joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003040
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
xor esi, esi
push esi
push esi
push esi
push 2
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
cmp edi, 0xffffffff
je 0x100306d
push esi
push esi
push esi
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100b453
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
movzx eax, byte [edi]
lea edi, [edi + 1]
jmp 0x100b3d6
push 0xffffffffffffffff
add esi, dword [edx + 0x20]
pop ecx
lodsd eax, dword [esi]
jmp 0x100b36e
inc ecx
cmp ecx, dword [edx + 0x18]
lea edi, [eax + ebx]
je 0x100b41b
jmp 0x100b541
movzx eax, word [esi]
pop esi
add esi, dword [edi + eax*4]
ret 4
sub dword [esp], eax
cmp byte [edi], 1
pop eax
jmp 0x100b48e
ret
mov edx, ebx
mov esi, ebx
mov eax, ebx
add eax, dword [ebx + 0x3c]
add edx, dword [eax + 0x78]
jmp 0x100689f
ja 0x100b544
xor eax, 0x47c0b0ec
sbb eax, dword [esp + 4]
jne 0x10068a5
lea edi, [ebx]
jmp 0x100b570
push 0
pop eax
imul eax, eax, 0xf
jmp 0x1006893
lea esi, [ebx]
add edi, dword [edx + 0x1c]
add esi, dword [edx + 0x24]
lea esi, [esi + ecx*2]
push ebx
jmp 0x100b388

Function at 0x434389
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x434398
pop dword [ebp - 0x24]
mov eax, 0xbf6d72c0
sub eax, 0xbf2a2f28
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xb8eeb570
add dword [ebp - 0x34], 0x95638fdb
mov dword [ebp - 0x30], 0x9057fb90
sub dword [ebp - 0x30], 0x5e24af4b
mov dword [ebp - 0x2c], 0xa8ae30fa
sub dword [ebp - 0x2c], 0x5c61eccc
mov dword [ebp - 0x28], 0x2eee6d9c
add dword [ebp - 0x28], 0xd1119264
lea eax, [ebp - 0x34]
push eax
mov eax, 0x8a3fb69b
add eax, 0x7605f9c9
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xf914a321
sub dword [ebp - 0x34], 0x84a239cb
mov dword [ebp - 0x30], 0x3aba1318
sub dword [ebp - 0x30], 0xf94db1a3
mov dword [ebp - 0x2c], 0x227e54a4
sub dword [ebp - 0x2c], 0xbf0ee838
mov dword [ebp - 0x28], 0xb8551bf7
add dword [ebp - 0x28], 0x47aae409
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x4cca3
push 0
call eax
mov ecx, 0xb33f68da
add ecx, 0x4cc0dd24
mov edx, eax
mov edi, 0x476000
add edi, dword [ebp - 0x24]
mov esi, 0xc5250649
add esi, 0xe49c3691
sub dword [ebp - 4], 0xcfc4835
mov ebx, dword [edi]
xor dword [ebp - 0xc], esi
sub ebx, esi
mov dword [ebp - 0x14], 0xd559b7bb
mov dword [edx], ebx
sub dword [ebp - 0x10], 0xc2357de3
add edx, 0x26fbf129
add edx, 0xd9040edb
add edi, 0x5e516f56
sub edi, 0x5e516f52
loop 0x4344af
add eax, 0x10acb
xor ebx, ebx
add ebx, eax
add eax, 0xa7f9f8d
sub eax, 0xa7f9f88
mov ecx, 0xd535f815
sub ecx, 0xd4f5f815
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x404728
Capabilities:
Hide graphical window

Disassembly:
mov al, 0x10
jmp fcn.0040275c
cmp eax, edx
je 0x4047c0
cmp word [eax], 8
jb 0x404760
push eax
push edx
cmp word [eax], 0x100
je 0x404756
cmp word [eax], 0x101
je 0x40474e
push eax
call sub.user32.dll_ShowScrollBar
jmp 0x40475e
call dword [0x44e3e4]
jmp 0x40475e
add eax, 8
call fcn.00403960
pop edx
pop eax
cmp word [edx], 8
jae 0x404777
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
je 0x404792
cmp word [edx], 0x101
jne 0x4047ac
push eax
call 0x404766
pop eax
jmp dword [0x44e3ec]
mov edx, dword [edx + 8]
or edx, edx
je 0x4047a3
mov ecx, dword [edx - 8]
inc ecx
jle 0x4047a3
lock inc dword [edx - 8]
mov word [eax], 0x100
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.user32.dll_ShowWindow
or eax, eax
jne 0x4046dc
ret

Function at 0x408724
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0x104
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403a48
add esp, 0x104
pop ebx
ret

Function at 0x4161c4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4161ca
ret

Function at 0x4178c0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
test esi, esi
je 0x41795d
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
jne 0x41795d
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x10]
mov dl, byte [0x417968]
mov eax, ebx
call fcn.00417ed0
mov eax, dword [ebx + 0x14]
call fcn.004175c0
call fcn.00416938
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetDesktopWindow
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x18]
call fcn.00416938
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetKeyboardLayoutList
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
add eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ecx, eax
add ecx, edi
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0040ee18
lea ecx, [ebp - 0x14]
mov edx, ebx
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x417db4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x10]
mov dl, byte [0x417df8]
mov eax, ebx
call fcn.00417ed0
mov eax, dword [ebp + 8]
call fcn.00416938
push eax
push edi
push esi
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x417f6c
Capabilities:
Get keyboard layout

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0xc]
call fcn.00416e0c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetDC
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x18]
call fcn.00416938
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetKeyboardLayoutList
pop ebx
ret

Function at 0x417f98
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x10]
call fcn.0041730c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetDC
mov eax, dword [ebx + 0x10]
movzx eax, byte [eax + 0x18]
movzx eax, word [eax*2 + 0x44d59c]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetKeyState
pop ebx
ret
Function at 0x444d58
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x444de1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x44e824
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x444dcb
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040a9d0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x444df8
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x44dd40]
mov dl, 1
mov eax, dword [0x444614]
call fcn.0040b308
call fcn.00403430
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444de8
lea eax, [ebp - 0x1c]
call fcn.00403960
ret

Function at 0x445450
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.00445374
mov cl, 1
mov edx, esi
mov eax, esi
mov bx, 0xffff
call fcn.00402ecc
push 0x10
lea eax, [esi + 0x18]
push eax
mov eax, dword [esi + 4]
push eax
call sub.wsock32.dll_connect
mov edx, 0x4454b4
call fcn.00444ca0
mov byte [esi + 0x29], 0
test byte [esi + 0x28], 0x10
jne 0x4454a6
cmp dword [esi + 4], 0xffffffff
setne al
mov byte [esi + 8], al
mov cl, 2
mov edx, esi
mov eax, esi
mov bx, 0xffff
call fcn.00402ecc
pop esi
pop ebx
ret

Function at 0x4454d8
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov eax, ebx
call fcn.00403da4
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.00402a08
test ebx, ebx
je 0x445523
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov cl, byte [edx]
mov byte [esp + 4], cl
mov cl, byte [edx + 1]
mov byte [esp + 5], cl
mov cl, byte [edx + 2]
mov byte [esp + 6], cl
mov al, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret
Function at 0x445600
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x445631
mov ecx, dword [0x44dca4]
mov dl, 1
mov eax, dword [0x444614]
call fcn.0040b2cc
call fcn.00403430
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x44565e
mov ecx, dword [0x44dc64]
mov dl, 1
mov eax, dword [0x444614]
call fcn.0040b2cc
call fcn.00403430
xor eax, eax
push ebp
push 0x4456dd
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xffff
call fcn.00402ecc
cmp byte [ebp + 8], 0
je 0x4456b9
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.00445568
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.00445450
jmp 0x4456d3
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.00444f8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4456fa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4458dc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0044520c
xor edx, edx
push ebp
push 0x445a3c
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x445a26
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x445926
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x445930
call fcn.004034d0
jmp 0x445a43
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041159c
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 4]
mov ebx, eax
test ebx, ebx
jle 0x445a1b
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
cmp eax, 0xffffffff
jne 0x4459d9
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x4459c9
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xfffe
call fcn.00402ecc
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.00445894
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x445a4c]
cmp dl, byte [eax + 0x28]
je 0x445a22
call fcn.0040b1b4
jmp 0x445a22
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0xc]
call fcn.004115ac
jmp 0x445a22
cmp eax, ebx
jge 0x4459f2
mov edx, dword [ebp - 0xc]
add edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004115ac
jmp 0x445930
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041159c
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004115b8
cmp ebx, eax
jne 0x445930
push ebp
call fcn.00445894
pop ecx
jmp 0x445a22
push ebp
call fcn.00445894
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x445a43
mov eax, dword [ebp - 4]
call fcn.00445218
ret
mov al, byte [ebp - 5]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x445a50
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x445b72
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0044520c
xor eax, eax
push ebp
push 0x445b55
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x445aa0
call fcn.004034d0
jmp 0x445b5c
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x445b3f
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x445b3f
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xfffe
call fcn.00402ecc
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x445b3f
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040a9d0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x445b8c
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x44dd40]
mov dl, 1
mov eax, dword [0x444614]
call fcn.0040b308
call fcn.00403430
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x445b5c
mov eax, dword [ebp - 4]
call fcn.00445218
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x445b79
lea eax, [ebp - 0x28]
call fcn.00403960
ret
Function at 0x445bd8
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x445d22
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0044520c
xor eax, eax
push ebp
push 0x445d05
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x445c3d
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x445c3d
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x445cef
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x445c50
call fcn.004034d0
jmp 0x445d0c
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x445cef
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x445cef
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xfffe
call fcn.00402ecc
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x445cef
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040a9d0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x445d3c
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x44dd40]
mov dl, 1
mov eax, dword [0x444614]
call fcn.0040b308
call fcn.00403430
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x445d0c
mov eax, dword [ebp - 4]
call fcn.00445218
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x445d29
lea eax, [ebp - 0x28]
call fcn.00403960
ret
Function at 0x406e30
Capabilities:
Get uefi variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aae23
mov eax, dword fs:[0]
push eax
sub esp, 0xf0
mov eax, dword [0x4e23d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x60], edi
xor eax, eax
mov dword [ebp - 0x18], 0
mov ebx, 2
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push str.Kernel32.dll
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
mov dword [ebp - 0x64], esi
test esi, esi
je 0x406f95
push str.GetFirmwareType
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x406f95
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x5c], 0
push ecx
call eax
call fcn.0043bfd0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x406f7f
push 0x70
push str.d:jenkins.jenkinsworkspacelib_commonwin11_update_assistantwin11_update_assistant_srccheckwin11_check.cpp
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], al
call fcn.0040daa0
push 3
push 0x4b5b84
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.0040daa0
mov byte [ebp - 4], bl
call fcn.0043bfd0
mov edi, eax
lea ecx, [ebp - 0xfc]
push 0x53
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00405060
mov esi, eax
push 0x4b5b88
push esi
mov byte [ebp - 4], 3
call fcn.00402ea0
add esp, 8
mov ecx, esi
push dword [ebp - 0x5c]
call fcn.004061e0
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0xfc]
call fcn.00406570
lea ecx, [ebp - 0x40]
call fcn.00405b30
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0
call fcn.00405b30
mov esi, dword [ebp - 0x64]
mov edi, dword [ebp - 0x60]
mov eax, dword [ebp - 0x5c]
cmp eax, 3
ja case.default.0x406f87
jmp dword [eax*4 + 0x407050]
mov ebx, 2
jmp case.default.0x406f87
push 0
push 0
push str.00000000_0000_0000_0000_000000000000
push 0x4b57ec
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 1
jne case.0x406f87.2
push 6
xor ebx, ebx
push str.Legacy
jmp 0x406fcb
push 4
push str.UEFI
mov ebx, 1
lea ecx, [ebp - 0x28]
call fcn.0040db90
test esi, esi
je 0x406fde
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.00404dd0
push ebx
push 7
mov ecx, edi
call fcn.0040b3e0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x40702c
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407022
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40704a
push edx
push ecx
call fcn.0045bfb6
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045c263
mov esp, ebp
pop ebp
ret
call fcn.004844a9
nop
mov gs, word [edi + 0x40]
add byte [edi + ebp*2 + 1874788416], dh
inc eax
add byte [esi + 0x5500406f], cl
push ebp
Function at 0x40a770
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4e23d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x104
push 0
push eax
mov dword [ebp - 0x210], esi
call fcn.004813a0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.004813a0
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 1
push 0x4b63c0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea ecx, [ebp - 0x108]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
lea edx, [ecx + 1]
mov byte [esi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a800
sub ecx, edx
lea eax, [ebp - 0x108]
push ecx
push eax
mov ecx, esi
call fcn.0040daa0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0045c263
mov esp, ebp
pop ebp
ret 4
Function at 0x40b1f0
Capabilities:
Check if file exists
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ab486
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x4e23d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004813a0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x218]
push eax
call ebx
mov esi, dword [ebp + 8]
test esi, esi
je 0x40b271
lea eax, [ebp - 0x218]
push eax
call ebx
sub esi, 1
jne 0x40b263
push str.NetBridge.dll
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.0040b110
mov ecx, eax
test ecx, ecx
je 0x40b3d3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x21c]
call fcn.00408e00
test al, al
jne 0x40b2e8
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b2c6
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040ba60
mov esi, dword [ebp - 0x21c]
push esi
mov dword [ebp - 4], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40b304
mov bl, 1
jmp 0x40b312
push esi
call fcn.0043db40
add esp, 4
test eax, eax
sete bl
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40b331
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
jne 0x40b3b3
cmp dword [edi], 0
jne 0x40b39a
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x40b3b3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpInit
push eax
call esi
push str.HttpUninit
push dword [edi]
mov dword [edi + 4], eax
call esi
push str.zlib_uncompress
push dword [edi]
mov dword [edi + 8], eax
call esi
push str.zlib_compress
push dword [edi]
mov dword [edi + 0x10], eax
call esi
push str.zlib_compressBound
push dword [edi]
mov dword [edi + 0x14], eax
call esi
mov dword [edi + 0x18], eax
mov eax, dword [edi + 4]
test eax, eax
je 0x40b39a
call eax
mov dword [edi + 0xc], eax
cmp dword [edi + 8], 0
je 0x40b3b3
cmp dword [edi + 4], 0
je 0x40b3b3
cmp dword [edi + 0xc], 0
je 0x40b3b3
mov eax, 1
jmp 0x40b3b5
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045c263
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00406e10
int3