joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40258f
Capabilities:
Query environment variable

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
je 0x4025b0
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0x40775c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x4025b0
inc esi
mov eax, esi
pop esi
ret

Function at 0x4034e9
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x409024]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x10
mov eax, 0x4053c5
call fcn.004042b8
push 0x4077f4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVCR100.dll__wdupenv_s]
add esp, 0xc
test eax, eax
jne 0x4035c7
push dword [ebp - 0x18]
call dword [sym.imp.MSVCR100.dll_free]
cmp dword [0x4090e4], 0
pop ecx
je 0x403546
xor eax, eax
inc eax
jmp 0x4035c9
lea eax, [ebp]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, esi
ja 0x4035c7
test eax, eax
je 0x4035c7
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.004015ba
and dword [ebp - 4], 0
push str.JavaDeployReg.log
lea ecx, [ebp - 0x14]
call fcn.004015ba
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00403eec
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x403597
call fcn.00401607
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x4035a2
mov eax, dword [esi]
jmp 0x4035a4
xor eax, eax
push 0x4078a0
push eax
push 0x4090e4
call dword [sym.imp.MSVCR100.dll__wfopen_s]
add esp, 0xc
test eax, eax
je 0x4035ec
test esi, esi
je 0x4035c7
mov ecx, esi
call fcn.00401607
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0040426a
add ebp, 0x20c
leave
ret
test esi, esi
je 0x40353e
mov ecx, esi
call fcn.00401607
jmp 0x40353e
Function at 0x40389d
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x4053ed
call fcn.004042eb
mov esi, dword [ebp + 8]
xor eax, eax
xor edi, edi
xor ebx, ebx
mov word [esi], ax
mov dword [ebp - 4], edi
call fcn.00401c94
test eax, eax
je 0x4038c8
call fcn.0040388e
mov ebx, eax
push 0x104
push esi
push ebx
push edi
push 0x40624c
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
cmp esi, edi
jge 0x403923
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__hToken__pPath__MAX_PATH_
call fcn.00404196
pop ecx
pop ecx
push edi
push esi
call fcn.00404fc0
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x14], esi
call fcn.00403e48
push eax
push esi
push 0x4067dc
call fcn.00404196
or dword [ebp - 4], 0xffffffff
add esp, 0xc
mov eax, 0x40391c
ret
cmp ebx, edi
je 0x40392e
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x4039df
push dword [ebp + 8]
mov dword [ebp - 4], 2
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x40398b
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x4038e7
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x4039df
push 1
push 0x1a
push dword [ebp + 8]
mov dword [ebp - 4], 4
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x4039df
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x4038e7
mov eax, esi
call fcn.00404321
ret

Function at 0x403c92
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1a0]
sub esp, 0x220
mov eax, dword [0x409024]
xor eax, ebp
mov dword [ebp + 0x19c], eax
mov eax, dword [ebp + 0x1a8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.00401775
mov ebx, eax
cmp ebx, esi
je 0x403d05
lea ecx, [ebp - 0x74]
call fcn.0040175a
mov eax, ebx
mov ecx, dword [ebp + 0x19c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040426a
add ebp, 0x1a0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x403d1d
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.00403c92
cmp eax, esi
jne 0x403d4f
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x403d0d
lea ecx, [ebp - 0x74]
call fcn.0040175a
push dword [ebp - 0x78]
mov ecx, edi
call fcn.004016eb
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.0040175a
mov eax, esi
jmp 0x403ceb
Function at 0x403fd2
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1044
call fcn.00404280
mov eax, dword [0x409024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov esi, 0x7fe
push esi
push eax
mov word [ebp - 0x1044], ax
lea eax, [ebp - 0x1042]
push eax
call sub.MSVCR100.dll_memset
push ebx
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x1044]
push 0x400
push eax
call dword [sym.imp.MSVCR100.dll__vsnwprintf_s]
add esp, 0x20
test eax, eax
jns 0x404034
xor eax, eax
mov word [ebp - 0x846], ax
xor eax, eax
push 0x3e
push eax
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x42]
push eax
call sub.MSVCR100.dll_memset
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.00403f50
push 0x407b5c
lea eax, [ebp - 0x44]
push 0x20
push eax
call dword [sym.imp.MSVCR100.dll_wcscat_s]
xor eax, eax
push esi
push eax
mov word [ebp - 0x844], ax
lea eax, [ebp - 0x842]
push eax
call sub.MSVCR100.dll_memset
add esp, 0x2c
mov eax, edi
push 2
lea edx, [eax + 2]
pop ebx
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x404084
sub eax, edx
sar eax, 1
cmp eax, 6
jbe 0x4040d4
mov ecx, 0x407b60
lea eax, [edi + eax*2 - 0xc]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4040c6
test dx, dx
je 0x4040c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4040c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4040a0
xor eax, eax
jmp 0x4040cb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4040d4
xor esi, esi
inc esi
jmp 0x4040d6
xor esi, esi
lea eax, [ebp - 0x44]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x4040dc
sub eax, edx
sar eax, 1
mov edi, eax
mov eax, str.Error:
test esi, esi
jne 0x4040fa
mov eax, 0x407b80
lea ecx, [ebp - 0x1044]
push ecx
push eax
lea esi, [edi + edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.P:_04d_T:_04d__s_s
mov eax, 0x3ff
sub eax, edi
push 0xffffffffffffffff
push eax
lea eax, [ebp + esi - 0x844]
push eax
call dword [sym.imp.MSVCR100.dll__snwprintf_s]
add esp, 0x20
test eax, eax
jns 0x40414c
xor eax, eax
movzx ecx, word [eax + 0x407bac]
mov word [ebp + eax - 0x4e], cx
add eax, ebx
test cx, cx
jne 0x404139
push esi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x844]
push eax
call sub.MSVCR100.dll_memcpy
lea edi, [ebp - 0x844]
add esp, 0xc
sub edi, 2
mov ax, word [edi + 2]
add edi, ebx
test ax, ax
jne 0x404169
lea eax, [ebp - 0x844]
mov esi, 0x407bb4
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040426a
leave
ret

Function at 0x40426a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x409024]
jne 0x404274
repz ret
jmp fcn.00404744
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40596d
pop dword [ebp - 0x48]
mov eax, 0x40596d
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x49b55fa7
add dword [ebp - 0x58], 0x49ce5a4
mov dword [ebp - 0x54], 0xd2aaadd3
sub dword [ebp - 0x54], 0xa077618e
mov dword [ebp - 0x50], 0x15d1c20a
sub dword [ebp - 0x50], 0xc9857ddc
mov dword [ebp - 0x4c], 0x5ff88164
sub dword [ebp - 0x4c], 0x5ff88164
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xee320ef0
sub dword [ebp - 0x58], 0x79bfa59a
mov dword [ebp - 0x54], 0x1420e2bd
add dword [ebp - 0x54], 0x2d4b7eb8
mov dword [ebp - 0x50], 0x5b26e482
add dword [ebp - 0x50], 0x84887ea
mov dword [ebp - 0x4c], 0xd110052d
add dword [ebp - 0x4c], 0x2eeffad3
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3b2c7
push 0
call eax
mov ecx, 0xa69d0b4d
add ecx, 0x59634e87
xor edi, edi
add edi, eax
mov ebx, 0x410000
add ebx, dword [ebp - 0x48]
mov edx, 0x4f525392
sub edx, 0x625918a9
sub dword [ebp - 8], esi
mov esi, dword [ebx]
sub esi, edx
mov dword [ebp - 0x1c], 0x461afbbd
mov dword [edi], esi
xor dword [ebp - 0x28], edi
add edi, 4
add ebx, 0x8ea68ddd
sub ebx, 0x8ea68dd9
loop 0x405a7c
add eax, 0x15a23
xor ebx, ebx
add ebx, eax
add eax, 0x539616c0
sub eax, 0x539616bb
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x408e5e
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
cmp dword [0x4105c4], 0
je 0x408e7e
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x408eac
push esi
lea ecx, [ebp - 0x214]
push dword [ebp + 8]
call fcn.00408c4a
push dword [ebp + 0xc]
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.00408c21
mov eax, esi
pop esi
leave
ret 8

Function at 0x40903d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
cmp dword [0x4105c4], 0
je 0x40905a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x409085
push esi
lea ecx, [ebp - 0x214]
push dword [ebp + 8]
jmp loc.00419d12
leave
ret 4

Function at 0x4091f0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
cmp dword [0x4105c4], 0
je 0x40920d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x409238
push esi
lea ecx, [ebp - 0x214]
push dword [ebp + 8]
call fcn.00408c4a
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.00408c21
mov eax, esi
pop esi
leave
ret 4

Function at 0x4092f1
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
cmp dword [0x4105c4], 0
je 0x409311
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x40933f
push esi
lea ecx, [ebp - 0x214]
push dword [ebp + 8]
call fcn.00408c4a
push dword [ebp + 0xc]
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.00408c21
mov eax, esi
pop esi
leave
ret 8

Function at 0x40939e
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x52c
cmp dword [0x4105c4], 0
je 0x4093c4
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x409426
push esi
lea ecx, [ebp - 0x52c]
push dword [ebp + 8]
call fcn.00408c4a
push dword [ebp + 0xc]
lea ecx, [ebp - 0x318]
call fcn.00408c4a
push dword [ebp + 0x14]
lea ecx, [ebp - 0x104]
call fcn.00408d3f
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x314]
push dword [ebp - 0x528]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [ebp - 0x318]
mov esi, eax
call fcn.00408c21
lea ecx, [ebp - 0x52c]
call fcn.00408c21
mov eax, esi
pop esi
leave
ret 0x10
Function at 0x10007baf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10007bbe
pop dword [ebp - 0x3c]
mov eax, 0x10007bbe
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x31611dae
add dword [ebp - 0x4c], 0x1cf1279d
mov dword [ebp - 0x48], 0x61e281e9
add dword [ebp - 0x48], 0xd050ca5c
mov dword [ebp - 0x44], 0x36ceeb0a
add dword [ebp - 0x44], 0x157d5924
mov dword [ebp - 0x40], 0x2c61b5b2
sub dword [ebp - 0x40], 0x2c61b5b2
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xbcfb109a
add eax, 0x53056fb2
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xa16f9c4b
add dword [ebp - 0x4c], 0xd302cd0b
mov dword [ebp - 0x48], 0x4d7234b8
add dword [ebp - 0x48], 0xf3fa2cbd
mov dword [ebp - 0x44], 0xa07e057c
add dword [ebp - 0x44], 0xc2f166f0
mov dword [ebp - 0x40], 0x897c08e8
sub dword [ebp - 0x40], 0x897c08e8
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3965e
push 0
call eax
mov ecx, 0x52ec
xor ebx, ebx
add ebx, eax
mov esi, 0x4fadcad2
add esi, 0xc0532f2e
add esi, dword [ebp - 0x3c]
mov edi, 0x5f36782e
sub edi, 0xe96d9f13
mov edx, dword [esi]
xor dword [ebp - 0x2c], 0xaf6358c
sub edx, edi
xor dword [ebp - 0x24], 0x213297e6
mov dword [ebx], edx
add dword [ebp - 8], 0xee3a1bbf
add ebx, 0x46c16310
sub ebx, 0x46c1630c
add esi, 0xee2b5f65
sub esi, 0xee2b5f61
loop 0x10007cd2
add eax, 0x78613d0
add eax, 0xf87b2ab3
xor ebx, ebx
add ebx, eax
add eax, 0x1af43927
sub eax, 0x1af43922
mov ecx, 0x18691fec
add ecx, 0xf796e014
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x406100
Capabilities:
Check mutex on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x406116
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov ecx, dword [esp + 8]
mov word [esi + 4], 0
call fcn.00402650
test al, al
jne 0x406134
mov ecx, dword [esp + 8]
call fcn.00405b00
jmp 0x406136
xor eax, eax
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
je 0x406158
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x406158
mov byte [esi + 5], 1
cmp dword [esi], 0
pop esi
setne al
ret 4

Function at 0x406170
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c5c68
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x50e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edi]
test eax, eax
je 0x4061b6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
lea ecx, [ebp - 0x14]
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.0040d430
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x4061df
lea ebx, [esi + 8]
jmp 0x4061e1
xor ebx, ebx
mov ecx, dword [ebp - 0x18]
call fcn.00402650
test al, al
jne 0x4061f7
mov ecx, dword [ebp - 0x18]
call fcn.00405b00
jmp 0x4061f9
xor eax, eax
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
je 0x40621a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40621a
mov byte [edi + 5], 1
cmp dword [edi], 0
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x406243
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x406258
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.004a12e5
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a100a
mov esp, ebp
pop ebp
ret 4
Function at 0x406290
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c5c68
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x50e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x4062d3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
push ecx
lea ecx, [ebp - 0x14]
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.0040d4f0
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x406300
lea eax, [esi + 8]
mov dword [ebp - 0x18], eax
jmp 0x406307
mov dword [ebp - 0x18], 0
mov ecx, ebx
call fcn.00402650
test al, al
jne 0x40631b
mov ecx, ebx
call fcn.00405b00
jmp 0x40631d
xor eax, eax
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
test eax, eax
jne 0x40636e
call ecx
cmp eax, 5
jne 0x406368
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, ebx
call fcn.00402650
test al, al
jne 0x406358
mov ecx, ebx
call fcn.00405b00
jmp 0x40635a
xor eax, eax
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [edi]
test eax, eax
je 0x40638c
call ecx
cmp eax, 0xb7
jne 0x406381
mov byte [edi + 5], 1
mov ecx, dword [edi]
call fcn.0040bdc0
mov eax, dword [edi]
test eax, eax
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x4063b2
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4063c7
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.004a12e5
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a100a
mov esp, ebp
pop ebp
ret 4
Function at 0x407a60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c5fd8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x50e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00402650
test al, al
je 0x407a9d
xor al, al
jmp 0x407bd1
push esi
lea ecx, [ebp - 0x28]
call fcn.00402770
mov dword [ebp - 4], 0
mov edx, 4
lea ecx, [ebp - 0x28]
call fcn.0040a060
lea ecx, [ebp - 0x28]
call fcn.00405b00
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x407bbe
lea ecx, [ebp - 0x40]
call fcn.00402750
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.00414cb0
test al, al
je 0x407afe
lea ecx, [ebp - 0x40]
call fcn.00405b00
push eax
call edi
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00402290
cmp esi, 0xffffffff
jne 0x407bbe
lea ecx, [ebp - 0x28]
call fcn.00402860
cmp eax, 2
jbe 0x407bba
lea ecx, [ebp - 0x28]
call fcn.00402860
lea ecx, [ebp - 0x28]
lea ebx, [eax - 1]
call fcn.00402850
mov esi, eax
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x407b43
mov ecx, dword [esi]
cmp word [ecx + ebx*2], 0x5c
je 0x407b62
lea ecx, [ebp - 0x28]
call fcn.00402860
cmp dword [esi + 0x14], 8
jb 0x407b5a
mov esi, dword [esi]
cmp word [esi + eax*2 - 2], 0x2f
jne 0x407bba
mov edx, 0x20
lea ecx, [ebp - 0x28]
call fcn.0040a060
lea ecx, [ebp - 0x28]
call fcn.00405b00
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x407bbe
lea ecx, [ebp - 0x40]
call fcn.00402750
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.00414cb0
test al, al
je 0x407ba9
lea ecx, [ebp - 0x40]
call fcn.00405b00
push eax
call edi
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00402290
cmp esi, 0xffffffff
jne 0x407bbe
xor bl, bl
jmp 0x407bc0
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402290
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a100a
mov esp, ebp
pop ebp
ret
Function at 0x407bf0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c6018
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x50e008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.00402650
test al, al
je 0x407c30
xor al, al
jmp 0x407d6a
push esi
lea ecx, [ebp - 0x2c]
call fcn.00402770
mov dword [ebp - 4], 0
mov edx, 4
lea ecx, [ebp - 0x2c]
call fcn.0040a060
lea ecx, [ebp - 0x2c]
call fcn.00405b00
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x407c9e
lea ecx, [ebp - 0x44]
call fcn.00402750
mov byte [ebp - 4], 1
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x2c]
call fcn.00414cb0
test al, al
je 0x407c8d
lea ecx, [ebp - 0x44]
call fcn.00405b00
push eax
call edi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.00402290
cmp ebx, 0xffffffff
je 0x407ca7
test bl, 0x10
je 0x407d57
lea ecx, [ebp - 0x2c]
call fcn.00402860
cmp eax, 2
jbe 0x407d53
lea ecx, [ebp - 0x2c]
call fcn.00402860
lea ecx, [ebp - 0x2c]
lea ebx, [eax - 1]
call fcn.00402850
mov esi, eax
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x407cd7
mov ecx, dword [esi]
cmp word [ecx + ebx*2], 0x5c
je 0x407cf6
lea ecx, [ebp - 0x2c]
call fcn.00402860
cmp dword [esi + 0x14], 8
jb 0x407cee
mov esi, dword [esi]
cmp word [esi + eax*2 - 2], 0x2f
jne 0x407d53
mov edx, 0x20
lea ecx, [ebp - 0x2c]
call fcn.0040a060
lea ecx, [ebp - 0x2c]
call fcn.00405b00
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x407d4e
lea ecx, [ebp - 0x44]
call fcn.00402750
mov byte [ebp - 4], 2
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x2c]
call fcn.00414cb0
test al, al
je 0x407d3d
lea ecx, [ebp - 0x44]
call fcn.00405b00
push eax
call edi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.00402290
cmp ebx, 0xffffffff
je 0x407d53
test bl, 0x10
je 0x407d57
xor bl, bl
jmp 0x407d59
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00402290
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a100a
mov esp, ebp
pop ebp
ret
Function at 0x407d90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c6050
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x50e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00402650
test al, al
je 0x407dcc
xor al, al
jmp 0x407e56
push esi
lea ecx, [ebp - 0x28]
call fcn.00402770
mov dword [ebp - 4], 0
mov edx, 4
lea ecx, [ebp - 0x28]
call fcn.0040a060
lea ecx, [ebp - 0x28]
call fcn.00405b00
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x407e3a
lea ecx, [ebp - 0x40]
call fcn.00402750
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.00414cb0
test al, al
je 0x407e29
lea ecx, [ebp - 0x40]
call fcn.00405b00
push eax
call esi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00402290
cmp ebx, 0xffffffff
je 0x407e43
test bl, 0x10
je 0x407e43
mov bl, 1
jmp 0x407e45
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402290
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a100a
mov esp, ebp
pop ebp
ret