joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401410
Capabilities:
Create thread

Disassembly:
sub esp, 0x10c
mov eax, dword [0x552994]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x114]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x11c]
push 0x104
mov ebx, ecx
lea ecx, [esp + 0x14]
push 0
push ecx
mov dword [esp + 0x18], eax
call fcn.0041bd70
add esp, 0xc
cmp dword [esi + 0x18], 8
lea ebp, [esi + 4]
jb 0x40145d
mov eax, dword [ebp]
jmp 0x40145f
mov eax, ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 1
call edi
cmp dword [esi + 0x18], 8
jb 0x401482
mov ecx, dword [ebp]
jmp 0x401484
mov ecx, ebp
xor ebp, ebp
push ebp
push ebp
push eax
lea edx, [esp + 0x20]
push edx
push 0xffffffffffffffff
push ecx
push ebp
push 1
call edi
mov eax, dword [esp + 0x10]
mov edi, dword [ebx + 4]
push eax
lea edx, [esp + 0x18]
call fcn.00401230
mov esi, dword [ebx + 4]
lea ecx, [esp + 0x10]
push ecx
push ebp
push esi
push 0x4011b0
push ebp
push ebp
mov dword [esp + 0x28], ebp
call fcn.004eedc1
add esp, 0x18
cmp eax, ebp
mov dword [esi + 0x10], eax
pop edi
je 0x4014f6
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4014ee
mov edx, dword [esi + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], ebp
mov eax, dword [ebx + 4]
mov al, byte [eax + 4]
jmp 0x4014fc
mov ecx, dword [ebx + 4]
mov al, byte [ecx + 4]
jmp 0x4014fc
mov edx, dword [ebx + 4]
mov al, byte [edx + 4]
mov ecx, dword [esp + 0x114]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041bab8
add esp, 0x10c
ret 8
Function at 0x402190
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x507e78
mov eax, dword fs:[0]
push eax
sub esp, 0x628
mov eax, dword [0x552994]
xor eax, esp
mov dword [esp + 0x624], eax
push ebx
push ebp
push edi
mov eax, dword [0x552994]
xor eax, esp
push eax
lea eax, [esp + 0x638]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esi], ebx
mov eax, 7
mov dword [esi + 0x20], eax
mov dword [esi + 0x1c], ebx
mov dword [esp + 0x10], esi
mov word [esi + 0xc], bx
lea edi, [esi + 0x24]
mov dword [esp + 0x640], ebx
mov dword [edi + 0x18], eax
mov dword [edi + 0x14], ebx
mov word [edi + 4], bx
mov dword [esi + 0x58], eax
mov dword [esi + 0x54], ebx
mov word [esi + 0x44], bx
lea ecx, [esi + 0x5c]
mov byte [esp + 0x640], 2
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x54b260
mov byte [ecx + 4], bl
call fcn.004017f0
push ebx
mov byte [esp + 0x644], 3
call fcn.00420446
push eax
call fcn.004efd6f
push 0x20a
lea eax, [esp + 0x22]
push ebx
push eax
mov word [esp + 0x28], bx
call fcn.0041bd70
add esp, 0x14
lea ecx, [esp + 0x14]
push ecx
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
add eax, 0xffffffff
cmp eax, 0x103
ja 0x4022f1
push 0x410
lea edx, [esp + 0x226]
push ebx
push edx
mov word [esp + 0x22a], bx
mov word [esp + 0x22c], bx
call fcn.0041bd70
add esp, 0xc
push 0x208
lea eax, [esp + 0x224]
push eax
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x4022ce
cmp eax, ebx
je 0x4022ce
lea edx, [esp + 0x220]
push edx
mov ecx, edi
mov word [esp + eax*2 + 0x224], bx
call fcn.00401760
jmp 0x4022f1
lea eax, [esp + 0x14]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4022d5
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x18]
push eax
mov ecx, edi
call fcn.00401a30
mov eax, dword [esi + 0x38]
cmp eax, ebx
je 0x402328
lea ebp, [eax - 1]
cmp ebp, dword [edi + 0x14]
jbe 0x402305
call fcn.0041c57f
cmp dword [edi + 0x18], 8
jb 0x402310
mov eax, dword [edi + 4]
jmp 0x402313
lea eax, [edi + 4]
cmp word [eax + ebp*2], 0x5c
je 0x402328
push 1
push 0x54b264
mov ecx, edi
call fcn.00403980
cmp dword [esi + 0x38], ebx
jne 0x40233b
push 3
push 0x54b268
mov ecx, edi
call fcn.00401a30
mov eax, esi
mov dword [esi + 4], ebx
mov ecx, dword [esp + 0x638]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x624]
xor ecx, esp
call fcn.0041bab8
add esp, 0x634
ret
Function at 0x403c40
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x507f18
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x552994]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
xor edi, edi
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], di
call fcn.00401d00
mov edx, dword [esp + 0x44]
mov eax, edx
mov dword [esp + 0x34], edi
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x403ca0
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.00403980
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push edi
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push eax
mov ecx, esi
mov word [esi + 4], di
call fcn.00401d00
cmp dword [esp + 0x28], 8
jb 0x403ceb
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0041b6ec
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret

Function at 0x404600
Capabilities:
Get http content length

Disassembly:
mov eax, dword [eax + 4]
sub esp, 8
test eax, eax
je 0x40463f
push 0
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 8]
push edx
push 0x20000005
push eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x40463f
mov eax, dword [esp]
xor edx, edx
add esp, 8
ret
xor eax, eax
xor edx, edx
add esp, 8
ret

Function at 0x405055
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x552994]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.0040fe1e
mov ecx, esi
call fcn.00405031
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x20c]
add esi, 0x234
push eax
mov ecx, esi
call fcn.00401760
push str.SmartCloud
mov ecx, esi
call fcn.004035f0
push str.TempSkin_
mov ecx, esi
call fcn.004035f0
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.0041bab8
leave
ret
Function at 0x405128
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x552994]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 0x1c
mov eax, 0x506408
call fcn.0041bac7
mov edi, dword [ebp + 0x230]
mov esi, dword [ebp + 0x234]
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x10], 7
call fcn.00401b10
lea eax, [ebp - 0x28]
push eax
push edi
mov dword [ebp - 4], ebx
call fcn.004117f3
push str.SmartCloudInfo.ini
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp]
push eax
call fcn.00403c40
add esp, 0x14
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
mov byte [ebp - 4], 1
jae 0x40519c
lea eax, [ebp + 4]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call edi
test eax, eax
jne 0x4051e6
push ebx
push 1
lea ecx, [ebp]
call fcn.00401790
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00401790
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.0041bab8
add ebp, 0x228
leave
ret 8
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x4051f2
lea eax, [ebp + 4]
push eax
push 0x104
lea eax, [ebp + 0x1c]
push eax
push 0x54b284
push str.CfgRootPath
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp + 0x1c]
push eax
mov ecx, esi
call fcn.00401760
push str.AllSkin
mov ecx, esi
call fcn.004035f0
cmp dword [esi + 0x18], 8
jb 0x405233
mov esi, dword [esi + 4]
jmp 0x405236
add esi, 4
push esi
call edi
test eax, eax
jne 0x40525e
xor bl, bl
push 0
push 1
lea ecx, [ebp]
call fcn.00401790
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00401790
mov al, bl
jmp 0x4051c1
mov bl, 1
jmp 0x40523f
Function at 0x405262
Capabilities:
Check if file exists
Copy file

Disassembly:
push ebp
sub esp, 0x480
lea ebp, [esp - 4]
mov eax, dword [0x552994]
xor eax, ebp
mov dword [ebp + 0x480], eax
push 0x28
mov eax, 0x506458
call fcn.0041bac7
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 0x48c]
mov edi, dword [ebp + 0x490]
push 7
pop ebx
xor esi, esi
push esi
lea ecx, [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], edi
mov dword [ebp + 0x34], ebx
call fcn.00401b10
mov ecx, dword [ebp - 0x14]
lea eax, [ebp + 0x1c]
push eax
push edi
mov dword [ebp - 4], esi
call fcn.00405128
test al, al
jne 0x4052c8
push esi
push 1
jmp 0x4053f9
push 0x206
lea eax, [ebp + 0x27a]
push esi
push eax
mov word [ebp + 0x278], si
call fcn.0041bd70
push dword [ebp - 0x10]
lea eax, [ebp]
push eax
call fcn.004114a0
add esp, 0x14
mov eax, dword [ebp + 4]
push 8
pop edi
cmp dword [ebp + 0x18], edi
mov byte [ebp - 4], 1
jae 0x405302
lea eax, [ebp + 4]
push eax
lea eax, [ebp + 0x278]
push eax
call fcn.0041c0a1
push 0x54b264
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00403c40
lea ecx, [ebp + 0x278]
push ecx
push eax
lea eax, [ebp + 0x54]
push eax
mov byte [ebp - 4], 2
call fcn.00403c40
add esp, 0x20
push esi
push 1
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 4
call fcn.00401790
cmp dword [ebp + 0x6c], edi
mov eax, dword [ebp + 0x58]
jae 0x405353
lea eax, [ebp + 0x58]
push esi
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [ebp + 0x6c], edi
mov eax, dword [ebp + 0x58]
jae 0x405369
lea eax, [ebp + 0x58]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
push esi
jne 0x40538f
push 1
lea ecx, [ebp + 0x54]
call fcn.00401790
push esi
push 1
lea ecx, [ebp]
call fcn.00401790
jmp 0x4052c0
lea ecx, [ebp + 0x38]
mov dword [ebp + 0x50], ebx
call fcn.00401b10
mov ecx, dword [ebp - 0x14]
lea eax, [ebp + 0x38]
push eax
push dword [ebp - 0x18]
mov byte [ebp - 4], 5
call fcn.004050c5
cmp dword [ebp + 0x50], edi
mov eax, dword [ebp + 0x3c]
jae 0x4053b8
lea eax, [ebp + 0x3c]
push dword [ebp - 0x10]
push eax
lea eax, [ebp + 0x70]
push str.__s___bindinst__s
push eax
call fcn.0041bfe1
lea eax, [ebp + 0x70]
push eax
call fcn.004102a3
add esp, 0x14
xor edi, edi
push esi
inc edi
push edi
lea ecx, [ebp + 0x38]
call fcn.00401790
push esi
push edi
lea ecx, [ebp + 0x54]
call fcn.00401790
push esi
push edi
lea ecx, [ebp]
call fcn.00401790
push esi
push edi
lea ecx, [ebp + 0x1c]
call fcn.00401790
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x480]
xor ecx, ebp
call fcn.0041bab8
add ebp, 0x484
leave
ret 8

Function at 0x4054f1
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x408a23
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8
Function at 0x408a79
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
test esi, esi
mov ebx, ecx
jne 0x408a8f
push 0x80004005
call fcn.00408823
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x408a92
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
ret 8

Function at 0x408ff9
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x552994]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a0]
push ebx
push esi
push edi
push 0x2001f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], esi
call fcn.004089ee
mov edi, eax
cmp edi, esi
je 0x409061
lea ecx, [ebp - 0x70]
call fcn.00408989
mov eax, edi
mov ecx, dword [ebp + 0x194]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041bab8
add ebp, 0x198
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x409079
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x70]
call fcn.00408ff9
cmp eax, esi
jne 0x4090ac
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x100
call edi
test eax, eax
je 0x409069
lea ecx, [ebp - 0x70]
call fcn.00408989
push dword [ebp - 0x78]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.00408989
mov eax, esi
jmp 0x409047
Function at 0x40baa1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40bab3
xor eax, eax
ret
and al, 0x10
xor cl, cl
cmp cl, al
sbb eax, eax
neg eax
ret

Function at 0x40c42b
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40c4b0
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
test eax, eax
mov esi, dword [ebp + 0x14]
je 0x40c49b
test si, 0x100
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
ja 0x40c48d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea eax, [ebp - 8]
push eax
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and esi, 0x27
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
pop edi
leave
ret 0x10

Function at 0x40c4d6
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x552994]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push str.Skin.xml
push ebx
mov edi, 0x50a128
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0041bfe1
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x40c521
xor al, al
jmp 0x40c545
push str.VipSkin.xml
push ebx
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.0041bfe1
add esp, 0x10
lea eax, [ebp - 0x414]
push eax
call esi
test eax, eax
setne al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041bab8
leave
ret 4

Function at 0x40c79d
Capabilities:
Create directory

Disassembly:
push 8
mov eax, 0x506af5
call fcn.0041bac7
push dword [ebp + 8]
call fcn.0040baa1
test eax, eax
pop ecx
je 0x40c7be
xor eax, eax
call fcn.0041bb9f
ret
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
call fcn.0040c736
mov edi, dword [ebp - 0x14]
xor esi, esi
push edi
mov dword [ebp - 4], esi
call fcn.0040bae7
push 0x5c
push edi
call fcn.0041c425
add esp, 0xc
cmp eax, esi
jne 0x40c7f4
push 0xf
pop esi
push edi
call fcn.0041c846
pop ecx
mov eax, esi
jmp 0x40c7b8
push edi
mov word [eax], si
call fcn.0040c79d
cmp eax, esi
pop ecx
je 0x40c806
mov esi, eax
jmp 0x40c7e9
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40c7e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40c802
jmp 0x40c7e9

Function at 0x40d118
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
test word [ebp + 0xc], 0x100
je 0x40d131
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041d288
add esp, 0xc
pop ebp
ret 0xc
Function at 0x40d2cd
Capabilities:
Delete file

Disassembly:
push 0x24
mov eax, 0x506c71
call fcn.0041bac7
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edi, edi
cmp dword [esi + 0x1108], eax
je 0x40d303
lea eax, [esi + 0x10cc]
mov dword [eax + 0x18], 0x3f3
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], edi
jmp 0x40d4e8
cmp dword [esi + 0x10f0], edi
je 0x40d4e8
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x1104], eax
mov dword [esi + 0x10f4], edi
mov eax, dword [esi + 0xc]
mov dword [esi + 8], edi
mov word [eax], di
mov eax, dword [esi + 0x14]
mov word [eax], di
lea ecx, [esi + 0x10cc]
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [ebp - 0x10], ecx
call fcn.0040bb69
push dword [ebp + 0xc]
lea ebx, [esi + 0x58]
mov ecx, ebx
mov dword [esi + 0x4c], edi
call fcn.0040b913
push ebx
call fcn.0040babe
mov dword [esp], 0x50a304
push dword [ebx]
call fcn.0041ced9
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
lea ecx, [ebp - 0x30]
mov dword [esi + 0x10f8], eax
call fcn.0040c718
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], edi
call fcn.0040c718
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
mov byte [ebp - 4], 1
call fcn.0040bb08
add esp, 0xc
mov ecx, ebx
call fcn.0040b82a
cmp eax, 3
jb 0x40d4c6
lea ecx, [ebp - 0x30]
call fcn.0040b82a
cmp eax, 2
jb 0x40d4c6
lea ecx, [ebp - 0x18]
call fcn.0040b82a
cmp eax, 2
jb 0x40d4c6
lea ebx, [esi + 0x60]
mov eax, dword [ebx]
lea ecx, [ebp - 0x28]
mov word [eax], di
call fcn.0040c6fb
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.0040c6fb
jmp 0x40d432
mov ecx, ebx
call fcn.0040b82a
test eax, eax
je 0x40d46b
push ebx
lea ecx, [ebp - 0x18]
call fcn.0040b913
push dword [ebp - 0x20]
call fcn.0041c846
push dword [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0041c846
mov eax, dword [ebx]
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
mov word [eax], di
call fcn.0040c6fb
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.0040c6fb
push dword [ebp + 0x10]
lea ecx, [ebp - 0x20]
push edi
push 0x40d1b9
push edi
push dword [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.0040b7dd
push eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
call fcn.0040b7dd
push eax
push dword [esi + 0x10f0]
call dword [esi + 0x1114]
add esp, 0x1c
test eax, eax
jne 0x40d3ef
push dword [ebp - 0x20]
call fcn.0041c846
push dword [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0041c846
pop ecx
pop ecx
push dword [esi + 8]
mov ecx, esi
call fcn.0040caa0
cmp dword [esi + 0x10f4], edi
je 0x40d4a1
cmp dword [esi + 8], edi
je 0x40d4a1
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x10]
call fcn.0040bb81
push dword [ebp - 0x18]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call fcn.0041c846
push dword [ebp - 0x30]
call fcn.0041c846
pop ecx
pop ecx
mov eax, esi
jmp 0x40d4ea
mov eax, dword [ebp - 0x10]
push dword [ebp - 0x18]
mov dword [eax + 0x18], 0x3ea
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], edi
call fcn.0041c846
push dword [ebp - 0x30]
call fcn.0041c846
pop ecx
pop ecx
xor eax, eax
call fcn.0041bb9f
ret 0xc
Function at 0x40d5bd
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ebp, ebp
cmp dword [esi + 0x1108], eax
je 0x40d5eb
lea eax, [esi + 0x10cc]
mov dword [eax + 0x18], 0x3f3
mov dword [eax + 0x1c], ebp
mov dword [eax + 0x20], ebp
xor eax, eax
jmp 0x40d727
mov eax, dword [0x55e870]
cmp eax, 0xffffffff
je 0x40d60f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebp
je 0x40d60f
lea eax, [esi + 0x10cc]
mov dword [eax + 0x18], 0x3f4
jmp 0x40d5de
push esi
push 1
call fcn.0040c309
test eax, eax
pop ecx
pop ecx
jne 0x40d62f
lea eax, [esi + 0x10cc]
mov dword [eax + 0x18], ebp
mov dword [eax + 0x1c], 0xe
jmp 0x40d5e1
push ebx
lea ebx, [esi + 0x10cc]
mov ecx, ebx
call fcn.0040bb69
cmp dword [esi + 0x10f0], ebp
jne 0x40d6e4
cmp dword [esi + 0x110c], ebp
jne 0x40d6e8
push edi
push str.Cabinet.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FDICreate
push eax
mov dword [esi + 0x110c], eax
call edi
push str.FDICopy
push dword [esi + 0x110c]
mov dword [esi + 0x1110], eax
call edi
push str.FDIIsCabinet
push dword [esi + 0x110c]
mov dword [esi + 0x1114], eax
call edi
push str.FDIDestroy
push dword [esi + 0x110c]
mov dword [esi + 0x1118], eax
call edi
cmp dword [esi + 0x1110], ebp
mov dword [esi + 0x111c], eax
pop edi
je 0x40d6d1
cmp dword [esi + 0x1114], ebp
je 0x40d6d1
cmp dword [esi + 0x1118], ebp
je 0x40d6d1
cmp eax, ebp
jne 0x40d6e8
mov dword [esi + 0x110c], ebp
mov dword [ebx + 0x18], 0x3e8
mov dword [ebx + 0x1c], ebp
mov dword [ebx + 0x20], ebp
xor eax, eax
jmp 0x40d726
push ebx
push 1
push 0x40d190
push fcn.0040d16f
push 0x40c899
push 0x40d146
push 0x40d593
push fcn.0041c846
push fcn.0041a944
call dword [esi + 0x1110]
xor ecx, ecx
add esp, 0x24
cmp eax, ebp
setne cl
mov dword [esi + 0x10f0], eax
mov eax, ecx
pop ebx
pop esi
pop ebp
ret
Function at 0x40dc2b
Capabilities:
Create process on windows
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0xde8]
sub esp, 0xe68
mov eax, dword [0x552994]
xor eax, ebp
mov dword [ebp + 0xde4], eax
mov eax, dword [ebp + 0xdf0]
push ebx
mov dword [ebp - 0x1c], eax
push esi
push edi
xor eax, eax
xor ebx, ebx
mov word [ebp - 0x2c], bx
lea edi, [ebp - 0x2a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov esi, 0x206
push esi
lea eax, [ebp + 0x9c2]
push ebx
push eax
mov word [ebp + 0x9c0], bx
call fcn.0041bd70
push str.UseVestige.ini
push str.Config
push 0x55dd08
lea eax, [ebp + 0x9c0]
push 0x50a3d4
push eax
call fcn.0041bfe1
add esp, 0x20
lea eax, [ebp + 0x9c0]
push eax
push 0xffffffffffffffff
push 0x50a3b8
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
movzx ecx, word [ebp - 0x26]
cmp eax, ecx
je 0x40de43
push esi
lea eax, [ebp + 0xbca]
push ebx
push eax
mov word [ebp + 0xbc8], bx
call fcn.0041bd70
push esi
lea eax, [ebp + 0x7ba]
push ebx
push eax
mov word [ebp + 0x7b8], bx
call fcn.0041bd70
lea eax, [ebp + 0x7b8]
push 0x55db00
push eax
call fcn.0041c0a1
lea eax, [ebp + 0x7b8]
push str.SCMutual.exe
push eax
call fcn.0041c077
lea eax, [ebp + 0xbc8]
push 0x50a3b4
push eax
call fcn.0041c0a1
lea eax, [ebp + 0x7b8]
push eax
lea eax, [ebp + 0xbc8]
push eax
call fcn.0041c077
lea eax, [ebp + 0xbc8]
push 0x50a398
push eax
call fcn.0041c077
add esp, 0x40
push dword [ebp - 0x1c]
lea eax, [ebp + 0xbc8]
push eax
call fcn.0041c077
mov esi, 0x55df10
push esi
call fcn.0041b494
add esp, 0xc
test eax, eax
jbe 0x40dd94
lea eax, [ebp + 0xbc8]
push 0x50a394
push eax
call fcn.0041c077
lea eax, [ebp + 0xbc8]
push esi
push eax
call fcn.0041c077
add esp, 0x10
push 0x44
pop esi
push esi
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.0041bd70
push 0x10
lea eax, [ebp - 0x3c]
push ebx
push eax
mov dword [ebp - 0x80], esi
call fcn.0041bd70
lea eax, [ebp + 0xbc8]
push eax
lea eax, [ebp - 0x18]
push 0x50a24c
push eax
call fcn.0041bfe1
add esp, 0x24
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40ddf7
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x38]
call esi
xor eax, eax
mov word [ebp + 0xdd0], bx
lea edi, [ebp + 0xdd2]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
movzx eax, word [ebp - 0x26]
push eax
lea eax, [ebp + 0xdd0]
push 0x50a38c
push eax
call fcn.0041bfe1
add esp, 0xc
lea eax, [ebp + 0x9c0]
push eax
lea eax, [ebp + 0xdd0]
push eax
push 0x50a3b8
push str.Setting
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp + 0xde4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041bab8
add ebp, 0xde8
leave
ret