joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404350
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421618
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4360c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
push ecx
push 0
push 0x80
push 3
push 1
push 0x80000000
push ecx
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
call fcn.00401ee0
test eax, eax
js 0x404422
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov dword [ebp - 0x20], edi
cmp edi, 0xffffffff
jne 0x4043d0
call fcn.00401ec0
test eax, eax
js 0x404422
mov edi, dword [ebp - 0x20]
cmp edi, 0x5c
jb 0x404422
push edi
call fcn.0041314d
add esp, 4
lea ecx, [ebp - 0x14]
push edi
push eax
mov dword [ebx], eax
call fcn.00402840
mov edx, dword [ebx]
cmp dword [edx], 0x7d1ea609
jne 0x404412
mov esi, dword [edx + 0x48]
push edi
mov dword [edx + 0x48], 0
call fcn.00410600
add esp, 4
cmp eax, esi
jne 0x404412
mov esi, 1
jmp 0x404424
push dword [ebx]
call fcn.00414286
add esp, 4
mov dword [ebx], 0
xor esi, esi
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x404432
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409aa0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4385d0]
sub esp, 0x18
cmp eax, dword [section.Shared]
jne 0x409b4a
push esi
mov esi, dword [ebp + 0xc]
push edi
movzx eax, byte [esi + 4]
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
movzx eax, byte [esi + 5]
add eax, 4
lea edx, [ebp - 0xc]
lea eax, [esi + eax*2]
mov dword [ebp - 8], eax
movzx eax, byte [edi + 4]
mov dword [ebp - 0x18], eax
movzx eax, byte [edi + 5]
add eax, 4
lea ecx, [ebp - 0x18]
lea eax, [edi + eax*2]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
call fcn.00408ac0
mov ecx, eax
test ecx, ecx
jne 0x409b3b
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x18]
call fcn.00408a00
mov ecx, eax
test ecx, ecx
jne 0x409b3b
mov eax, dword [edi]
mov edx, dword [esi]
cmp eax, edx
jbe 0x409b31
or ecx, 0xffffffff
xor eax, eax
test ecx, ecx
pop edi
sets al
pop esi
mov esp, ebp
pop ebp
ret 8
mov esi, 1
cmp eax, edx
cmovb ecx, esi
xor eax, eax
test ecx, ecx
pop edi
sets al
pop esi
mov esp, ebp
pop ebp
ret 8
push 1
call fcn.00414788
int3

Function at 0x40a520
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov ebx, edx
push edi
mov edi, ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edi
lea eax, [ebx - 1]
cdq
sub eax, edx
mov esi, eax
sar esi, 1
cmp dword [ebp + 8], ebx
jge 0x40a5bb
mov eax, dword [ebp + 0xc]
mov edi, dword [edi + esi*4]
mov ebx, dword [eax]
mov eax, dword [section.Shared]
cmp dword [0x4385d0], eax
jne 0x40a5e4
movzx eax, byte [ebx + 4]
mov dword [ebp - 0x14], eax
movzx eax, byte [ebx + 5]
add eax, 4
lea edx, [ebp - 0x14]
lea eax, [ebx + eax*2]
mov dword [ebp - 0x10], eax
movzx eax, byte [edi + 4]
mov dword [ebp - 0x20], eax
movzx eax, byte [edi + 5]
add eax, 4
lea ecx, [ebp - 0x20]
lea eax, [edi + eax*2]
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
call fcn.00408ac0
test eax, eax
jne 0x40a5ca
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x20]
call fcn.00408a00
test eax, eax
jne 0x40a5ca
mov eax, dword [edi]
cmp eax, dword [ebx]
ja 0x40a5cc
mov edi, dword [ebp - 4]
mov ebx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [edi + ebx*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jns 0x40a5b5
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov ebx, esi
mov dword [ecx + eax*4], edi
mov dword [ebp - 8], ebx
lea eax, [esi - 1]
mov edi, ecx
jmp 0x40a536
push 1
call fcn.00414788
int3
Function at 0x40a600
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x4360c0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x414]
push eax
push 0x100
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x40a642
call fcn.00401ec0
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413156
mov esp, ebp
pop ebp
ret 8
cmp eax, 0x100
jbe 0x40a65f
mov eax, 0x80020013
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413156
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x432908
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x40a62c
push esi
xor eax, eax
mov word [ebp - 6], ax
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
push eax
lea esi, [edi + 8]
push 0x101
push esi
call fcn.0041479c
push eax
call fcn.00402670
add esp, 0x10
lea eax, [ebp - 0x420]
push eax
push 0x2100
push 2
push 0
push 0x40000000
push esi
mov ecx, edi
mov dword [ebp - 0x420], 0xc
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x418], 1
mov dword [edi + 0x20c], 0x40000000
call fcn.00401ee0
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop edi
call fcn.00413156
mov esp, ebp
pop ebp
ret 8

Function at 0x40a700
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
test eax, eax
je 0x40a71a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov edi, dword [ebp + 8]
test edi, edi
jne 0x40a733
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40a756
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40a756
mov ecx, eax
call fcn.0040a5f0
pop edi
pop esi
pop ebp
ret 4
push edi
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x40a72b
call fcn.00401ec0
pop edi
pop esi
pop ebp
ret 4
Function at 0x40d5e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x40d673
mov esi, dword [ebp + 8]
push edi
push esi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp + 0x10], 0
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test esi, esi
je 0x40d66d
mov ecx, dword [edi]
test ecx, ecx
je 0x40d668
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x40d658
cmp edx, 2
jbe 0x40d649
cmp edx, 7
jne 0x40d658
test cl, 1
jne 0x40d658
shr ecx, 1
cmp ecx, 1
jb 0x40d658
cmp word [esi + ecx*2 - 2], 0
jne 0x40d658
cmp ecx, 1
jbe 0x40d66d
cmp word [esi + ecx*2 - 4], 0
jmp 0x40d656
test cl, 1
jne 0x40d658
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x40d66d
xor eax, eax
mov word [esi], ax
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor ecx, ecx
mov word [esi], cx
pop edi
pop esi
pop ebp
ret 0xc
push 0x80004005
call fcn.00401e80
int3

Function at 0x40d680
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4360c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.00414e20
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x40d6df
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40d704
cmp dword [ebp - 0x11c], 6
jne 0x40d704
cmp dword [ebp - 0x118], 0
jne 0x40d704
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413156
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00413156
mov esp, ebp
pop ebp
ret

Function at 0x40d720
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4360c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.00414e20
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x40d77f
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40d7a4
cmp dword [ebp - 0x11c], 6
jne 0x40d7a4
cmp dword [ebp - 0x118], 1
jb 0x40d7a4
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413156
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00413156
mov esp, ebp
pop ebp
ret
Function at 0x40d7c0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4360c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.00414e20
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x40d81f
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40d844
cmp dword [ebp - 0x11c], 6
jne 0x40d844
cmp dword [ebp - 0x118], 2
jb 0x40d844
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413156
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00413156
mov esp, ebp
pop ebp
ret
Function at 0x40dd80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4360c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
test edi, edi
je 0x40de65
lea eax, [ebp - 0x214]
push eax
push 0x20019
push 0
push ecx
push 0x80000002
mov dword [ebp - 0x214], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40de65
cmp dword [ebp - 0x214], eax
je 0x40de65
push 0x20a
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00414e20
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push ebx
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x20b
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40de59
push 0x103
lea eax, [ebp - 0x210]
push eax
push edi
call fcn.004137b4
add esp, 0xc
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413156
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00413156
mov esp, ebp
pop ebp
ret
Function at 0x40de80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421e08
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x4360c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x54], edi
mov dword [ebp - 4], edi
call fcn.0040d680
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40df2f
call fcn.0040d720
test eax, eax
jne 0x40df2f
lea eax, [ebp - 0x48]
push eax
push 0x20019
push edi
push str.SOFTWARETencentQQPinyinJ2FSwitchCount
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e021
lea eax, [ebp - 0x50]
push eax
push esi
lea eax, [ebp - 0x4c]
push eax
push edi
push str.value
push dword [ebp - 0x48]
mov dword [ebp - 0x4c], 4
mov dword [ebp - 0x50], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x48]
mov esi, eax
call ebx
xor ebx, ebx
test esi, esi
sete bl
jmp 0x40e023
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], 1
push 0x28
push str.SOFTWARETencentQQPinyinJ2FSwitchCount
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], eax
mov word [ebp - 0x44], ax
call fcn.0040ea00
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.0040d860
cmp dword [ebp - 0x30], 8
mov edi, eax
jb 0x40df86
push dword [ebp - 0x44]
call fcn.00413962
add esp, 4
xor eax, eax
cmp dword [ebp - 0x18], 8
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push 0x2001f
push eax
push edi
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], 0
call fcn.0040d530
test eax, eax
jne 0x40e00d
mov edi, dword [ebp - 0x5c]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x4c]
push eax
push esi
lea eax, [ebp - 0x48]
push eax
push 0
push str.value
push edi
mov dword [ebp - 0x4c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x48], 4
mov esi, eax
mov eax, 0xd
cmovne esi, eax
test edi, edi
je 0x40dff3
push edi
call ebx
xor edi, edi
xor ebx, ebx
test esi, esi
sete bl
cmp dword [ebp - 0x18], 8
jb 0x40e023
push dword [ebp - 0x2c]
call fcn.00413962
add esp, 4
jmp 0x40e023
cmp dword [ebp - 0x18], 8
jb 0x40e01e
push dword [ebp - 0x2c]
call fcn.00413962
add esp, 4
mov edi, dword [ebp - 0x5c]
xor ebx, ebx
test edi, edi
je 0x40e02e
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00413156
mov esp, ebp
pop ebp
ret
Function at 0x40e3f0
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421d82
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x4360c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x220], 0
mov eax, dword [0x436e84]
mov ecx, 0x436e84
mov dword [ebp - 0x224], esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 4], 0
push 0x20a
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
mov dword [ebp - 0x220], 1
call fcn.00414e20
add esp, 0xc
lea eax, [ebp - 0x21c]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x21c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e492
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.00402320
mov edx, dword [esi]
mov ecx, dword [edx - 0xc]
test ecx, ecx
jle 0x40e4f8
lea eax, [ecx - 1]
test eax, eax
js 0x40e514
cmp eax, ecx
jg 0x40e514
cmp word [edx + eax*2], 0x5c
je 0x40e4d4
push 0x5c
mov ecx, esi
call fcn.00402140
push 0x11
push str.TencentQQPinyin_
mov ecx, esi
call fcn.004021e0
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40e4f8
push eax
push dword [esi]
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413156
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00401e80
int3

Function at 0x40efa0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4360c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x43a554]
push esi
mov esi, ecx
mov dword [ebp - 0x214], 0
test al, 1
jne 0x40eff3
or eax, 1
mov dword [0x43a554], eax
mov eax, dword [0x436e84]
mov ecx, 0x436e84
call dword [eax + 0xc]
add eax, 0x10
push 0x422450
mov dword [0x43a55c], eax
call fcn.00413923
add esp, 4
mov eax, dword [0x43a55c]
cmp dword [eax - 0xc], 0
jne 0x40f066
xor eax, eax
push 0x20a
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00414e20
add esp, 0xc
lea eax, [ebp - 0x210]
push 1
push 0x25
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
jmp 0x40f040
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f040
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x210]
push eax
mov ecx, 0x43a55c
call fcn.00402320
mov eax, dword [0x43a55c]
add eax, 0xfffffff0
push eax
call fcn.00407780
mov ecx, dword [ebp - 4]
add eax, 0x10
add esp, 4
mov dword [esi], eax
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00413156
mov esp, ebp
pop ebp
ret
Function at 0x40f090
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4360c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x43a558]
push esi
mov esi, ecx
mov dword [ebp - 0x214], 0
test al, 1
jne 0x40f0e3
or eax, 1
mov dword [0x43a558], eax
mov eax, dword [0x436e84]
mov ecx, 0x436e84
call dword [eax + 0xc]
add eax, 0x10
push 0x422480
mov dword [0x43a560], eax
call fcn.00413923
add esp, 4
mov eax, dword [0x43a560]
cmp dword [eax - 0xc], 0
jne 0x40f156
xor eax, eax
push 0x20a
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00414e20
add esp, 0xc
lea eax, [ebp - 0x210]
push 1
push 0x24
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
jmp 0x40f130
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f130
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x210]
push eax
mov ecx, 0x43a560
call fcn.00402320
mov eax, dword [0x43a560]
add eax, 0xfffffff0
push eax
call fcn.00407780
mov ecx, dword [ebp - 4]
add eax, 0x10
add esp, 4
mov dword [esi], eax
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00413156
mov esp, ebp
pop ebp
ret
Function at 0x40f920
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp - 8]
push eax
xorps xmm0, xmm0
push esi
mov edi, ecx
movlpd qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0xc]
cmp ecx, 0xffffffff
jne 0x40f96b
test eax, eax
je 0x40f96b
jle 0x40f9f3
movzx eax, ax
or eax, 0x80070000
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c
push dword [ebp + 0x20]
push ecx
push dword [ebp - 8]
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, eax
mov dword [edi + 8], ecx
test ecx, ecx
jne 0x40f993
call fcn.00401ec0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c
mov eax, dword [ebp - 0xc]
push 0
push eax
mov dword [edi + 0x10], 0
push dword [edi + 0x10]
mov dword [edi + 0x14], 0
push dword [edi + 0x14]
mov dword [edi + 4], eax
push 4
push ecx
mov dword [edi + 0x18], 4
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov dword [edi], eax
test eax, eax
jne 0x40f9f1
call fcn.00401ec0
push dword [edi + 8]
mov esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], 0
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x40fa00
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x20]
push edi
mov edi, ecx
test esi, esi
je 0x40fa33
lea eax, [ebp - 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
sub esp, 0xc
mov ecx, edi
push eax
push esi
mov dword [ebp - 0xc], eax
call fcn.0040fa90
test eax, eax
jns 0x40fa81
push esi
sub esp, 0x14
mov ecx, edi
push ebx
call fcn.0040f920
mov ebx, eax
test ebx, ebx
js 0x40fa7f
mov esi, dword [edi + 8]
push 4
mov ecx, esi
call fcn.0040f710
add esp, 4
test eax, eax
jne 0x40fa5f
mov ecx, esi
call fcn.0040f890
call fcn.0040d7c0
test eax, eax
je 0x40fa7f
push 4
mov ecx, esi
call fcn.0040f7d0
add esp, 4
test eax, eax
jne 0x40fa7f
mov ecx, esi
call fcn.0040f890
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x410140
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push ecx
push 0
push 0x80
push 2
push 1
push 0xc0000000
push dword [ebp + 8]
mov esi, ecx
call fcn.00401ee0
test eax, eax
js 0x4101da
lea eax, [ebp - 8]
push eax
push dword [esi]
mov dword [esi + 8], 1
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
jne 0x41018d
call fcn.00401ec0
test eax, eax
js 0x410192
mov eax, dword [ebp - 0xc]
or eax, dword [ebp - 8]
jne 0x4101b6
push 0
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp + 8]
push eax
push dword [esi]
mov dword [ebp + 8], 0xfeff
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4101b6
call fcn.00401ec0
push 2
lea eax, [ebp - 8]
push eax
push 0
push dword [esi]
xorps xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4101d8
call fcn.00401ec0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4101f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421fe8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4360c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 8], 0
jne 0x410287
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
push dword [ebp + 8]
call fcn.004103a0
push 2
push ecx
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0
call fcn.00410540
mov eax, dword [ebp + 0xc]
push 0
lea ecx, [ebp + 8]
push ecx
push dword [eax - 0xc]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41025f
call fcn.00401ec0
mov esi, eax
jmp 0x410261
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4102d1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4102d1
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 0xc]
add eax, eax
push eax
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4102ad
call fcn.00401ec0
mov esi, eax
test esi, esi
js 0x4102d1
push 0
lea eax, [ebp + 8]
push eax
push 4
push 0x42e0c8
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4102cf
call fcn.00401ec0
mov esi, eax
jmp 0x4102d1
xor esi, esi
xor eax, eax
test esi, esi
setns al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8