joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446030
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x446063
push esi
call fcn.00449120
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44605c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4460e9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4460d2
mov eax, dword [esi + 8]
test eax, eax
je 0x446087
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4460ce
cmp eax, 2
je 0x4460d2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44607a
cmp eax, 3
je 0x4460ad
cmp eax, 1
jne 0x44607a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44607a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44607a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00446110
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4460f8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00446110
add esp, 4
pop esi
ret

Function at 0x46471a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x464752
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004627ce
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004627a6
jmp 0x46475e
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x465e08
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x465e4a
call fcn.0046b8e0
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x465e4a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x465e41
xor eax, eax
jmp 0x465e52
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00465e58
pop edi
pop esi
pop ebx
ret 4

Function at 0x46be10
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46be3e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46be5c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046bd76
jmp 0x46be5c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46be5c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046bd76
test edi, edi
mov eax, edi
jne 0x46be46
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x88db18
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x88db1e
pop ebp
sub ebp, 6
sub ebp, 0x48db18
jmp 0x88db7c
stosd dword es:[edi], eax
cmpsb byte [esi], byte es:[edi]
sub byte [eax], 0xe9
xlatb
push edi
pop ss
cmc
adc ch, byte [ebx]
fsub dword [esi + 0x6b08d4cc]
popal
cmpsb byte [esi], byte es:[edi]
add dword [eax], eax
add byte [eax], al
add byte [esi], al
mov dh, 0xf5
xor ch, bh
push ecx
imul edi, dword [ecx - 0x44], 0xffffffaa
push ebx
xchg byte [edi], cl
invalid
jmp 0x88db85
mov eax, 0x48db18
add eax, ebp
add eax, 0x93
mov ecx, 0x583
mov edx, 0xbaa5208a
xor byte [eax], dl
inc eax
dec ecx
jne 0x88db9c
jmp 0x88dbaf
add dword [edi + 1], eax
add esi, dword [esi + 0xb8a8a8a]
dec ebx
jb 0x88db45
mov cl, byte [edx - 0x70cdb877]
mov cl, byte [edx - 0x755dcf76]
mov cl, byte [edx + 0x4289687d]
add dword [ebx], ecx
xchg byte [edx + 0x4f898a8a], cl
fcmovu st(0), st(2)
loop 0x88dc0f
sub al, byte [esi - 0x4f2c1d76]
mov dh, 0x8a
mov esp, dword [esi + 0x1670e2ae]
popal
xchg edi, eax
bound ecx, qword [edi + 0x638a8a8a]
mov al, byte [0xdf8a8a8a]
pop es
out 0xae, al
mov al, byte [ecx]
jb 0x2136689
pop ds
xchg byte [edx + 0x7018a8a], cl
lcall 0x8863, 0x4b8a8a8a
mov ebx, 0x8e480988
or dword [eax - 0x72], ecx
ret
Function at 0x401040
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [ecx + 4]
mov edx, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
cmp esi, 4
jb 0x4010ab
mov edi, esi
shr edi, 2
xor eax, dword [edx]
sub esi, 4
mov ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x4199e0]
add edx, 4
mov ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x4199e0]
mov ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x4199e0]
mov ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x4199e0]
dec edi
jne 0x401058
test esi, esi
je 0x4010cb
nop
movzx ebx, byte [edx]
mov edi, eax
and edi, 0xff
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x4199e0]
inc edx
dec esi
jne 0x4010b0
pop edi
pop esi
mov dword [ecx + 4], eax
pop ebx
ret 8

Function at 0x405be0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, eax
mov eax, ebp
shr eax, 2
xor ecx, ecx
xor edx, edx
test eax, eax
je 0x405c1a
mov edx, edi
sub esi, edi
mov dword [esp + 0xc], eax
push ebx
mov ebx, dword [esi + edx]
xor ebx, dword [edx]
add edx, 4
or ecx, ebx
dec eax
jne 0x405c04
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
pop ebx
lea eax, [edx*4]
sub ebp, eax
jne 0x405c31
pop edi
xor eax, eax
test ecx, ecx
pop esi
sete al
pop ebp
pop ecx
ret
add esi, eax
add edi, eax
mov eax, ecx
mov edx, ecx
shr edx, 0x10
shr eax, 0x18
or al, dl
mov edx, ecx
shr edx, 8
or al, dl
or cl, al
test ebp, ebp
je 0x405c5f
mov eax, edi
sub esi, edi
mov edi, ebp
mov dl, byte [eax + esi]
xor dl, byte [eax]
inc eax
or cl, dl
dec edi
jne 0x405c54
pop edi
xor eax, eax
test cl, cl
pop esi
sete al
pop ebp
pop ecx
ret
Function at 0x405f10
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x416ab6
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x41e138]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
mov eax, dword [0x41e138]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
lea esi, [edi + 0x10]
mov ecx, 0x100
mov dword [esp + 0x20], edi
mov dword [edi + 0xc], 0xffffffff
mov dword [edi], vtable.CryptoPP::MessageQueue.0
mov dword [edi + 4], vtable.CryptoPP::MessageQueue.1.0
call fcn.00404bf0
mov dword [esp + 0x48], 2
xor ebx, ebx
lea esi, [edi + 0x38]
push 8
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], esi
mov dword [esi], ebx
call fcn.0040eb91
add esp, 4
cmp eax, ebx
je 0x406050
mov dword [esi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [esi]
mov dword [eax], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea ecx, [esp + 0x14]
push ecx
push esi
mov byte [esp + 0x50], 3
call fcn.00406420
mov byte [esp + 0x48], 4
lea esi, [edi + 0x50]
push 8
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], esi
mov dword [esi], ebx
call fcn.0040eb91
add esp, 4
cmp eax, ebx
je 0x406027
mov dword [esi], eax
xor edx, edx
mov dword [eax + 4], edx
xor ecx, ecx
mov dword [eax], ecx
mov edx, dword [esi]
mov dword [edx], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea eax, [esp + 0x1c]
push eax
push esi
mov byte [esp + 0x50], 5
call fcn.004067d0
mov eax, edi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0040ddba
add esp, 0x40
ret
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x10], ebx
call fcn.0040e406
push 0x41c188
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x2c], vtable.std::bad_alloc.0
call fcn.0040ec11
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ebx
call fcn.0040e406
push 0x41c188
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x38], vtable.std::bad_alloc.0
call fcn.0040ec11
int3
Function at 0x409650
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x416dc8
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x41e138]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x41e138]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
cmp byte [esp + 0xac], 0
mov ebp, dword [esp + 0xa0]
mov ebx, dword [esp + 0xa4]
mov edi, ecx
jne 0x4096e4
push 8
xor esi, esi
push str.Inflator
lea ecx, [esp + 0x20]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], esi
mov byte [esp + 0x20], 0
call fcn.004018b0
lea eax, [esp + 0x18]
mov dword [esp + 0x98], esi
push eax
lea esi, [esp + 0x38]
call fcn.00402440
push 0x41c1c8
mov ecx, esi
push ecx
call fcn.0040ec11
mov eax, dword [edi + 0x3c]
lea esi, [edi + 0x1c]
mov dword [esp + 0x14], esi
test eax, eax
je 0x40970b
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi]
push 1
push 0
push eax
mov eax, dword [edx + 0x14]
push ecx
mov ecx, esi
mov dword [esi + 0x20], 0
call eax
mov eax, dword [esi + 0x18]
mov edx, dword [eax + 0x14]
add edx, dword [eax + 0xc]
cmp ebp, edx
jne 0x409729
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
push 1
push 0
push ebx
push ebp
mov ecx, esi
call edx
jmp 0x409733
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], ebx
mov byte [esi + 0x24], 0
mov esi, dword [esp + 0xa8]
test esi, esi
setne al
movzx ecx, al
push ecx
mov dword [esp + 0x9c], 1
call fcn.00409960
test esi, esi
je 0x40977e
mov eax, dword [edi + 0x44]
test eax, eax
je 0x409779
cmp eax, 4
je 0x409779
lea esi, [esp + 0x60]
call fcn.00408660
push 0x41c45c
mov edx, esi
push edx
call fcn.0040ec11
test esi, esi
je 0x40977e
dec esi
mov eax, dword [edi]
mov edx, dword [eax + 0xa4]
mov ecx, edi
call edx
mov ecx, dword [esp + 0xac]
mov edx, dword [eax]
mov edx, dword [edx + 0x88]
push ecx
push esi
push 0
push 0
push 0x41f60c
mov ecx, eax
call edx
lea eax, [esp + 0x14]
push eax
mov dword [edi + 0x14], 0
mov dword [esp + 0x9c], 0xffffffff
call fcn.00408520
xor eax, eax
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.0040ddba
add esp, 0x88
ret 0x10
Function at 0x40b9d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x41e138]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.0040ddd0
push esi
lea edx, [ebp - 0x20c]
push 0x104
push edx
mov dword [ebp - 0x210], 0
call fcn.0040dce2
push edi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040dd45
add esp, 0x24
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40ba76
mov eax, dword [ebp + 0x14]
push 0
lea edx, [ebp - 0x210]
push edx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ddba
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40ba90
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41629b
mov eax, dword fs:[0]
push eax
mov eax, 0x13b8c
call fcn.0040e230
mov eax, dword [0x41e138]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x41e]
push ecx
mov word [ebp - 0x420], ax
call fcn.0040ddd0
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x216]
push eax
mov word [ebp - 0x218], dx
call fcn.0040ddd0
add esp, 0x18
lea ecx, [ebp - 0x13b90]
call fcn.0040c370
lea ecx, [ebp - 0x13b94]
push ecx
push esi
lea ecx, [ebp - 0x13b90]
mov dword [ebp - 4], 0
call fcn.0040c4e0
cmp dword [ebp - 0x13b94], 0xffffffff
jne 0x40bb36
push 0xffffffffffffffff
call fcn.0040da65
lea edx, [ebp - 0x13b94]
push edx
lea ecx, [ebp - 0x13b90]
call fcn.0040c7a0
xor esi, esi
mov dword [ebp - 0x13b98], eax
cmp dword [ebp - 0x424], esi
jle 0x40bc42
lea ebx, [ebp - 0x13344]
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.0040ddd0
push 0x208
lea ecx, [ebp - 0x218]
push 0
push ecx
call fcn.0040ddd0
push edi
lea edx, [ebp - 0x420]
push 0x104
push edx
call fcn.0040dce2
push ebx
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.0040dd45
push edi
lea ecx, [ebp - 0x218]
push 0x104
push ecx
call fcn.0040dce2
push str.extract.tmp
lea edx, [ebp - 0x218]
push 0x104
push edx
call fcn.0040dd45
add esp, 0x48
lea eax, [ebp - 0x13b94]
push eax
push esi
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x13b90]
call fcn.0040c390
lea edx, [ebp - 0x420]
push edx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x13b90]
call fcn.0040c9e0
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x13b98]
mov eax, dword [ebp - 0x13b94]
push 0
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
inc esi
add ebx, 0x308
cmp esi, dword [ebp - 0x424]
jl 0x40bb62
mov ecx, dword [ebp - 0x13b94]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x13b90]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c380
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ddba
mov esp, ebp
pop ebp
ret 8
Function at 0x40bc80
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4162db
mov eax, dword fs:[0]
push eax
mov eax, 0x13b94
call fcn.0040e230
mov eax, dword [0x41e138]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push 0x206
xor ebx, ebx
mov edi, ecx
lea edx, [ebp - 0x216]
xor ecx, ecx
push ebx
push edx
mov dword [ebp - 0x13b9c], eax
mov word [ebp - 0x218], cx
call fcn.0040ddd0
push 0x206
lea ecx, [ebp - 0x41e]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x420], ax
call fcn.0040ddd0
add esp, 0x18
lea ecx, [ebp - 0x13b90]
call fcn.0040c370
lea edx, [ebp - 0x13ba0]
push edx
push esi
lea ecx, [ebp - 0x13b90]
mov dword [ebp - 4], ebx
call fcn.0040c4e0
mov eax, dword [ebp - 0x13ba0]
cmp eax, 0xffffffff
jne 0x40bd2d
push eax
call fcn.0040da65
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x13b98], ebx
cmp dword [ebp - 0x424], ebx
jle 0x40be48
lea eax, [ebp - 0x13344]
add edi, 4
mov dword [ebp - 0x13b94], eax
mov ecx, dword [ebp - 0x13b9c]
push ecx
lea edx, [ebp - 0x218]
push 0x104
push edx
call fcn.0040dce2
mov eax, dword [ebp - 0x13b94]
push eax
lea ecx, [ebp - 0x218]
push 0x104
push ecx
call fcn.0040dd45
add esp, 0x18
lea edx, [ebp - 0x218]
push edx
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x420]
push str.ASMBase____Attempting_to_Delete_File__s
push ecx
mov edx, 0x104
call fcn.0040cad0
add esp, 0xc
lea edx, [ebp - 0x420]
push edx
mov ecx, edi
call fcn.0040d180
test esi, esi
jne 0x40be12
cmp ebx, 0x14
jge 0x40be0e
push str.ASMBase____Delete_File_Failed.
mov ecx, edi
call fcn.0040d180
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1f4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.ASMBase____Attempting_to_Delete_File.
mov ecx, edi
call fcn.0040d180
inc ebx
test esi, esi
je 0x40bdcb
push str.ASMBase____Delete_File_Sucessful.
jmp 0x40be1e
test esi, esi
je 0x40be19
push str.ASMBase____Delete_File_Sucessful.
jmp 0x40be1e
push str.ASMBase____Delete_File_Wait_Time_Exceeded.
mov ecx, edi
call fcn.0040d180
mov eax, dword [ebp - 0x13b98]
add dword [ebp - 0x13b94], 0x308
inc eax
mov dword [ebp - 0x13b98], eax
cmp eax, dword [ebp - 0x424]
jl 0x40bd55
lea ecx, [ebp - 0x13b90]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c380
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ddba
mov esp, ebp
pop ebp
ret 8
Function at 0x40c390
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.0040e230
mov eax, dword [0x41e138]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1018], eax
xor eax, eax
mov dword [ebp - 0x1008], ecx
mov dword [ebp - 0x1010], eax
mov dword [ebp - 0x100c], eax
cmp edi, eax
jle 0x40c3fe
lea esi, [ecx + 0xb50]
mov dword [ebp - 0x1014], edi
lea ecx, [ecx]
mov ecx, dword [esi]
mov edx, dword [ebx]
push 1
push 0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
add esi, 0x308
dec dword [ebp - 0x1014]
jne 0x40c3e0
mov eax, dword [ebp - 0x1018]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
imul edi, edi, 0x308
mov ecx, dword [ebp - 0x1008]
lea edi, [edi + ecx + 0xb50]
mov esi, eax
mov eax, dword [edi]
shr eax, 0xc
mov dword [ebp - 0x1008], edi
test eax, eax
je 0x40c486
mov edi, eax
mov ecx, dword [ebx]
push 0
lea edx, [ebp - 0x1010]
push edx
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea edx, [ebp - 0x100c]
push edx
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
dec edi
jne 0x40c443
mov edi, dword [ebp - 0x1008]
mov edi, dword [edi]
mov eax, dword [ebx]
push 0
lea ecx, [ebp - 0x1010]
push ecx
and edi, 0xfff
push edi
lea edx, [ebp - 0x1004]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [ebp - 0x100c]
push ecx
push edi
lea edx, [ebp - 0x1004]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ddba
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40c9e0
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 0x3134
mov ebx, ecx
call fcn.0040d4ae
mov esi, eax
add esp, 4
test esi, esi
jne 0x40ca05
push 1
call fcn.0040da65
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call edi
mov ecx, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push ecx
mov dword [ebp - 0x28], eax
call edi
lea edx, [ebp - 0x28]
push edx
push esi
xor edi, edi
push 0x40cdd0
push 0x40ce00
mov ecx, ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], 0x1000
mov dword [ebp - 0x10], 0x40ce00
mov dword [ebp - 0xc], 0x40cdd0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
call fcn.0040c830
test eax, eax
je 0x40ca82
push 2
call fcn.0040da65
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
add ebx, 4
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea ecx, [ebp - 8]
push ecx
mov edx, ecx
push edx
mov eax, ecx
mov ecx, dword [ebp - 0x24]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov edx, dword [ebp - 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [ebp - 0x24]
push eax
call edi
push esi
call fcn.0040e25b
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40cfc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x40d005
mov eax, dword [ebp + 8]
lea ecx, [esi + 0x10]
push ecx
push 0
push esi
push 0x40cf80
push 0
push 0
mov dword [esi + 0x1c], eax
call fcn.0040ee5c
add esp, 0x18
mov dword [esi + 0xc], eax
test eax, eax
je 0x40d00d
cmp dword [esi + 0x18], 0
je 0x40cffe
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x14], 1
mov eax, dword [esi + 0x14]
pop esi
pop ebp
ret 4
push 0x417870
lea ecx, [esi + 4]
call fcn.0040d180
push 0xffffffffffffffff
call fcn.0040da65
int3

Function at 0x40d030
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
je 0x40d05c
cmp dword [esi + 0x18], 0
jne 0x40d05c
mov eax, dword [esi + 0xc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18], 1
pop esi
ret

Function at 0x40d0d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x41e138]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
mov eax, 4
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x34]
push eax
push 0
push 1
push 0
push 0
mov ecx, 0xb
mov esi, str.SoftwareClassLibrary
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
push 0
lea ecx, [ebp - 0x30]
push ecx
push 0x80000002
mov dword [ebp - 0x38], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
pop edi
pop esi
test eax, eax
jne 0x40d164
lea edx, [ebp - 0x3c]
push edx
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x40]
push ecx
push 0
push 0x4178d4
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40d15a
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ddba
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.0040ddba
mov esp, ebp
pop ebp
ret

Function at 0x40d180
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x41e138]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx + 4], 0
mov eax, dword [ebp + 8]
je 0x40d1d4
push eax
lea eax, [ebp - 0x804]
push 0x400
push eax
call fcn.0040dce2
push 0x417924
lea ecx, [ebp - 0x804]
push 0x400
push ecx
call fcn.0040dd45
add esp, 0x18
lea edx, [ebp - 0x804]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ddba
mov esp, ebp
pop ebp
ret 4
Function at 0x40d280
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x41e138]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0
mov ebx, ecx
mov ecx, 9
mov esi, 0x4179c0
lea edi, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0x10]
mov eax, dword [eax + 0x24]
push ecx
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
lea edx, [ebp - 0x28]
push edx
push eax
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
lea ecx, [ebx + 4]
test esi, esi
jne 0x40d2ef
push str.ASMBase____CreateWindow_Failed
call fcn.0040d180
jmp 0x40d340
push str.ASMBase____CreateWindow_Succeeded.
call fcn.0040d180
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push 0
push 0
push 0
lea ecx, [ebp - 0x44]
push ecx
call esi
test eax, eax
je 0x40d340
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea edx, [ebp - 0x44]
push edx
call edi
lea eax, [ebp - 0x44]
push eax
call ebx
push 0
push 0
push 0
lea ecx, [ebp - 0x44]
push ecx
call esi
test eax, eax
jne 0x40d324
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0040ddba
mov esp, ebp
pop ebp
ret 4

Function at 0x40ddba
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41e138]
jne 0x40ddc4
repz ret
jmp fcn.004129ba