joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405bf0
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x418808
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x426034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str._DoInstall__begin...
push 1
push 0x105
push 0x41ca54
push 0x41ca78
mov dword [ebp - 4], 1
call fcn.0040bd30
add esp, 0x14
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push 0xf01ff
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], eax
test eax, eax
jne 0x405d2e
call edi
cmp eax, 0x424
jne 0x405d13
push 0x41ca90
push 1
push 0x10b
push 0x41cabc
push 0x41cae0
call fcn.0040bd30
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
mov word [ecx], ax
lea eax, [ebp + 0x20]
push eax
call fcn.004014c0
sub esp, 0x18
mov byte [ebp - 4], 2
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp + 8]
push eax
call fcn.004014c0
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.004058b0
mov dword [esi + 4], eax
test eax, eax
jne 0x405d2e
push 0x41caf8
push 1
push 0x10f
push 0x41cb14
push 0x41cb38
call fcn.0040bd30
add esp, 0x14
jmp 0x405db0
call edi
push eax
push 0x41cb50
push 1
push 0x115
push 0x41cb98
push 0x41cbbc
jmp 0x405da8
push dword [esi + 4]
call fcn.00405ad0
test al, al
je 0x405d5c
push str.Check_Service_already_running_
push 1
push 0x11d
push 0x41cbf4
push 0x41cc18
call fcn.0040bd30
add esp, 0x14
mov bl, 1
jmp 0x405db2
push 0
push 0
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x405d8f
push 0x41cc30
push 1
push 0x123
push 0x41cc48
push 0x41cc6c
call fcn.0040bd30
add esp, 0x14
mov bl, 1
jmp 0x405db2
call edi
push eax
push 0x41cc84
push 1
push 0x128
push 0x41cc9c
push str.CServiceObj::DoInstall
call fcn.0040bd30
add esp, 0x18
xor bl, bl
cmp dword [ebp + 0x1c], 8
mov esi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
jb 0x405dc6
push dword [ebp + 8]
call esi
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
cmp dword [ebp + 0x34], 8
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
jb 0x405de8
push dword [ebp + 0x20]
call esi
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
Function at 0x405e00
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x418838
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x426034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.DoUninstall...
push 1
push 0x130
push 0x41cce8
push 0x41cd0c
mov dword [ebp - 4], 0
call fcn.0040bd30
add esp, 0x14
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push 0xf01ff
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [edi + 4], eax
test eax, eax
jne 0x405ec4
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x424
jne 0x405ea6
push str.WARN:The_specified_service_does_not_exist_as_an_installed_service.
push 1
push 0x136
push 0x41cd6c
push 0x41cd90
call fcn.0040bd30
add esp, 0x14
mov bl, 1
jmp 0x405f7a
call esi
push eax
push str.ERR:OpenService_fail_0x_x_n
push 1
push 0x139
push 0x41cdc8
push 0x41cdec
jmp 0x405f70
push eax
call fcn.00405ad0
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test al, al
je 0x405f28
lea eax, [ebp - 0x2c]
push eax
push 1
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x405f07
push str.SERVICE_CONTROL_STOP_SUCCESS
push 1
push 0x142
push 0x41ce28
push 0x41ce4c
call fcn.0040bd30
add esp, 0x14
jmp 0x405f28
call esi
push eax
push str.ERR:ControlService_fail_0x_x_n
push 1
push 0x146
push 0x41ce88
push 0x41ceac
call fcn.0040bd30
add esp, 0x18
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x405f57
push str.DeleteService__SUCCESS
push 1
push 0x14b
push 0x41cee0
push 0x41cf04
call fcn.0040bd30
add esp, 0x14
mov bl, 1
jmp 0x405f7a
call esi
push eax
push str.ERR:DeleteService_fail_0x_x
push 1
push 0x150
push 0x41cf3c
push str.CServiceObj::DoUninstall
call fcn.0040bd30
add esp, 0x18
xor bl, bl
cmp dword [ebp + 0x1c], 8
jb 0x405f8c
push dword [ebp + 8]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00417832
mov esp, ebp
pop ebp
ret 0x18
Function at 0x406850
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x14], 8
jb 0x406861
mov eax, dword [ebx]
jmp 0x406863
mov eax, ebx
push 0x406a60
push eax
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
mov dword [ebx + 0x34], eax
test eax, eax
jne 0x40689d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._SVC___ERR:RegisterServiceCtrlHandler_fail__0x_x_n
push 1
push 0x3d
push 0x41dc6c
push 0x41dc94
call fcn.0040bd30
add esp, 0x18
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
push str._SVC___initial_status_to_SERVICE_START_PENDING...
push 1
push 0x46
push 0x41dcec
lea edi, [ebx + 0x18]
mov dword [ebx + 0x28], 0
mov dword [edi], 0x10
push 0x41dd14
call fcn.0040bd30
mov eax, dword [0x42604c]
add esp, 0x14
mov esi, dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov dword [ebx + 0x2c], eax
inc eax
mov dword [ebx + 0x1c], 2
push edi
push dword [ebx + 0x34]
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x30], 0xbb8
mov dword [ebx + 0x20], 0
mov dword [0x42604c], eax
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push ebx
push 0x4069f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push dword [ebp - 4]
mov dword [ebx + 0x38], eax
push str._SVC___Success_create_work_thread_:__d
push 1
push 0x4e
push 0x41dd60
push 0x41dd88
call fcn.0040bd30
push str._SVC___initialization_is_complete__set_status_SERVICE_RUNNING
push 1
push 0x51
push 0x41ddec
push 0x41de14
call fcn.0040bd30
add esp, 0x2c
mov dword [ebx + 0x1c], 4
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x20], 1
push edi
push dword [ebx + 0x34]
mov dword [ebx + 0x2c], 0
call esi
push str._SVC___Perform_work_until_service_stops...
push 1
push 0x55
push 0x41de64
push 0x41de8c
call fcn.0040bd30
add esp, 0x14
push 0xffffffffffffffff
push dword [ebx + 0x38]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str._SVC___Work_thread_has_exit__set_status_SERVICE_STOPPED
push 1
push 0x58
push 0x41dee8
push str.CServiceTemplate::OnMainCallback
call fcn.0040bd30
add esp, 0x14
mov dword [ebx + 0x1c], 1
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x20], 1
push edi
push dword [ebx + 0x34]
mov dword [ebx + 0x2c], 0
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406aa0
Capabilities:
Terminate thread

Disassembly:
push esi
push str._SVC__handle_SERVICE_CONTROL_STOP...
push 1
push 0x81
push 0x41e108
push 0x41e130
mov esi, ecx
call fcn.0040bd30
add esp, 0x14
call fcn.00406670
mov ecx, dword [0x42604c]
mov dword [eax + 0x2c], ecx
inc ecx
mov dword [0x42604c], ecx
lea ecx, [eax + 0x18]
push ecx
push dword [eax + 0x34]
mov dword [eax + 0x1c], 3
mov dword [eax + 0x24], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x20], 1
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov eax, dword [esi + 0x40]
test eax, eax
je 0x406b08
call eax
cmp dword [esi + 0x38], 0
je 0x406b3e
push str.kill_work_thread...
push 1
push 0x8d
push str..._srcServiceUtilServiceTemplate.cpp
push str.CServiceTemplate::OnHandleServiceStop
call fcn.0040bd30
add esp, 0x14
push 0xfffffffffffffffe
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 0x38], 0
push 0
push ecx
push dword [esi + 0x1c]
call fcn.00406670
mov ecx, eax
call fcn.00406b60
pop esi
ret
Function at 0x4089c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x4089cb
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x408a95
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x41fd10]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x41fd10]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x41fd10]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x41fd10]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x41fd10]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x41fd10]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x41fd10]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x41fd10]
dec edi
jne 0x4089e0
pop edi
test esi, esi
je 0x408aba
lea esp, [esp]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x41fd10]
dec esi
jne 0x408aa0
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x408ad0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
and eax, 0xff
shr esi, 8
mov eax, dword [eax*4 + 0x41fd10]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul ecx, eax, 0x8088405
mov eax, dword [edi + 8]
inc ecx
mov dword [edi + 4], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x41fd10]
mov dword [edi + 8], eax
pop edi
pop esi
ret

Function at 0x408b20
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebx
push esi
mov bl, dl
mov edx, ecx
push edi
mov edi, dword [edx + 8]
mov esi, edi
mov ecx, dword [edx]
and esi, 0xfffd
or esi, 2
mov eax, esi
xor eax, 1
imul eax, esi
shr eax, 8
xor bl, al
movsx eax, bl
xor eax, ecx
shr ecx, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x41fd10]
xor eax, ecx
mov dword [edx], eax
movzx eax, al
add eax, dword [edx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, edi
shr edi, 8
and eax, 0xff
xor edi, dword [eax*4 + 0x41fd10]
mov al, bl
mov dword [edx + 8], edi
pop edi
pop esi
pop ebx
ret
Function at 0x409300
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp byte [edi], 0
je 0x409343
push 0
lea ecx, [ebp + 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x409335
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
xor edx, edx
pop edi
pop esi
div ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x1c]
mov ecx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x409354
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp - 4]
call sub.MSVCR120.dll_memcpy
add dword [edi + 0x1c], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409380
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 8], ebx
mov edi, 1
cmp byte [esi], 0
je 0x4093bb
push 0
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4093b6
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x4093e8
mov ebx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x4093cc
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x14]
add eax, ebx
push edi
push eax
lea eax, [ebp - 1]
push eax
call sub.MSVCR120.dll_memcpy
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 8]
mov dword [esi + 0x1c], eax
cmp edi, 1
jne 0x4093fc
movzx eax, byte [ebp - 1]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x4093f3
cmp byte [esi + 8], 0
je 0x4093f3
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409520
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [edi], 0
je 0x409563
cmp byte [edi + 1], 0
je 0x409559
push 2
lea eax, [ebp - 0x24]
xorps xmm0, xmm0
push eax
push 0
push dword [edi + 4]
movlpd qword [ebp - 0x28], xmm0
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x409569
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x18]
mov dword [edi + 0x1c], eax
cmp byte [edi], 0
je 0x409588
cmp byte [edi + 1], 0
je 0x409584
push 1
push 0
push 0
push dword [edi + 4]
call ecx
sub eax, dword [edi + 0xc]
jmp 0x40958b
xor eax, eax
jmp 0x40958b
mov eax, dword [edi + 0x1c]
mov ebx, 0xffff
mov dword [ebp - 8], eax
cmp eax, ebx
push 0x404
cmovb ebx, eax
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.MSVCR120.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x409559
mov eax, 4
mov dword [ebp - 4], 0xffffffff
cmp ebx, eax
jbe 0x4096b6
mov ecx, dword [ebp - 8]
add eax, 0x400
cmp eax, ebx
mov edx, eax
mov eax, 0x404
cmova edx, ebx
mov ebx, dword [ebp - 8]
sub ecx, edx
mov dword [ebp - 0x18], edx
sub ebx, ecx
mov dword [ebp - 0x14], ecx
cmp ebx, 0x404
cmova ebx, eax
cmp byte [edi], 0
je 0x40961d
cmp byte [edi + 1], 0
je 0x4096b6
mov eax, dword [edi + 0xc]
add eax, ecx
mov dword [ebp - 0x24], 0
push 0
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x28], eax
push ecx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x409620
mov dword [edi + 0x1c], ecx
cmp byte [edi], 0
mov ecx, ebx
mov dword [ebp - 0xc], ebx
je 0x409648
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x409643
mov byte [edi + 8], 1
mov eax, dword [ebp - 0x10]
jmp 0x409671
mov edx, dword [edi + 0x1c]
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x18]
jbe 0x40965b
mov ecx, dword [edi + 0x18]
sub ecx, edx
mov dword [ebp - 0xc], ecx
push ecx
mov ecx, dword [edi + 0x14]
add ecx, edx
push ecx
push esi
call sub.MSVCR120.dll_memcpy
mov eax, dword [ebp - 0xc]
add esp, 0xc
add dword [edi + 0x1c], eax
xor edx, edx
div ebx
cmp eax, 1
jne 0x4096b6
lea eax, [ebx - 3]
test eax, eax
js 0x4096a1
dec eax
cmp byte [eax + esi], 0x50
jne 0x40969d
cmp byte [eax + esi + 1], 0x4b
jne 0x40969d
cmp byte [eax + esi + 2], 5
jne 0x40969d
cmp byte [eax + esi + 3], 6
je 0x4096ca
test eax, eax
jns 0x409681
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4096b6
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
cmp eax, ebx
jb 0x4095c3
push esi
call dword [sym.imp.MSVCR120.dll_free]
mov eax, dword [ebp - 4]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
jmp 0x4096a4
Function at 0x40a600
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x40a69a
cmp dword [edi + 4], 0xffffffff
jne 0x40a69a
lea esi, [edi + 0x244]
push esi
push 0x103
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40a630
sub esi, ecx
sar esi, 1
movzx eax, word [edi + esi*2 + 0x242]
cmp eax, 0x5c
je 0x40a65c
cmp eax, 0x2f
je 0x40a65c
mov dword [edi + esi*2 + 0x244], 0x2f
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00409260
add esp, 8
test eax, eax
jne 0x40a67b
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, eax
call fcn.004096e0
xor ecx, ecx
mov dword [edi], eax
test eax, eax
mov edx, 0x200
cmove ecx, edx
mov eax, ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
pop edi
mov eax, 0x1000000
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40b1d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4189b8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x426034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x40]
push 2
xor eax, eax
mov dword [ebp - 0x2c], 7
push 0x420368
xor bl, bl
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.00401870
xor eax, eax
mov byte [ebp - 4], 2
push 0xffffffffffffffff
push eax
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x28]
lea eax, [ebp + 0x20]
mov dword [ebp - 0x14], 7
push eax
mov dword [ebp - 0x18], 0
call fcn.004014c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x14], 8
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.MSVCR120.dll__wfopen]
mov esi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 8
cmp dword [ebp - 0x14], 8
mov edi, eax
jb 0x40b286
push dword [ebp - 0x28]
call esi
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
jb 0x40b2a8
push dword [ebp - 0x40]
call esi
add esp, 4
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
test edi, edi
je 0x40b2f4
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 7
push eax
mov word [ecx], ax
lea eax, [ebp + 8]
push eax
call fcn.004014c0
push edi
call fcn.0040b060
push edi
mov bl, al
call dword [sym.imp.MSVCR120.dll_fclose]
add esp, 4
test bl, bl
jne 0x40b306
cmp dword [ebp + 0x34], 8
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp + 0x1c], 8
jb 0x40b314
push dword [ebp + 8]
call esi
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
cmp dword [ebp + 0x34], 8
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
jb 0x40b336
push dword [ebp + 0x20]
call esi
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
Function at 0x40bb10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x418acb
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x426034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x144]
push 0
push eax
call fcn.0040c1b0
add esp, 8
cmp byte [0x426919], 0
mov dword [ebp - 4], 0
je 0x40bc35
push 0x103
lea eax, [ebp - 0x113]
mov byte [ebp - 0x114], 0
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x114]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp dword [esi + 0x14], 0x10
jb 0x40bba0
mov ecx, dword [esi]
jmp 0x40bba2
mov ecx, esi
cmp dword [ebp - 0x130], 0x10
lea eax, [ebp - 0x144]
push ecx
cmovae eax, dword [ebp - 0x144]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x12c]
push str.__d._d._s._s___s_n
push eax
call fcn.0040c7c0
add esp, 0x1c
lea eax, [ebp - 0x12c]
cmp dword [ebp - 0x118], 0x10
cmovae eax, dword [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [ebp - 0x118], 0x10
jb 0x40bc1a
push dword [ebp - 0x12c]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x12c], 0
mov eax, dword [0x426920]
test eax, eax
jne 0x40bc65
push 0x18
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [0x426920], eax
xorps xmm0, xmm0
movdqu xmmword [eax], xmm0
push eax
movq qword [eax + 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [0x426920]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.00412d80
lea ecx, [ebp - 0x144]
push ecx
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x20]
call eax
test eax, eax
jne 0x40bc8f
push eax
push eax
call fcn.0040b760
add esp, 8
push dword [0x426920]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00412d80
cmp dword [esi + 0x10], 0
mov edi, eax
je case.default.0x40bcbd
mov edx, dword [edi]
mov ecx, edi
mov edx, dword [edx + 0xc]
call edx
mov ecx, dword [ebp + 8]
cmp ecx, eax
jg case.default.0x40bcbd
cmp ecx, 3
ja case.default.0x40bcbd
jmp dword [ecx*4 + 0x40bd1c]
push esi
mov ecx, edi
call fcn.00412850
jmp case.default.0x40bcbd
push esi
mov ecx, edi
call fcn.00412e50
jmp case.default.0x40bcbd
push esi
mov ecx, edi
call fcn.00413320
jmp case.default.0x40bcbd
push esi
mov ecx, edi
call fcn.00412b90
cmp dword [ebp - 0x130], 0x10
jb 0x40bd01
push dword [ebp - 0x144]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00417832
mov esp, ebp
pop ebp
ret