joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40540c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00402650
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4054a7
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x40bfa0]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x4054a7
cmp eax, 1
je 0x4054c8
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4054a7
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x405474
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x4054a3
xor eax, eax
inc eax
jmp 0x4054e7
cmp edi, eax
jae 0x4054ab
xor eax, eax
jmp 0x4054e7
cmp eax, esi
jae 0x4054b2
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x40bfa0]
jmp 0x4054cb
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404b70
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a328
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x42801c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [ebp - 0x40]
call fcn.00414d60
mov dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push 0x42893c
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00406fe0
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
push eax
call fcn.004039d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00402e70
lea ecx, [ebp - 0x40]
call fcn.00402e30
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
jne 0x404c7e
cmp dword [0x42897c], eax
je 0x404c7a
push ecx
mov ecx, 0x42897c
call fcn.0040d250
mov eax, dword [0x42897c]
cmp byte [eax + 0x54], 0
je 0x404c7a
cmp dword [eax + 0x58], 2
jb 0x404c7a
mov bl, byte [eax + 0x5c]
lea ecx, [ebp - 0x28]
call fcn.00402f20
mov byte [ebp - 4], 2
push 0x41ffe0
call fcn.00403160
add esp, 4
lea ecx, [ebp - 0x28]
push eax
push 0x41ffe0
call fcn.00402f50
push 0x1b
push str.RC::RCFileAssociateInterface::InitIntface
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_rtpsystem_srclibrtglobalutils_fileassoc_rcfileassociateinterface.cpp
lea eax, [ebp - 0x28]
push eax
push ecx
mov ecx, 0x42897c
call fcn.0040e270
test bl, bl
je 0x404c6e
lea eax, [ebp - 0x28]
mov ecx, 0x42897c
push eax
call fcn.0040e8e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00402e70
xor bl, bl
jmp 0x404cfd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Initialize
push eax
call esi
push str.Uninitialize
push dword [edi]
mov dword [edi + 4], eax
call esi
push str.GetSwitchStatus
push dword [edi]
mov dword [edi + 8], eax
call esi
push str.IsAllowedPopup
push dword [edi]
mov dword [edi + 0xc], eax
call esi
push str.NotifyAssocEventWithoutResult
push dword [edi]
mov dword [edi + 0x10], eax
call esi
push str.NotifyAssocEventWithResult
push dword [edi]
mov dword [edi + 0x14], eax
call esi
push str.GetCurrentNotifyAssocEventCount
push dword [edi]
mov dword [edi + 0x18], eax
call esi
push str.TryToCleanDoneAssocEvents
push dword [edi]
mov dword [edi + 0x1c], eax
call esi
push str.ParseFileAssocCloudSettings
push dword [edi]
mov dword [edi + 0x20], eax
call esi
push str.IsHitDatabaseItem
push dword [edi]
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00402e70
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041870e
mov esp, ebp
pop ebp
ret
Function at 0x4054f0
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x42801c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x13c]
push 0x118
push 0
push eax
mov dword [ebp - 0x264], esi
xor bl, bl
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x140], 0x11c
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x405632
cmp dword [ebp - 0x13c], 6
ja 0x405561
jne 0x4055e6
cmp dword [ebp - 0x138], 2
jb 0x4055e6
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x4055e6
push 0x10
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4055e6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4055e6
movups xmm0, xmmword [0x420808]
push eax
movups xmmword [ebp - 0x24], xmm0
movups xmm0, xmmword [0x420818]
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4055e6
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 6]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4055e6
cmp word [esi + 2], ax
jbe 0x4055e6
movzx edx, word [esi + 0x32]
movzx ecx, word [esi + 0x30]
movzx eax, word [esi + 0x36]
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x134], eax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40562c
push 0x118
lea eax, [ebp - 0x258]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x25c], 0x11c
lea eax, [ebp - 0x25c]
push eax
call esi
mov esi, dword [ebp - 0x264]
cmp dword [ebp - 0x13c], 6
jae 0x40564f
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041870e
mov esp, ebp
pop ebp
ret 4
push esi
push 0
push 0x410
mov dword [ebp - 0x260], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x405681
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041870e
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x260]
push eax
push 0xf01ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4056a5
push dword [ebp - 0x260]
call fcn.004056d0
mov bl, al
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov ecx, dword [ebp - 0x260]
test ecx, ecx
je 0x4056bb
push ecx
call esi
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.0041870e
mov esp, ebp
pop ebp
ret 4
Function at 0x4056d0
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x42801c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x13c]
push edi
push 0x118
push 0
push eax
mov dword [ebp - 0x264], esi
xor bl, bl
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x140], 0x11c
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x405811
cmp dword [ebp - 0x13c], 6
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
ja 0x405748
jne 0x4057c9
cmp dword [ebp - 0x138], 2
jb 0x4057c9
push str.kernel32.dll
call edi
mov esi, eax
test esi, esi
je 0x4057c9
push 0x10
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4057c9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4057c9
movups xmm0, xmmword [0x420808]
push eax
movups xmmword [ebp - 0x24], xmm0
movups xmm0, xmmword [0x420818]
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4057c9
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 6]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4057c9
cmp word [esi + 2], ax
jbe 0x4057c9
movzx edx, word [esi + 0x32]
movzx ecx, word [esi + 0x30]
movzx eax, word [esi + 0x36]
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x134], eax
push str.ntdll.dll
call edi
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40580b
push 0x118
lea eax, [ebp - 0x258]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x25c], 0x11c
lea eax, [ebp - 0x25c]
push eax
call esi
mov esi, dword [ebp - 0x264]
cmp dword [ebp - 0x13c], 6
jae 0x40582f
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041870e
mov esp, ebp
pop ebp
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x260]
push eax
push 0
push 0
push 0x19
push esi
mov dword [ebp - 0x260], 0
call edi
push dword [ebp - 0x260]
call fcn.00418e74
mov esi, eax
add esp, 4
test esi, esi
je 0x405898
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x260]
push esi
push 0x19
push dword [ebp - 0x264]
call edi
test eax, eax
je 0x40588f
mov eax, dword [esi]
test eax, eax
je 0x40588f
cmp dword [eax + 8], 0x3000
setae bl
push esi
call fcn.00418e43
add esp, 4
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041870e
mov esp, ebp
pop ebp
ret 4
Function at 0x407d00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a9b8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x42801c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.00402f40
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x407d43
xor al, al
jmp 0x407e67
push esi
lea ecx, [ebp - 0x2c]
call fcn.004045b0
mov dword [ebp - 4], 0
mov edx, 4
lea ecx, [ebp - 0x2c]
call fcn.00406e00
lea ecx, [ebp - 0x2c]
call fcn.00402e30
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x407e54
lea ecx, [ebp - 0x44]
call fcn.00402f20
mov byte [ebp - 4], 1
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x2c]
call fcn.0040c590
test al, al
je 0x407da4
lea ecx, [ebp - 0x44]
call fcn.00402e30
push eax
call edi
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.00402e70
cmp esi, 0xffffffff
jne 0x407e54
lea ecx, [ebp - 0x2c]
call fcn.00402f40
mov esi, dword [eax + 0x10]
cmp esi, 2
jbe 0x407e50
lea ecx, [ebp - 0x2c]
call fcn.00402f40
mov ecx, eax
mov edx, dword [eax + 0x14]
cmp edx, 8
jb 0x407de1
mov ecx, dword [eax]
cmp word [ecx + esi*2 - 2], 0x5c
je 0x407df8
cmp edx, 8
jb 0x407df0
mov eax, dword [eax]
cmp word [eax + esi*2 - 2], 0x2f
jne 0x407e50
mov edx, 0x20
lea ecx, [ebp - 0x2c]
call fcn.00406e00
lea ecx, [ebp - 0x2c]
call fcn.00402e30
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x407e54
lea ecx, [ebp - 0x44]
call fcn.00402f20
mov byte [ebp - 4], 2
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x2c]
call fcn.0040c590
test al, al
je 0x407e3f
lea ecx, [ebp - 0x44]
call fcn.00402e30
push eax
call edi
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.00402e70
cmp esi, 0xffffffff
jne 0x407e54
xor bl, bl
jmp 0x407e56
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00402e70
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041870e
mov esp, ebp
pop ebp
ret
Function at 0x407e90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a9b8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x42801c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.00402f40
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x407ed3
xor al, al
jmp 0x407ffd
push esi
lea ecx, [ebp - 0x2c]
call fcn.004045b0
mov dword [ebp - 4], 0
mov edx, 4
lea ecx, [ebp - 0x2c]
call fcn.00406e00
lea ecx, [ebp - 0x2c]
call fcn.00402e30
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x407f41
lea ecx, [ebp - 0x44]
call fcn.00402f20
mov byte [ebp - 4], 1
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x2c]
call fcn.0040c590
test al, al
je 0x407f30
lea ecx, [ebp - 0x44]
call fcn.00402e30
push eax
call edi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.00402e70
cmp ebx, 0xffffffff
je 0x407f4a
test bl, 0x10
je 0x407fea
lea ecx, [ebp - 0x2c]
call fcn.00402f40
mov esi, dword [eax + 0x10]
cmp esi, 2
jbe 0x407fe6
lea ecx, [ebp - 0x2c]
call fcn.00402f40
mov ecx, eax
mov edx, dword [eax + 0x14]
cmp edx, 8
jb 0x407f72
mov ecx, dword [eax]
cmp word [ecx + esi*2 - 2], 0x5c
je 0x407f89
cmp edx, 8
jb 0x407f81
mov eax, dword [eax]
cmp word [eax + esi*2 - 2], 0x2f
jne 0x407fe6
mov edx, 0x20
lea ecx, [ebp - 0x2c]
call fcn.00406e00
lea ecx, [ebp - 0x2c]
call fcn.00402e30
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x407fe1
lea ecx, [ebp - 0x44]
call fcn.00402f20
mov byte [ebp - 4], 2
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x2c]
call fcn.0040c590
test al, al
je 0x407fd0
lea ecx, [ebp - 0x44]
call fcn.00402e30
push eax
call edi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.00402e70
cmp ebx, 0xffffffff
je 0x407fe6
test bl, 0x10
je 0x407fea
xor bl, bl
jmp 0x407fec
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00402e70
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041870e
mov esp, ebp
pop ebp
ret
Function at 0x408020
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a9f0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x42801c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.00402f40
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x408062
xor al, al
jmp 0x4080ec
push esi
lea ecx, [ebp - 0x2c]
call fcn.004045b0
mov dword [ebp - 4], 0
mov edx, 4
lea ecx, [ebp - 0x2c]
call fcn.00406e00
lea ecx, [ebp - 0x2c]
call fcn.00402e30
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4080d0
lea ecx, [ebp - 0x44]
call fcn.00402f20
mov byte [ebp - 4], 1
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x2c]
call fcn.0040c590
test al, al
je 0x4080bf
lea ecx, [ebp - 0x44]
call fcn.00402e30
push eax
call esi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.00402e70
cmp ebx, 0xffffffff
je 0x4080d9
test bl, 0x10
je 0x4080d9
mov bl, 1
jmp 0x4080db
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00402e70
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041870e
mov esp, ebp
pop ebp
ret
Function at 0x4081f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41aa80
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x42801c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov ecx, ebx
call fcn.00402f40
mov edi, eax
cmp dword [edi + 0x10], 0
jne 0x408234
xor al, al
jmp 0x4083e2
push ebx
call fcn.00408020
add esp, 4
test al, al
je 0x408248
mov al, 1
jmp 0x4083e2
push 0
mov ecx, ebx
call fcn.00402e30
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push eax
call esi
test eax, eax
jne 0x408297
lea ecx, [ebp - 0x2c]
call fcn.00402f20
mov dword [ebp - 4], 0
lea edx, [ebp - 0x2c]
mov ecx, ebx
call fcn.0040c590
test al, al
je 0x408288
push 0
lea ecx, [ebp - 0x2c]
call fcn.00402e30
push eax
call esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00402e70
push ebx
call fcn.00408020
add esp, 4
test al, al
jne 0x408241
mov eax, dword [edi + 0x10]
xor esi, esi
mov dword [ebp - 0x48], eax
test eax, eax
je 0x40837d
mov ecx, dword [edi + 0x14]
mov eax, edi
cmp ecx, 8
jb 0x4082c0
mov eax, dword [edi]
mov edx, 0x2f
cmp dx, word [eax + esi*2]
mov edx, 0x5c
je 0x4082e3
mov eax, edi
cmp ecx, 8
jb 0x4082d9
mov eax, dword [edi]
cmp dx, word [eax + esi*2]
jne 0x408373
push esi
push 0
lea eax, [ebp - 0x2c]
mov ecx, ebx
push eax
call fcn.004061e0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00402f40
mov eax, dword [eax + 0x10]
test eax, eax
je 0x408364
lea eax, [ebp - 0x2c]
push eax
call fcn.00407d00
add esp, 4
test al, al
jne 0x408364
push 0
lea ecx, [ebp - 0x2c]
call fcn.00402e30
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x408364
lea ecx, [ebp - 0x44]
call fcn.00402f20
mov byte [ebp - 4], 2
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x2c]
call fcn.0040c590
test al, al
je 0x408358
push 0
lea ecx, [ebp - 0x44]
call fcn.00402e30
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x44]
call fcn.00402e70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00402e70
inc esi
cmp esi, dword [ebp - 0x48]
jb 0x4082b4
push ebx
call fcn.00407d00
add esp, 4
test al, al
jne 0x4083d9
push 0
mov ecx, ebx
call fcn.00402e30
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push eax
call esi
test eax, eax
jne 0x4083d9
lea ecx, [ebp - 0x44]
call fcn.00402f20
mov dword [ebp - 4], 3
lea edx, [ebp - 0x44]
mov ecx, ebx
call fcn.0040c590
test al, al
je 0x4083ca
push 0
lea ecx, [ebp - 0x44]
call fcn.00402e30
push eax
call esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.00402e70
push ebx
call fcn.00408020
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041870e
mov esp, ebp
pop ebp
ret
Function at 0x409730
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ac88
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x42801c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edi]
test eax, eax
je 0x409776
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
lea ecx, [ebp - 0x14]
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.0040c710
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x40979f
lea ebx, [esi + 8]
jmp 0x4097a1
xor ebx, ebx
mov ecx, dword [ebp - 0x18]
call fcn.00402f40
mov eax, dword [eax + 0x10]
test eax, eax
je 0x4097ba
mov ecx, dword [ebp - 0x18]
call fcn.00402e30
jmp 0x4097bc
xor eax, eax
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
je 0x4097dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4097dd
mov byte [edi + 5], 1
cmp dword [edi], 0
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x409806
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x40981b
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.004189cc
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041870e
mov esp, ebp
pop ebp
ret 4
Function at 0x409850
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ac88
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x42801c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edi]
test eax, eax
je 0x409896
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
push ecx
lea ecx, [ebp - 0x14]
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.0040c7d0
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x4098c0
lea ebx, [esi + 8]
jmp 0x4098c2
xor ebx, ebx
mov ecx, dword [ebp - 0x18]
call fcn.00402f40
add eax, 0x10
mov dword [ebp - 0x1c], eax
cmp dword [eax], 0
je 0x4098df
mov ecx, dword [ebp - 0x18]
call fcn.00402e30
jmp 0x4098e1
xor eax, eax
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
test eax, eax
jne 0x40992c
call ecx
cmp eax, 5
jne 0x409926
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0
je 0x409918
mov ecx, dword [ebp - 0x18]
call fcn.00402e30
jmp 0x40991a
xor eax, eax
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [edi]
test eax, eax
je 0x40994a
call ecx
cmp eax, 0xb7
jne 0x40993f
mov byte [edi + 5], 1
mov ecx, dword [edi]
call fcn.00409e40
mov eax, dword [edi]
test eax, eax
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x409970
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x409985
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.004189cc
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041870e
mov esp, ebp
pop ebp
ret 4
Function at 0x40bf60
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x42801c]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x40bfe2
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x40bfe2
test ecx, ecx
je 0x40bfde
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x40bfa0
xor eax, eax
jmp 0x40bfe7
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x40bff1
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041870e
add esp, 0xc
ret 0xc