joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ac20
Capabilities:
Enumerate process modules

Disassembly:
push ebp
lea ebp, [esp - 0xa0c]
sub esp, 0xa0c
push 0xfffffffffffffffe
push 0x48e568
push 0x45e1c0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x200c
call fcn.0045cb30
mov eax, dword [0x494db8]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0xa08], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, dword [ebp + 0xa14]
mov dword [ebp - 0x24], edi
mov esi, dword [ebp + 0xa18]
mov dword [ebp - 0x20], esi
test esi, esi
je 0x40adbc
mov eax, esi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40ac90
sub eax, edx
sar eax, 1
cmp eax, 0x104
ja 0x40adbc
mov dword [ebp - 4], 0
mov eax, dword [edi]
push edi
mov ecx, dword [eax + 8]
call ecx
mov dword [ebp - 4], 0xfffffffe
jmp 0x40acd8
push 0x800
push 0
lea edx, [ebp]
push edx
call fcn.0045bc00
mov dword [ebp - 0x1c], 0
push 0x2000
push 0
lea eax, [ebp - 0x2024]
push eax
call fcn.0045bc00
add esp, 0x18
lea ecx, [ebp - 0x1c]
push ecx
push 0x800
lea edx, [ebp - 0x2024]
push edx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x40adbc
push 0x104
push esi
lea eax, [ebp + 0x800]
push eax
call fcn.0045cd4c
lea ecx, [ebp + 0x800]
push ecx
call fcn.0045dab1
add esp, 0x10
xor esi, esi
cmp dword [ebp - 0x1c], esi
jbe 0x40adbc
lea ebx, [ebx]
mov edx, dword [ebp + esi*4 - 0x2024]
push edx
lea ebx, [ebp]
call fcn.0040b0c0
test eax, eax
je 0x40adb6
mov eax, ebx
push eax
call fcn.0045dab1
add esp, 4
mov ecx, ebx
lea eax, [ebp + 0x800]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40ad9d
test dx, dx
je 0x40ad99
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40ad9d
add eax, 4
add ecx, 4
test dx, dx
jne 0x40ad77
xor eax, eax
jmp 0x40ada2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40adb6
mov ecx, dword [edi]
mov edx, dword [ebp + esi*4 - 0x2024]
push edx
push edi
mov eax, dword [ecx + 0x18]
call eax
inc esi
cmp esi, dword [ebp - 0x1c]
jb 0x40ad50
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xa08]
xor ecx, ebp
call fcn.0045bbec
add ebp, 0xa0c
mov esp, ebp
pop ebp
ret 8
Function at 0x40adf0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
lea ebp, [esp - 0xa0c]
sub esp, 0xa0c
push 0xfffffffffffffffe
push 0x48e6d8
push 0x45e1c0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x2018
call fcn.0045cb30
mov eax, dword [0x494db8]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0xa08], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, dword [ebp + 0xa14]
mov dword [ebp - 0x28], edi
mov esi, dword [ebp + 0xa18]
mov dword [ebp - 0x20], esi
mov eax, dword [ebp + 0xa1c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp + 0xa20]
mov dword [ebp - 0x30], ecx
test esi, esi
je 0x40afde
mov eax, esi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40ae70
sub eax, edx
sar eax, 1
mov dword [ebp - 0x2c], eax
cmp eax, 4
jl 0x40afde
cmp eax, 0x104
jg 0x40afde
mov dword [ebp - 4], 0
mov edx, dword [edi]
push edi
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 4], 0xfffffffe
jmp 0x40aec1
push 0x800
push 0
lea ecx, [ebp]
push ecx
call fcn.0045bc00
mov dword [ebp - 0x1c], 0
push 0x2000
push 0
lea edx, [ebp - 0x2030]
push edx
call fcn.0045bc00
add esp, 0x18
lea eax, [ebp - 0x1c]
push eax
push 0x800
lea ecx, [ebp - 0x2030]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x40afde
push 0x104
push esi
lea edx, [ebp + 0x800]
push edx
call fcn.0045cd4c
lea eax, [ebp + 0x800]
push eax
call fcn.0045dab1
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
push edi
call fcn.0040d0a0
mov dword [ebp - 0x20], eax
xor esi, esi
cmp dword [ebp - 0x1c], esi
jbe 0x40afde
mov eax, dword [ebp + esi*4 - 0x2030]
cmp edi, eax
je 0x40afd4
cmp dword [ebp - 0x20], eax
je 0x40afd4
push eax
lea ebx, [ebp]
call fcn.0040b0c0
test eax, eax
je 0x40afd4
mov ecx, ebx
push ecx
call fcn.0045dab1
mov edx, dword [ebp - 0x2c]
push edx
mov eax, ebx
push eax
lea ecx, [ebp + 0x800]
push ecx
call fcn.0045e81c
add esp, 0x10
test eax, eax
jne 0x40afd4
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
mov ecx, dword [ebp + esi*4 - 0x2030]
push ecx
push eax
mov edx, dword [edx + 0x18]
call edx
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x40afb4
mov edx, dword [ebp - 0x30]
push edx
push esi
mov edx, dword [ebp - 0x1c]
push edx
push eax
mov eax, ebx
push eax
call ecx
push str.360TRAY.EXE
lea ecx, [ebp]
push ecx
call fcn.0045d1f6
add esp, 8
test eax, eax
je 0x40afd4
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, dword [ebp - 0x1c]
jb 0x40af48
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xa08]
xor ecx, ebp
call fcn.0045bbec
add ebp, 0xa0c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40b010
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x14
push esi
lea eax, [esp + 4]
push eax
push 0x28
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40b071
lea ecx, [esp + 0xc]
push ecx
push str.SeDebugPrivilege
push esi
mov dword [esp + 0x14], 1
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 4]
push esi
push esi
push 0x10
lea edx, [esp + 0x14]
push edx
push esi
push eax
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x14
ret 4

Function at 0x40b080
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 8]
push esi
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x40b09a
pop esi
ret 8
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret 8
Function at 0x40b1f0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4777c0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x494db8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
lea eax, [esp + 0x18]
push 0x49866c
push eax
mov ebx, str.Register_dll
call fcn.0040d710
mov dword [esp + 0x2c], 0
mov edi, dword [esp + 0x38]
push eax
lea ecx, [esp + 0x20]
push ecx
mov ebx, edi
call fcn.0040d710
mov byte [esp + 0x34], 1
mov eax, dword [eax]
mov esi, dword [esp + 0x3c]
push eax
call fcn.0040ccc0
mov byte [esp + 0x38], 0
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
add esp, 0x14
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40b27d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b2a5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.00401ee0
test eax, eax
jne 0x40b2dd
test edi, edi
je 0x40b2e9
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40b2dd
push edi
call fcn.00401f60
add esp, 4
test eax, eax
jne 0x40b2dd
push 1
call fcn.0045b750
push eax
push edi
call fcn.0045b960
add esp, 0xc
jmp 0x40b2e9
push edi
call sub.KERNEL32.dll_LoadLibraryW
mov ebx, eax
test ebx, ebx
jne 0x40b2fe
push edi
push str.Can_not_load__s__return.
call fcn.0040ccc0
add esp, 8
xor eax, eax
jmp 0x40b3aa
push str.DllRegisterServer
push ebx
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40b31b
call eax
xor ecx, ecx
test eax, eax
setge cl
mov ebp, ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [esp + 0x2c]
push 0x498664
push edx
mov ebx, str.Register_dll
call fcn.0040d710
push eax
lea eax, [esp + 0x3c]
push eax
mov ebx, edi
mov dword [esp + 0x34], 2
call fcn.0040d710
mov byte [esp + 0x34], 3
mov eax, dword [eax]
push eax
call fcn.0040ccc0
mov byte [esp + 0x38], 2
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
add esp, 0x14
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b380
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b3a8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x40b410
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x804]
sub esp, 0x804
push 0xfffffffffffffffe
push 0x48e8d8
push 0x45e1c0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x494db8]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x800], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 0x80c]
mov dword [ebp - 0x1c], esi
mov edi, dword [ebp + 0x810]
mov ebx, dword [ebp + 0x814]
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp + 0x824]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
test edi, edi
je 0x40b5eb
cmp word [edi], 0
je 0x40b5eb
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b493
sub eax, edx
sar eax, 1
cmp eax, 0x104
ja 0x40b5eb
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40b5eb
test ebx, ebx
mov eax, ebx
jne 0x40b4c7
mov eax, 0x484624
push eax
push edi
mov ecx, dword [0x49866c]
push ecx
push str._sRun_App__s__s
call fcn.0040ccc0
xor edx, edx
mov word [ebp], dx
push 0x7fe
push edx
lea eax, [ebp + 2]
push eax
call fcn.0045bc00
push edi
push 0x485008
push 0x3ff
lea ecx, [ebp]
push ecx
call fcn.0040a930
push 0x3c
push 0
lea edx, [ebp - 0x60]
push edx
call fcn.0045bc00
add esp, 0x38
mov dword [ebp - 0x60], 0x3c
lea eax, [ebp]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], str.open
mov dword [ebp - 0x4c], ebx
mov ecx, dword [ebp + 0x818]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x5c], 0x440
cmp dword [ebp + 0x81c], 0
je 0x40b554
mov esi, edi
call fcn.0040dc80
test eax, eax
jne 0x40b554
push eax
call fcn.0045ed3f
lea edx, [ebp - 0x60]
push edx
call fcn.0045bbe0
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x40b57b
cmp dword [ebp + 0x820], 0
je 0x40b57b
push 0xffffffffffffffff
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x40b591
test ebx, ebx
je 0x40b59f
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test ebx, ebx
je 0x40b59f
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x40b5ab
mov eax, 0x484624
push eax
push edi
mov eax, dword [0x498664]
push eax
push str._sRun_App__s__s
mov esi, dword [ebp - 0x1c]
call fcn.0040ccc0
add esp, 0x10
mov dword [ebp - 4], 0xfffffffe
mov eax, ebx
jmp 0x40b5f4
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.0045bbec
add ebp, 0x804
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x40b620
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x804]
sub esp, 0x804
push 0xfffffffffffffffe
push 0x48e8b8
push 0x45e1c0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x494db8]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x800], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 0x80c]
mov dword [ebp - 0x20], esi
mov edi, dword [ebp + 0x810]
mov ebx, dword [ebp + 0x814]
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp + 0x824]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
test edi, edi
je 0x40b818
cmp word [edi], 0
je 0x40b818
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b6a3
sub eax, edx
sar eax, 1
cmp eax, 0x104
ja 0x40b818
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40b818
test ebx, ebx
mov eax, ebx
jne 0x40b6d7
mov eax, 0x484624
push eax
push edi
mov ecx, dword [0x49866c]
push ecx
push str._sRun_App__s__s
call fcn.0040ccc0
xor edx, edx
mov word [ebp], dx
push 0x7fe
push edx
lea eax, [ebp + 2]
push eax
call fcn.0045bc00
push edi
push 0x485008
push 0x3ff
lea ecx, [ebp]
push ecx
call fcn.0040a930
push 0x3c
push 0
lea edx, [ebp - 0x60]
push edx
call fcn.0045bc00
add esp, 0x38
mov dword [ebp - 0x60], 0x3c
lea eax, [ebp]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], str.open
mov dword [ebp - 0x4c], ebx
mov ecx, dword [ebp + 0x818]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x5c], 0x440
cmp dword [ebp + 0x81c], 0
je 0x40b766
push edi
call fcn.00402030
add esp, 4
test eax, eax
jne 0x40b766
push eax
call fcn.0045ed3f
lea edx, [ebp - 0x60]
push edx
call fcn.0045bbe0
add esp, 4
mov ebx, eax
cmp dword [ebp + 0x820], 0
je 0x40b7ab
test ebx, ebx
je 0x40b7ab
mov eax, dword [ebp + 0x828]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40b7ab
cmp dword [ebp + 0x82c], 0
je 0x40b7ab
mov edx, dword [esi]
push edi
push esi
mov eax, dword [edx + 0x10]
call eax
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x40b7c1
test ebx, ebx
je 0x40b7cf
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test ebx, ebx
je 0x40b7cf
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x40b7db
mov eax, 0x484624
push eax
push edi
mov eax, dword [0x498664]
push eax
push str._sRun_App__s__s
call fcn.0040ccc0
add esp, 0x10
mov dword [ebp - 4], 0xfffffffe
mov eax, ebx
jmp 0x40b821
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.0045bbec
add ebp, 0x804
mov esp, ebp
pop ebp
ret 0x24
Function at 0x40bb50
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x478858
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x494db8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x40bbcd
mov ebx, dword [esp + 0x2c]
test ebx, ebx
je 0x40bbcd
lea eax, [esp + 0x28]
push eax
call fcn.00402700
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x28]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40bbe5
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40bbcd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
mov esi, dword [esp + 0x28]
mov eax, dword [esi - 0xc]
cmp eax, 0x100
jl 0x40bc0d
lea eax, [esi - 0x10]
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x40bbc1
push 0x2a0
push 0
push ebx
call fcn.0045bc00
push 0x100
push esi
push ebx
call fcn.0045cd4c
mov ebp, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
mov ecx, dword [ebp]
mov eax, dword [ecx + 0x38]
add esp, 0x18
push edx
push ebp
call eax
mov dword [ebx + 0x208], eax
test eax, eax
je 0x40bc72
mov ecx, dword [ebp]
lea edx, [ebx + 0x28c]
push edx
mov edx, dword [esp + 0x2c]
lea eax, [ebx + 0x288]
push eax
mov eax, dword [ecx + 0x40]
push edx
push ebp
call eax
mov edi, dword [esp + 0x28]
lea esi, [ebx + 0x218]
call fcn.00418400
jmp 0x40bc9c
mov ecx, dword [esp + 0x28]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
je 0x40bc9c
mov ecx, dword [ebp + 8]
push ecx
push 0x10
lea edx, [ebx + 0x218]
push edx
push 0
push 0x48505c
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edx, dword [esp + 0x28]
mov eax, dword [ebp]
mov eax, dword [eax + 0x3c]
push 0x28
lea ecx, [ebx + 0x238]
push ecx
push edx
push ebp
call eax
lea ecx, [esp + 0x28]
call fcn.00418510
mov dword [ebx + 0x210], eax
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov dword [ebx + 0x214], edx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40bcf0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x40bbcf
Function at 0x40c130
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x68
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0x64], eax
push esi
mov esi, dword [esp + 0x74]
push edi
mov edi, dword [esp + 0x7c]
xor eax, eax
test edi, edi
je 0x40c1b0
mov word [edi], ax
test esi, esi
jne 0x40c16a
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0045bbec
add esp, 0x68
ret 0x10
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40c155
push 0x64
lea ecx, [esp + 0xc]
push 0
push ecx
call fcn.0045bc00
add esp, 0xc
lea eax, [esp + 8]
mov ecx, esi
call fcn.004182d0
test eax, eax
je 0x40c155
mov eax, dword [esp + 0x80]
push ebx
push edi
lea ebx, [esp + 0x10]
call fcn.004183a0
add esp, 4
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
xor ecx, esp
call fcn.0045bbec
add esp, 0x68
ret 0x10

Function at 0x40c320
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40c342
xor eax, eax
add esp, 0x14
ret 4
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp]
push 0
push 0
push 0
lea edx, [esp + 0x10]
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40c33a
push 0x80020003
push 0x12
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret 4

Function at 0x40c790
Capabilities:
Get disk information
Get disk size

Disassembly:
sub esp, 0x14
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [0x485194]
mov ecx, dword [0x485198]
mov dx, word [esp + 0x1c]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0x10], ecx
mov word [esp + 0xc], dx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x40c7e0
xor eax, eax
xor edx, edx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0045bbec
add esp, 0x14
ret 8
xor eax, eax
lea ecx, [esp]
push ecx
push eax
push eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x40c7cb
mov ecx, dword [esp + 0x10]
mov eax, dword [esp]
mov edx, dword [esp + 4]
xor ecx, esp
call fcn.0045bbec
add esp, 0x14
ret 8
Function at 0x40c9b0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x814
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0x810], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x800
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.0045bc00
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov eax, dword [ebp + 0xc]
push 0
cdq
push 0x100000
push edx
push eax
lea esi, [esp + 0x28]
call fcn.0045f3b0
cmp word [esp + 0x18], 0
mov dword [esp + 0x10], eax
mov ebx, edx
je 0x40ca4f
movzx eax, word [esi]
mov edx, dword [edi]
mov ecx, dword [edx + 0x4c]
push eax
push edi
call ecx
cmp edx, ebx
ja 0x40ca68
jb 0x40ca30
cmp eax, dword [esp + 0x10]
ja 0x40ca68
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40ca35
sub eax, edx
sar eax, 1
cmp word [esi + eax*2 + 2], cx
lea esi, [esi + eax*2 + 2]
jne 0x40ca18
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x810]
xor ecx, esp
call fcn.0045bbec
mov esp, ebp
pop ebp
ret 8
mov ax, word [esi]
mov ecx, dword [esp + 0x81c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0045bbec
mov esp, ebp
pop ebp
ret 8

Function at 0x40ca90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x808
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0x804], eax
push 0x800
lea eax, [esp + 4]
push 0
push eax
call fcn.0045bc00
add esp, 0xc
push 0x400
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, dword [esp + 0x804]
mov ax, word [esp]
xor ecx, esp
call fcn.0045bbec
mov esp, ebp
pop ebp
ret 4
Function at 0x40d6b0
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
mov dword [esi], 0
mov dword [esi + 4], 0
test eax, eax
je 0x40d6fb
push edi
push 0
push 0x80
push 3
push 0
push 7
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40d6fa
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
ret 0xc

Function at 0x40dc80
Capabilities:
Check if file exists

Disassembly:
cmp dword [0x4982d4], 0
jne 0x40dc93
push esi
call fcn.00402030
add esp, 4
ret
call fcn.00401ee0
test eax, eax
je 0x40dca2
mov eax, 1
ret
test esi, esi
jne 0x40dca9
xor eax, eax
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40dc9c
push esi
call fcn.00401f60
mov eax, 1
add esp, 4
ret

Function at 0x40de40
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4771d2
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x494db8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ebx, [esi + 8]
mov dword [esi], vtable.CFileManagerEx.0
mov dword [esi + 4], vtable.CFileManagerEx.1.0
mov dword [ebx], vtable.CFileManagerEx.2.0
mov dword [esp + 0x20], 3
mov eax, dword [esi + 0x9c]
xor ebp, ebp
mov dword [esi + 0xb4], 1
cmp eax, ebp
je 0x40debb
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x9c], ebp
mov eax, dword [esi + 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40dedb
mov eax, dword [esi + 0x80]
push eax
call fcn.00418ad0
add esp, 4
mov eax, dword [esi + 0x90]
cmp eax, ebp
je 0x40deff
mov edi, dword [esi + 0x94]
call fcn.00408250
mov eax, dword [esi + 0x90]
push eax
call fcn.004487a0
add esp, 4
mov eax, dword [esi + 0x84]
push eax
mov dword [esi + 0x90], ebp
mov dword [esi + 0x94], ebp
mov dword [esi + 0x98], ebp
call fcn.004487a0
mov byte [esp + 0x24], 1
mov eax, dword [esi + 0x80]
sub eax, 0x10
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40df47
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esi + 0x64], vtable._BaseModule::CCriticalSection.0
add esi, 0x68
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, ebx
call fcn.00418640
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x40e020
Capabilities:
Check if file exists
Get system information on windows
Read file via mapping

Disassembly:
mov edx, dword [esp + 4]
add edx, 8
mov dword [esp + 4], edx
jmp fcn.00418820