joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10037090
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x10052f14], eax
je 0x100370b4
mov eax, 0x10dd
jmp 0x1003725c
cmp dword [0x10052f18], 0
je 0x100370c7
mov eax, dword [0x10052f18]
jmp 0x1003725c
cmp dword [ebp + 0xc], 0
jne 0x100370d7
mov eax, 0x57
jmp 0x1003725c
cmp dword [ebp + 8], 0
jne 0x100370e7
mov eax, 6
jmp 0x1003725c
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x10037110
mov dword [ebp - 8], 6
mov ecx, dword [ebp - 8]
mov dword [0x10052f18], ecx
mov edx, dword [ebp + 8]
mov dword [0x10052f1c], edx
mov eax, dword [ebp - 8]
jmp 0x1003725c
push 0x18
call fcn.10038756
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1003716b
mov dword [ebp - 8], 8
mov ecx, dword [ebp - 8]
mov dword [0x10052f18], ecx
cmp dword [ebp - 4], 0
je 0x1003715a
mov edx, dword [ebp - 4]
mov dword [ebp - 0x20], edx
push 0x18
mov eax, dword [ebp - 0x20]
push eax
call fcn.10038d0e
add esp, 8
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov dword [0x10052f1c], ecx
mov eax, dword [ebp - 8]
jmp 0x1003725c
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.10037070
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10037070
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x36]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0xc], 0
je 0x100371ab
cmp dword [ebp - 0xc], 0x1e
jbe 0x100371c7
mov dword [ebp - 8], 9
cmp dword [0x10052f0c], 0
je 0x100371c2
jmp 0x10037139
jmp 0x10037130
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
cmp ecx, dword [ebp + 0xc]
je 0x100371ee
mov dword [ebp - 8], 9
cmp dword [0x10052f0c], 0
je 0x100371e9
jmp 0x10037139
jmp 0x10037130
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x18]
push edx
push 0x40
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x10037219
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x10037130
mov edx, dword [ebp - 4]
mov dword [edx + 4], 1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x10052f24]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x10052f24], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x10037270
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x10052f14], eax
je 0x1003728d
mov eax, 0x10dd
jmp 0x10037370
mov eax, dword [0x10052f24]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1003730c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call sub.KERNEL32.dll_VirtualProtect
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x100372e8
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x100372e8
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10036110
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
push 0x18
mov edx, dword [ebp - 0xc]
push edx
call fcn.10038d0e
add esp, 8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10037295
mov dword [0x10052f24], 0
call fcn.100369f0
mov ecx, dword [0x10052f20]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x1003735a
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call sub.KERNEL32.dll_ResumeThread
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 8
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10038d0e
add esp, 8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10037324
mov dword [0x10052f20], 0
mov dword [0x10052f14], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10037850
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x10052f18], 0
je 0x10037869
mov eax, dword [0x10052f18]
jmp 0x10037908
call sub.KERNEL32.dll_GetCurrentThread
cmp dword [ebp + 8], eax
jne 0x1003787a
xor eax, eax
jmp 0x10037908
push 8
call fcn.10038756
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100378d2
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x100378bb
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
push 8
mov edx, dword [ebp - 0x10]
push edx
call fcn.10038d0e
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x10052f18], eax
mov dword [0x10052f1c], 0
mov eax, dword [ebp - 8]
jmp 0x10037908
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x100378ea
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x1003789a
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x10052f20]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x10052f20], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1003b410
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003eb5e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10051014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x10051020]
cmp eax, 0xffffffff
jne 0x1003b446
xor ebx, ebx
jmp 0x1003b44f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x1003b491
nop dword [eax]
cmp dword [ebx + 0x18], 0
mov esi, dword [ebx + 0xc]
jne 0x1003b4d0
test esi, esi
jne 0x1003b4d4
push 0x1003af10
push 0x100532b8
call fcn.1003aa80
mov eax, dword [0x10051020]
add esp, 8
cmp eax, 0xffffffff
je 0x1003b491
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1003b4be
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1003b4be
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x1003b516
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x1003b4ff
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x1003b4d4
cmp dword [ebx + 0x18], 0
je 0x1003b460
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x1003b53d
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x1003b53d
push eax
mov eax, dword [esi + 0x14]
push ecx
call eax
add esp, 8
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.1003af30
cmp dword [ebx + 0x18], 0
jne 0x1003b520
jmp 0x1003b460
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ed0
mov ecx, 0x73b643cc
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x5f552f95
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x40107d
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59ca40
push 0x413b60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x1c], 1
and dword [ebp - 4], 0
push edx
push ecx
push ebx
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 0x1c]
pop ebx
pop ecx
pop edx
jmp 0x4010dd
or dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404420
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x588d87
call fcn.00414dac
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0043e500
mov eax, dword [0x5d8b34]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi + 0x3c], eax
lea eax, [esi + 0x244]
mov dword [eax], method.CCommandLineInfo.virtual_0
mov dword [eax + 4], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0xc], edi
mov dword [eax + 8], edi
lea ecx, [esi + 0x258]
mov byte [ebp - 4], 2
call fcn.00433f80
mov ebx, 0x100
lea eax, [esi + 0x44]
push ebx
push edi
push eax
mov byte [ebp - 4], 3
mov dword [esi], 0x59cb20
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x34], edi
call fcn.00413c50
push ebx
lea eax, [esi + 0x144]
push edi
push eax
call fcn.00413c50
add esp, 0x18
lea ecx, [esi + 0x3c]
mov dword [esi + 0x40], edi
push 0x5efa58
call fcn.00579da7
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x404641
Capabilities:
Get common file path

Disassembly:
mov eax, 0x588de4
call fcn.00414dac
sub esp, 0x15c
push ebx
xor ebx, ebx
cmp dword [0x5efc54], ebx
jne 0x4047a9
push edi
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0x60]
mov dword [ebp - 0x64], ebx
rep stosd dword es:[edi], eax
push 0x5efa58
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], 0x40
call fcn.00579c8c
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x167]
mov byte [ebp - 0x168], bl
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x168]
push 0x23
push eax
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x168]
lea ecx, [ebp - 0x14]
push eax
call fcn.00579c8c
push 0x5d41b0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00577166
lea eax, [ebp - 0x168]
push 0x103
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
lea eax, [ebp - 0x168]
lea ecx, [ebp - 0x10]
push eax
call fcn.00579da7
push str.OEAViewerModuleOeaViewer.ini
lea ecx, [ebp - 0x10]
call fcn.00579ffa
push dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.00403acc
add esp, 0xc
test eax, eax
je 0x40476e
mov dword [ebp - 0x5c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 1
mov dword [ebp - 0x58], eax
pop edi
push edi
call fcn.004024f6
cmp dword [ebp - 0x18], ebx
pop ecx
mov dword [ebp - 0x4c], eax
jne 0x404745
mov dword [ebp - 0x60], edi
lea eax, [ebp - 0x24]
push eax
call fcn.0041161a
fld qword [eax]
fstp qword [ebp - 0x54]
jmp 0x404771
cmp dword [ebp - 0x60], ebx
je 0x404769
lea eax, [ebp - 0x24]
push eax
call fcn.0041161a
fld qword [eax]
fld qword [ebp - 0x54]
fcomp st(1)
fnstsw ax
sahf
fstp st(0)
ja 0x404769
mov dword [ebp - 0x60], edi
lea eax, [ebp - 0x24]
jmp 0x404738
mov dword [ebp - 0x60], ebx
jmp 0x404771
push 1
pop edi
call fcn.00403db9
test eax, eax
je 0x404791
lea eax, [ebp - 0x64]
push 0x40
push eax
call fcn.00403e8d
pop ecx
test eax, eax
pop ecx
je 0x404791
mov dword [0x5efc54], edi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.00579c1e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00579c1e
pop edi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40581a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
lea ecx, [ebp - 8]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, 0x20019
xor eax, eax
push ecx
push ebx
push eax
push str.SystemCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x405962
and byte [ebp - 0x114], al
push edi
push 0x41
lea edi, [ebp - 0x113]
pop ecx
push dword [ebp + 8]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x114]
push str._sConnection
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp + 8]
xor edi, edi
push eax
push ebx
lea eax, [ebp - 0x114]
push edi
push eax
mov dword [ebp + 8], edi
push dword [ebp - 8]
call esi
test eax, eax
jne 0x405958
lea eax, [ebp - 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 4]
push eax
push edi
push str.MediaSubType
mov ebx, 0x104
push dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], 1
call esi
test eax, eax
jne 0x4058d9
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x114]
mov dword [eax], ecx
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 4]
push eax
push edi
push str.PnpInstanceID
push dword [ebp + 8]
call esi
test eax, eax
jne 0x405948
mov esi, 0x5d4ba8
push esi
call fcn.00413dd0
push eax
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.004153b3
mov ecx, dword [ebp + 0x10]
add esp, 0x10
neg eax
sbb eax, eax
inc eax
mov dword [ecx], eax
jne 0x405948
mov esi, 0x5d4ba4
push esi
call fcn.00413dd0
push eax
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.004153b3
mov ecx, dword [ebp + 0x14]
add esp, 0x10
neg eax
sbb eax, eax
inc eax
mov dword [ecx], eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0x10
Function at 0x4062e3
Capabilities:
Create directory

Disassembly:
mov eax, 0x588f64
call fcn.00414dac
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x406412
push edi
call fcn.00413dd0
test eax, eax
pop ecx
je 0x406412
push edi
lea ecx, [ebp + 8]
call fcn.00579c8c
and dword [ebp - 4], 0
push 0x3a
lea ecx, [ebp + 8]
call fcn.0057a13f
mov esi, eax
or ebx, 0xffffffff
cmp esi, ebx
jne 0x406351
push 2
push 0x5d50b4
push edi
call fcn.004153b3
add esp, 0xc
test eax, eax
jne 0x406353
push 2
push 0x5c
lea ecx, [ebp + 8]
call fcn.0057a14d
mov esi, eax
cmp esi, ebx
je 0x406353
inc esi
inc esi
push esi
push 0x5c
lea ecx, [ebp + 8]
call fcn.0057a14d
mov esi, eax
cmp esi, ebx
je 0x4063b1
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x10]
push esi
push eax
lea ecx, [ebp + 8]
call fcn.00576bc5
push 0
mov byte [ebp - 4], 1
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x406393
call edi
cmp eax, 0xb7
jne 0x4063d3
inc esi
lea ecx, [ebp + 8]
push esi
push 0x5c
call fcn.0057a14d
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.00579c1e
cmp esi, ebx
jne 0x40636a
mov esi, dword [ebp + 8]
call fcn.00485690
push eax
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.00579c1e
push 1
pop eax
jmp 0x406414
cmp dword [0x5f3320], 0
je 0x4063fb
call edi
push eax
push dword [ebp - 0x10]
push str.strFolder__S___gle_0x_x_
push str.safedisk
push 4
push 0x5f2a8c
call fcn.00472c70
add esp, 0x18
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00579c1e
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.00579c1e
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x406498
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x588faf
call fcn.00414dac
sub esp, 0x1c
and dword [ebp - 0x18], 0
push ebx
push esi
mov esi, 0x5efa58
push edi
push esi
lea ecx, [ebp - 0x14]
call fcn.00579c8c
and word [ebp - 0x28], 0
xor eax, eax
lea edi, [ebp - 0x26]
push 1
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
pop ebx
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push esi
lea ecx, [ebp - 0x10]
call fcn.00579c8c
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push str._sOCularSD_
push eax
call fcn.0057703b
add esp, 0xc
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x406528
xor esi, esi
push dword [ebp - 0x10]
call fcn.004062e3
test eax, eax
pop ecx
jne 0x406528
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0xa
jl 0x40650a
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x14]
push eax
call fcn.00579d57
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.00579993
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.00579c1e
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00579c1e
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x40699c
Capabilities:
Check mutex on windows

Disassembly:
push str.GlobalTEC_OCULAR__AGENT_V3_MUTEX_AGENT
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
jne 0x4069c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 5
neg eax
sbb eax, eax
inc eax
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
ret

Function at 0x406eb7
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x406ed7
test al, 1
je 0x406ed7
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x406eda
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x5890c7
call fcn.00414dac
push ecx
mov eax, dword [0x59f140]
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
lea ecx, [esi + 8]
mov dword [ecx], eax
mov eax, dword [0x59f140]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x34], eax
mov eax, dword [0x59f140]
mov dword [esi + 0x38], eax
mov eax, dword [0x59f144]
mov dword [esi + 0x144], eax
mov edi, 0x5efa58
mov byte [ebp - 4], 3
push edi
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.00427bc0
push 0x10
lea eax, [esi + 0x14]
push ebx
push eax
mov dword [esi + 0xc], ebx
call fcn.00413c50
add esp, 0xc
lea ecx, [esi + 0x34]
push edi
call fcn.00427bc0
push edi
lea ecx, [esi + 0x38]
call fcn.00427bc0
push 0x104
lea eax, [esi + 0x40]
push ebx
push eax
mov dword [esi + 0x30], ebx
call fcn.00413c50
add esp, 0xc
lea ecx, [esi + 0x144]
call fcn.0042cf90
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40713c
Capabilities:
Get common file path

Disassembly:
mov eax, 0x589158
call fcn.00414dac
sub esp, 0x10c
push ebx
push esi
mov esi, ecx
push edi
push 0x5efa58
lea ecx, [ebp - 0x10]
call fcn.00579c8c
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
je 0x4071c1
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp + 8]
call fcn.0040862d
pop ecx
cmp eax, ebx
pop ecx
jne 0x4071ba
cmp dword [0x5f3320], ebx
je 0x40719e
push str.CSDSafeDiskMgr::CalcDefaultSafeDiskInfo___No_Free_Volume_r_n
push str.safedisk
push 4
push 0x5f2a8c
call fcn.00472c70
add esp, 0x10
push 2
mov ecx, esi
call fcn.00408a86
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00579c1e
xor eax, eax
jmp 0x407261
add al, 0x40
movsx eax, al
jmp 0x4071f4
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x117]
mov byte [ebp - 0x118], bl
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x407206
movsx eax, byte [ebp - 0x118]
push eax
lea eax, [ebp - 0x10]
push str._c:_OcularOEACache.sys
push eax
call fcn.0057703b
add esp, 0xc
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], ebx
je 0x407253
push eax
mov ecx, esi
call fcn.00407272
mov edi, eax
cmp edi, ebx
jne 0x40723f
cmp dword [0x5f3320], ebx
je 0x407253
push str.CSDSafeDiskMgr::CalcDefaultSafeDiskInfo___CalcSize_Error__r_n
push str.safedisk
push 4
push 0x5f2a8c
call fcn.00472c70
add esp, 0x10
jmp 0x407253
push dword [ebp - 0x10]
lea ecx, [esi + 8]
call fcn.00427bc0
push 1
mov dword [esi + 0x10], ebx
mov dword [esi + 0xc], edi
pop ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00579c1e
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4