
mov eax, dword [0x56b338]
xor eax, esp
mov dword [esp + 0x300], eax
push ebx
push esi
push edi
mov eax, dword [0x56b338]
xor eax, esp
push eax
lea eax, [esp + 0x318]
mov dword fs:[0], eax
mov eax, ecx
cmp dword [eax + 0x1c], 8
jb 0x403e5d
mov eax, dword [eax + 8]
jmp 0x403e60
add eax, 8
push eax
push str.CRunDateTaskCmd_cmd___s
call fcn.0041a280
xor ebx, ebx
push 0x206
lea eax, [esp + 0x112]
push ebx
push eax
mov word [esp + 0x118], bx
call fcn.00436020
add esp, 0x14
xor eax, eax
lea ecx, [ecx]
movzx ecx, word [eax + str.SmartCloudWB]
mov word [esp + eax + 0x104], cx
add eax, 2
cmp cx, bx
jne 0x403e90
lea eax, [esp + 0x104]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x403eb1
mov ecx, dword [0x560e60]
mov edx, dword [0x560e64]
mov dword [eax], ecx
mov ecx, dword [0x560e68]
mov dword [eax + 4], edx
mov edx, dword [0x560e6c]
mov dword [eax + 8], ecx
mov ecx, dword [0x560e70]
mov dword [eax + 0xc], edx
mov edx, dword [0x560e74]
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], edx
lea eax, [esp + 0x104]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
mov eax, ecx
mov dword [esp + 0x14], eax
cmp eax, ebx
mov dword [esp + 0x320], ebx
jne 0x403f43
cmp edi, ebx
je 0x403f3c
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x403ff3
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xb
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push str.RunDateTask
mov byte [ecx + 4], bl
call fcn.004054c0
call fcn.004085f0
add esp, 0x20
lea edx, [esp + 0x1c]
push edx
call fcn.0042c640
lea ecx, [esp + 0x1c]
mov byte [esp + 0x320], 1
call fcn.0042d060
lea esi, [esp + 0x1c]
call fcn.0042d540
test al, al
je 0x403fd3
push 1
mov eax, esi
push eax
lea ecx, [esp + 0x34]
call fcn.0042c830
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x34]
lea ecx, [esp + 0x70]
call fcn.004020b0
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x54]
lea ecx, [esp + 0x90]
call fcn.004020b0
mov cl, byte [esp + 0x48]
mov byte [esp + 0x84], cl
lea eax, [esp + 0x1c]
call fcn.0042c6b0
cmp edi, ebx
je 0x403fee
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [esp + 0x318]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x300]
xor ecx, esp
call fcn.0042f3aa
mov esp, ebp
pop ebp
ret
Function at 0x4092a0
Capabilities:
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x51f1f8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x56b338]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x3c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.kernel32
mov dword [0x578a6c], eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.IsWow64Process
push edi
call esi
push str.Wow64DisableWow64FsRedirection
push edi
mov dword [esp + 0x18], eax
call esi
push str.Wow64RevertWow64FsRedirection
push edi
mov dword [esp + 0x1c], eax
call esi
lea edi, [esp + 0x10]
mov dword [esp + 0x18], eax
call fcn.0040bd00
test al, al
je 0x40938b
push str.WOW64FSRedirHolder_true
call fcn.0041a020
add esp, 4
push str.kernel32
call ebx
mov edi, eax
push str.IsWow64Process
push edi
call esi
push str.Wow64DisableWow64FsRedirection
push edi
mov dword [esp + 0x24], eax
call esi
push str.Wow64RevertWow64FsRedirection
push edi
mov dword [esp + 0x28], eax
call esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x40935e
lea ecx, [esp + 0x28]
push ecx
call eax
mov dword [esp + 0x34], 0
call fcn.004045c0
push eax
call fcn.00401230
mov dword [esp + 0x34], 0xffffffff
cmp dword [esp + 0x20], 0
je 0x4093a3
mov edx, dword [esp + 0x28]
push edx
call dword [esp + 0x28]
jmp 0x4093a3
push str.WOW64FSRedirHolder_false
call fcn.0041a020
add esp, 4
call fcn.004045c0
push eax
call fcn.00401230
mov ecx, dword [esp + 0x44]
lea ebx, [esp + 0x3c]
call fcn.004023c0
xor eax, eax
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret 0x10

Function at 0x40a3a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40a3b7
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40a3e8
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x40a3e4
cmp esi, eax
jae 0x40a3e8
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x40a3d4
cmp esi, eax
jb 0x40a3ee
pop esi
pop edi
xor eax, eax
pop ebp
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x40bd60
Capabilities:
Encode data using base64

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov edi, dword [esp + 0x14]
test edi, edi
mov esi, eax
je 0x40bed9
lea ecx, [edi*8]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
add ecx, ecx
mov edx, ecx
lea ecx, [edi*8]
sub ecx, edx
sub ecx, 2
je 0x40bdaa
sub ecx, 2
jne 0x40bdad
add eax, 2
jmp 0x40bdad
add eax, 3
add eax, 1
cmp dword [ebx], eax
jge 0x40bdc0
pop edi
mov dword [ebx], eax
pop esi
mov eax, 0xfffffff0
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x18]
mov eax, 0x55555556
imul edi
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*2]
xor edx, edx
test eax, eax
push ebp
jle 0x40be6e
lea edx, [eax - 1]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
add edx, 1
lea eax, [edx + edx*2]
mov dword [esp + 0x10], eax
movzx eax, byte [esi]
movzx ebp, byte [esi + 1]
mov ebx, eax
sar ebx, 2
add esi, 1
movzx edi, byte [esi + 1]
and ebx, 0x3f
mov bl, byte [ebx + 0x562180]
mov byte [ecx], bl
add esi, 1
shl eax, 4
mov ebx, ebp
sar ebx, 4
add ebx, eax
and ebx, 0x3f
movzx eax, byte [ebx + 0x562180]
mov byte [ecx + 1], al
add ecx, 1
mov eax, edi
sar eax, 6
lea eax, [eax + ebp*4]
and eax, 0x3f
movzx eax, byte [eax + 0x562180]
add ecx, 1
mov byte [ecx], al
and edi, 0x3f
movzx eax, byte [edi + 0x562180]
add ecx, 1
mov byte [ecx], al
add esi, 1
add ecx, 1
sub edx, 1
jne 0x40bdf6
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
cmp edx, edi
jge 0x40becd
movzx eax, byte [esi]
lea ebp, [edx + 1]
cmp ebp, edi
jge 0x40be82
movzx esi, byte [esi + 1]
jmp 0x40be84
xor esi, esi
mov edx, eax
sar edx, 2
and edx, 0x3f
mov dl, byte [edx + 0x562180]
mov byte [ecx], dl
mov edx, esi
sar edx, 4
shl eax, 4
add edx, eax
and edx, 0x3f
mov al, byte [edx + 0x562180]
add ecx, 1
mov byte [ecx], al
add ecx, 1
cmp ebp, edi
jge 0x40bec1
and esi, 0xf
mov dl, byte [esi*4 + 0x562180]
mov byte [ecx], dl
jmp 0x40bec4
mov byte [ecx], 0x3d
add ecx, 1
mov byte [ecx], 0x3d
add ecx, 1
mov eax, ecx
sub eax, dword [esp + 0x1c]
pop ebp
mov dword [ebx], eax
mov byte [ecx], 0
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x40bee0
Capabilities:
Encode data using base64

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, eax
xor ebp, ebp
xor esi, esi
xor edx, edx
test edi, edi
jle 0x40c020
mov dword [esp + 0x10], edi
lea ecx, [ecx]
cmp dword [esp + 0x10], 2
jl 0x40bf1f
movzx eax, byte [edx + ebx]
cmp eax, 0x2f72
jne 0x40bf1f
movzx ecx, byte [edx + ebx + 1]
cmp ecx, 0x2f6e
je 0x40bf54
mov al, byte [edx + ebx]
movzx ecx, al
cmp ecx, 0x2f6e
je 0x40bf54
cmp al, 0x3d
jne 0x40bf39
add esi, 1
cmp esi, 2
jg 0x40bf88
cmp al, 0x7f
ja 0x40bf88
mov cl, byte [ecx + 0x5621c0]
cmp cl, 0x7f
je 0x40bf88
cmp cl, 0x40
jae 0x40bf51
test esi, esi
jne 0x40bf88
add ebp, 1
sub dword [esp + 0x10], 1
add edx, 1
cmp edx, edi
jl 0x40bf00
test ebp, ebp
je 0x40c020
mov ecx, dword [esp + 0x20]
lea eax, [ebp + ebp*2]
lea eax, [eax + eax + 7]
sar eax, 3
cmp dword [ecx], eax
jge 0x40bf93
pop edi
pop esi
pop ebp
mov dword [ecx], eax
mov eax, 0xfffffff0
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
mov eax, 0xffffffee
pop ebx
pop ecx
ret
mov esi, dword [esp + 0x1c]
xor ecx, ecx
xor edi, edi
test edx, edx
mov ebp, 3
jle 0x40c016
movzx eax, byte [ebx]
cmp eax, 0x2f72
je 0x40c008
cmp eax, 0x2f6e
je 0x40c008
movzx eax, byte [eax + 0x5621c0]
xor ebx, ebx
cmp al, 0x40
sete bl
shl ecx, 6
and eax, 0x3f
or eax, ecx
add edi, 1
mov ecx, eax
sub ebp, ebx
cmp edi, 4
jne 0x40c004
xor edi, edi
test ebp, ebp
jle 0x40bfe5
shr eax, 0x10
mov byte [esi], al
add esi, 1
cmp ebp, 1
jle 0x40bff4
mov eax, ecx
shr eax, 8
mov byte [esi], al
add esi, 1
cmp ebp, 2
mov ebx, dword [esp + 0x18]
jle 0x40c008
mov byte [esi], cl
add esi, 1
jmp 0x40c008
mov ebx, dword [esp + 0x18]
sub edx, 1
add ebx, 1
test edx, edx
mov dword [esp + 0x18], ebx
jg 0x40bfa4
sub esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [ecx], esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x40c6a0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ecx
push ebp
push esi
push edi
mov edi, eax
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40c6b0
sub eax, edx
sar eax, 1
mov ebp, eax
xor ecx, ecx
lea eax, [ebp + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042e6e8
mov esi, eax
mov edx, esi
add esp, 4
mov eax, edi
sub edx, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x40c6e5
xor edi, edi
test ebp, ebp
mov byte [esp + 0xf], 1
jl 0x40c74d
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp word [esi + edi*2], 0x5c
jne 0x40c72c
push esi
mov word [esi + edi*2], 0
call ebx
test eax, eax
jne 0x40c726
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40c747
mov word [esi + edi*2], 0x5c
add edi, 1
cmp edi, ebp
jle 0x40c706
pop ebx
push esi
call fcn.0042fb39
movzx eax, byte [esp + 0x13]
add esp, 4
pop edi
pop esi
pop ebp
pop ecx
ret
mov byte [esp + 0x13], 0
pop ebx
push esi
call fcn.0042fb39
movzx eax, byte [esp + 0x13]
add esp, 4
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x40cb10
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x51dfb6
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x56b338]
xor eax, esp
mov dword [esp + 0x268], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56b338]
xor eax, esp
push eax
lea eax, [esp + 0x280]
mov dword fs:[0], eax
xor ebx, ebx
cmp edx, ebx
je 0x40ccd9
mov eax, edx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
lea esi, [eax + 2]
jmp 0x40cb70
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40cb70
sub eax, esi
sar eax, 1
push eax
push edx
lea esi, [esp + 0x1c]
call fcn.004021f0
mov eax, esi
push eax
mov dword [esp + 0x28c], ebx
call fcn.0040d600
add esp, 4
push 0x228
lea ecx, [esp + 0x54]
push ebx
push ecx
mov dword [esp + 0x58], ebx
call fcn.00436020
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x40cbcc
cmp dword [esp + 0x2c], 8
jmp 0x40ccca
lea eax, [esp + 0x4c]
push eax
push ebp
mov dword [esp + 0x54], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40ccba
jmp 0x40cbf0
lea eax, [esp + 0x70]
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], ebx
mov word [esp + 0x34], bx
lea edx, [eax + 2]
jmp 0x40cc10
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40cc10
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x74]
push ecx
lea esi, [esp + 0x38]
call fcn.004021f0
mov edx, esi
push edx
mov byte [esp + 0x28c], 1
call fcn.0040d600
mov eax, dword [esp + 0x1c]
mov esi, 8
add esp, 4
cmp dword [esp + 0x2c], esi
jae 0x40cc54
lea eax, [esp + 0x18]
mov edi, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x34]
call fcn.00404b90
test eax, eax
je 0x40cc99
mov byte [esp + 0x288], bl
cmp dword [esp + 0x48], esi
jb 0x40cc84
mov eax, dword [esp + 0x34]
push eax
call fcn.0042f3a5
add esp, 4
lea ecx, [esp + 0x4c]
push ecx
push ebp
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40cbf0
jmp 0x40ccbf
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x54]
lea ecx, [esp + 0x30]
call fcn.004022c0
lea ecx, [esp + 0x14]
call fcn.004022c0
mov eax, esi
jmp 0x40ccdb
mov esi, 8
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x2c], esi
jb 0x40ccd9
mov edx, dword [esp + 0x18]
push edx
call fcn.0042f3a5
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x280]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x268]
xor ecx, esp
call fcn.0042f3aa
add esp, 0x278
ret
Function at 0x40e310
Capabilities:
Access peb ldr_data
Hash data with md5

Disassembly:
push 0xffffffffffffffff
push 0x51e973
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x56b338]
xor eax, esp
mov dword [esp + 0x8c], eax
push ebx
push edi
mov eax, dword [0x56b338]
xor eax, esp
push eax
lea eax, [esp + 0x9c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0xa4], ebx
cmp dword [esp + 0xc4], 0x10
mov eax, dword [esp + 0xb0]
mov byte [esp + 0x94], bl
mov dword [esp + 0x40], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x2c], 0x67452301
mov dword [esp + 0x30], 0xefcdab89
mov dword [esp + 0x34], 0x98badcfe
mov dword [esp + 0x38], 0x10325476
jae 0x40e39d
lea eax, [esp + 0xb0]
push eax
mov eax, dword [esp + 0xc4]
lea ecx, [esp + 0x30]
call fcn.00411c40
lea edi, [esp + 0x10]
lea eax, [esp + 0x2c]
call fcn.004126b0
push eax
mov ecx, esi
mov byte [esp + 0xa8], 1
call fcn.0040d310
add esp, 4
cmp dword [esp + 0x28], 0x10
jb 0x40e3e2
mov eax, dword [esp + 0x14]
push eax
call fcn.0042f3a5
add esp, 4
cmp dword [esp + 0xc4], 0x10
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
jb 0x40e40c
mov ecx, dword [esp + 0xb0]
push ecx
call fcn.0042f3a5
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x9c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x8c]
xor ecx, esp
call fcn.0042f3aa
add esp, 0x9c
ret
Function at 0x40e440
Capabilities:
Check if file exists
Write file on windows

Disassembly:
sub esp, 0x82c
mov eax, dword [0x56b338]
xor eax, esp
mov dword [esp + 0x828], eax
push ebx
push esi
xor ebx, ebx
push 0x206
lea eax, [esp + 0x426]
push ebx
push eax
mov word [esp + 0x42c], bx
call fcn.00436020
add esp, 0xc
xor eax, eax
jmp 0x40e480
movzx ecx, word [eax + 0x562718]
mov word [esp + eax + 0x420], cx
add eax, 2
cmp cx, bx
jne 0x40e480
lea ecx, [esp + 0x420]
push ecx
push str._sgswb.log
lea edx, [esp + 0x220]
call fcn.004105e0
push 0x206
lea edx, [esp + 0x636]
push ebx
push edx
mov word [esp + 0x63c], bx
call fcn.00436020
push 0x206
lea eax, [esp + 0x2a]
push ebx
push eax
mov word [esp + 0x30], bx
call fcn.00436020
add esp, 0x20
push 0x104
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x10]
push 0x5c
push edx
call fcn.0042f3fe
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov word [eax], bx
add esp, 8
lea eax, [esp + 0x218]
push eax
call esi
test eax, eax
je 0x40e64d
lea eax, [esp + 0x10]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40e525
sub eax, edx
sar eax, 1
lea eax, [esp + eax*2 + 0x12]
lea edx, [esp + 0x628]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x40e541
push edi
lea ecx, [esp + 0x62c]
push ecx
lea edx, [esp + 0x428]
push edx
push str._s_s.txt
lea edx, [esp + 0x228]
call fcn.004105e0
mov ecx, dword [esp + 0x848]
lea eax, [esp + 0x84c]
push eax
push ecx
push 0xfff
push 0x578a98
call fcn.00432358
add esp, 0x1c
lea edx, [esp + 0x21c]
push edx
mov word [0x57aa96], bx
xor edi, edi
call esi
test eax, eax
je 0x40e5b0
mov edi, 1
lea eax, [esp + 0x21c]
push 0x562754
push eax
call fcn.00432439
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x40e64c
cmp edi, ebx
jne 0x40e5ed
push esi
push 2
lea ecx, [esp + 0x18]
push 1
push ecx
mov dword [esp + 0x20], 0xfeff
call fcn.004325ab
add esp, 0x10
mov eax, 0x578a98
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40e5f5
sub eax, edx
sar eax, 1
push esi
lea edx, [eax + eax]
push edx
push 1
push 0x578a98
call fcn.004325ab
push esi
push 2
lea eax, [esp + 0x24]
push 1
push eax
mov dword [esp + 0x2c], 0xd
call fcn.004325ab
push esi
push 2
lea ecx, [esp + 0x34]
push 1
push ecx
mov dword [esp + 0x3c], 0xa
call fcn.004325ab
push esi
call fcn.0043269f
add esp, 0x34
pop edi
mov ecx, dword [esp + 0x830]
pop esi
pop ebx
xor ecx, esp
call fcn.0042f3aa
add esp, 0x82c
ret
Function at 0x410f60
Capabilities:
Check os version

Disassembly:
sub esp, 0x124
mov eax, dword [0x56b338]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x218]
xor ebp, ebp
cmp dword [esi + 0x214], edi
jbe 0x410f8f
call fcn.0042f791
mov ebx, dword [esi + 0x214]
cmp ebx, dword [esi + 0x218]
jbe 0x410fa2
call fcn.0042f791
cmp ebx, edi
je 0x410fbd
push ebx
mov ebx, dword [esi + 0x218]
mov eax, edi
call fcn.004117a0
add esp, 4
mov dword [esi + 0x218], eax
push 0x114
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00436020
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x24], 2
jne 0x410ff3
push esi
call fcn.00410820
jmp 0x41100a
xor edi, edi
test ebp, ebp
jne 0x41100a
mov ecx, esi
call fcn.00410b80
add edi, 1
cmp edi, 0xa
mov ebp, eax
jl 0x410ff5
mov eax, dword [esi + 0x214]
test eax, eax
je 0x41102d
mov esi, dword [esi + 0x218]
sub esi, eax
mov eax, 0x4bda12f7
imul esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, dword [esp + 0x130]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042f3aa
add esp, 0x124
ret