joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435d40
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b35e0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4ed4e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x17
lea esi, [ebp - 0x14]
call fcn.00418db0
push eax
lea eax, [ebp - 0x10]
push eax
mov ebx, 0x4c8a30
mov dword [ebp - 4], 0
call fcn.00406680
add esp, 0xc
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
or ebx, 0xffffffff
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x435db2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, ebx
je 0x435dfc
mov ecx, edi
call fcn.0043b300
mov esi, eax
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
lock xadd dword [edx], ebx
dec ebx
test ebx, ebx
jg 0x435de8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebx
dec ebx
test ebx, ebx
jg 0x435e1b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4361a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4b5070
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4ed4e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x14]
mov edi, 1
call fcn.00418bf0
lea ecx, [esp + 0x10]
push 0x4fe784
push ecx
mov ebx, eax
mov dword [esp + 0x30], 0
call fcn.00407e10
add esp, 8
mov byte [esp + 0x28], 2
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43621d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, esi
call fcn.00436bc0
test eax, eax
jne 0x43622a
xor edi, edi
mov eax, dword [esi]
push ecx
sub eax, 0x10
mov dword [esp + 0x1c], esp
mov ebx, esp
push eax
call fcn.00401550
lea ecx, [esp + 0x18]
add esp, 4
add eax, 0x10
push ecx
mov dword [ebx], eax
call fcn.00419610
add esp, 8
test eax, eax
jne 0x436257
xor edi, edi
mov ecx, esi
call fcn.004364c0
test eax, eax
jne 0x436264
xor edi, edi
call fcn.004377d0
call fcn.00437f20
call fcn.00450360
test eax, eax
je 0x43627e
call fcn.004374d0
jmp 0x436283
call fcn.00437d60
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4362ab
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x436420
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, str.FSPlatform.exe
push esi
xor esi, esi
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], str.FSLauncher.exe
mov dword [ebp - 0x10], str.FsSvr.exe
mov dword [ebp - 0xc], str.FSPAP.exe
mov dword [ebp - 8], esi
cmp eax, ebx
je 0x4364a9
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.00406680
mov eax, dword [ebp - 4]
add esp, 8
push eax
call edi
cmp eax, 0xffffffff
je 0x436480
test al, 0x10
jne 0x436480
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43649f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [ebp + esi*4 - 0x14]
inc esi
test ebx, ebx
jne 0x436457
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x436a00
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push 0x4fe778
push eax
call fcn.00407e10
mov ecx, dword [ebp - 4]
add esp, 8
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x436a57
mov edx, dword [ebp - 4]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436a50
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436a76
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x436a80
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b35a8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4ed4e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov ebx, str.FunshionBHO.dll
mov dword [ebp - 0x14], 1
call fcn.00406680
add esp, 8
xor esi, esi
mov dword [ebp - 4], esi
mov edx, dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edx
call edi
cmp eax, 0xffffffff
je 0x436aef
test al, 0x10
jne 0x436aef
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x436aef
mov dword [ebp - 0x14], esi
push 0x26
lea esi, [ebp - 0x18]
call fcn.00418db0
mov ecx, esi
push ecx
lea edx, [ebp + 8]
push edx
mov ebx, str.Common_Files_funshionlauncher
mov byte [ebp - 4], 1
call fcn.00406680
add esp, 0xc
mov byte [ebp - 4], 2
mov eax, dword [ebp + 8]
push eax
call edi
cmp eax, 0xffffffff
je 0x436b34
lea ecx, [ebp + 8]
push ecx
call fcn.00418eb0
add esp, 4
test eax, eax
jne 0x436b34
xor esi, esi
jmp 0x436b37
mov esi, dword [ebp - 0x14]
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x436b5a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436b7d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436ba3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x436bc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b4718
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4ed4e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, 1
call fcn.004362c0
test eax, eax
jne 0x436bf8
xor edi, edi
push ebx
call fcn.00436420
call fcn.00436e30
test eax, eax
jne 0x436c09
xor edi, edi
push ebx
call fcn.00437590
test eax, eax
jne 0x436c15
xor edi, edi
push ebx
call fcn.004376b0
test eax, eax
jne 0x436c21
xor edi, edi
mov ecx, ebx
call fcn.00436720
test eax, eax
jne 0x436c2e
xor edi, edi
call fcn.00436a00
push ebx
call fcn.00436a80
lea eax, [ebp - 0x10]
push eax
call fcn.004360d0
mov esi, eax
mov dword [ebp - 4], 0
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x436c6b
push esi
call fcn.004376b0
call fcn.004362c0
mov ecx, esi
call fcn.00437170
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436c91
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x436cb0
Capabilities:
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aead8
mov eax, dword fs:[0]
push eax
sub esp, 0x78
push ebx
push esi
push edi
mov eax, dword [0x4ed4e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x44
xor esi, esi
lea eax, [ebp - 0x84]
push esi
push eax
call fcn.0048ac40
xor eax, eax
mov ebx, str.FSPlatform.exe
xor ecx, ecx
add esp, 0xc
mov dword [ebp - 0x84], 0x44
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], str.FSLauncher.exe
mov dword [ebp - 0x30], str.FsSvr.exe
mov dword [ebp - 0x2c], str.FSPAP.exe
mov dword [ebp - 0x28], esi
cmp ecx, ebx
je 0x436e13
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x14]
push eax
call fcn.00406680
add esp, 8
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
push ecx
call edi
or ebx, 0xffffffff
cmp eax, ebx
je 0x436d5c
test al, 0x10
je 0x436d89
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
lock xadd dword [edx], ebx
dec ebx
test ebx, ebx
jg 0x436d7b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [ebp + esi*4 - 0x34]
inc esi
test ebx, ebx
jne 0x436d34
jmp 0x436e13
mov eax, dword [ebp - 0x14]
cmp dword [eax - 4], 1
jle 0x436da1
mov ecx, dword [eax - 0xc]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004018f0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x24]
push edx
lea ecx, [ebp - 0x84]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 4], ebx
test eax, eax
mov eax, dword [ebp - 0x14]
jne 0x436dfa
add eax, 0xfffffff0
lea edx, [eax + 0xc]
lock xadd dword [edx], ebx
dec ebx
test ebx, ebx
jg 0x436de4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebx
dec ebx
test ebx, ebx
jg 0x436e13
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x436e30
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x4ed4e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, str.fsadb.exe
mov dword [ebp - 0x234], 1
call fcn.00409da0
test eax, eax
jne 0x436e61
mov dword [ebp - 0x234], eax
push ebx
push edi
push str.FunshionSync.exe
lea ecx, [ebp - 0x238]
call fcn.00401bb0
lea ebx, [ebp - 0x23c]
lea edi, [ebp - 0x238]
mov dword [ebp - 0x23c], 0
call fcn.004099d0
test eax, eax
jne 0x436ec9
mov eax, dword [ebp - 0x238]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436eb4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00485532
mov esp, ebp
pop ebp
ret
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x436f0d
mov eax, dword [ebp - 0x238]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436efb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00485532
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x230]
push ecx
push edi
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x436f48
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x238]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x436eef
push esi
mov esi, dword [ebp - 0x23c]
xor ebx, ebx
lea ecx, [ebp - 0x20c]
push str.adb.exe
push ecx
call fcn.0048652c
add esp, 8
test eax, eax
je 0x436f81
lea edx, [ebp - 0x20c]
push str.aapt.exe
push edx
call fcn.0048652c
add esp, 8
test eax, eax
jne 0x436fab
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessId]
cmp dword [ebp - 0x218], eax
jne 0x436fab
lea ecx, [ebp - 0x20c]
call fcn.00409da0
test eax, eax
jne 0x436fa5
mov dword [ebp - 0x234], eax
inc ebx
cmp ebx, 2
jge 0x436fbd
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x436f51
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x436fd0
mov dword [ebp - 0x234], eax
mov ecx, str.FuniOSLoader.exe
call fcn.00409da0
test eax, eax
jne 0x436fe4
mov dword [ebp - 0x234], eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
mov eax, dword [ebp - 0x238]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
pop esi
test edx, edx
jg 0x437013
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x234]
pop edi
xor ecx, ebp
pop ebx
call fcn.00485532
mov esp, ebp
pop ebp
ret
Function at 0x437590
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b12b0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push esi
mov eax, dword [0x4ed4e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.regsvr32
lea ecx, [ebp - 0x14]
call fcn.00401bb0
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
push str._u__s
push eax
call fcn.0040c430
lea ecx, [ebp - 0x10]
push 0x4fe774
push ecx
mov ebx, eax
mov byte [ebp - 4], 1
call fcn.00407e10
xor ebx, ebx
mov byte [ebp - 4], bl
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
add esp, 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x437617
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x38
lea ecx, [ebp - 0x4c]
push ebx
push ecx
call fcn.0048ac40
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
add esp, 0xc
lea ecx, [ebp - 0x50]
push ecx
mov dword [ebp - 0x50], 0x3c
mov dword [ebp - 0x4c], 0x100
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43766e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437694
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4376b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b12b0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push esi
mov eax, dword [0x4ed4e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.regsvr32
lea ecx, [ebp - 0x14]
call fcn.00401bb0
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
push str._u__s
push eax
call fcn.0040c430
lea ecx, [ebp - 0x10]
push 0x4fe77c
push ecx
mov ebx, eax
mov byte [ebp - 4], 1
call fcn.00407e10
xor ebx, ebx
mov byte [ebp - 4], bl
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
add esp, 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x437737
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x38
lea ecx, [ebp - 0x4c]
push ebx
push ecx
call fcn.0048ac40
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
add esp, 0xc
lea ecx, [ebp - 0x50]
push ecx
mov dword [ebp - 0x50], 0x3c
mov dword [ebp - 0x4c], 0x100
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43778e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4377b4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x437ca0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov ebx, str.FSPlatform.exe
xor esi, esi
xor eax, eax
push edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], str.FSLauncher.exe
mov dword [ebp - 0x10], str.FsSvr.exe
mov dword [ebp - 0xc], str.FSPAP.exe
mov dword [ebp - 8], esi
cmp eax, ebx
je 0x437d1e
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.00406680
mov eax, dword [ebp - 4]
add esp, 8
push eax
call edi
cmp eax, 0xffffffff
je 0x437cf6
test al, 0x10
je 0x437d29
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437d15
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [ebp + esi*4 - 0x14]
inc esi
test ebx, ebx
jne 0x437cd7
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437d48
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4383a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b1278
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4ed4e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
mov ecx, section..data
xor edi, edi
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
mov ecx, section..data
call edx
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x18]
mov bl, 1
push eax
mov byte [ebp - 4], bl
call fcn.0044ff60
mov byte [ebp - 4], 2
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x10]
push str._sFunNail.dll
push edx
call fcn.00407760
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43843f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [ebp - 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x438489
test al, 0x10
jne 0x438489
push ebx
lea ecx, [ebp - 0x14]
push str.rundll32.exe___s__startup
push ecx
call fcn.00407760
mov esi, dword [ebp - 0x14]
add esp, 8
lea eax, [esi - 0x10]
mov dword [ebp - 0x1c], esp
mov edi, esp
push eax
call fcn.00401550
add esp, 4
add eax, 0x10
push 0
mov dword [edi], eax
call fcn.0040bea0
add esp, 8
mov edi, eax
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4384a9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4384cc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4384e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b35e0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4ed4e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x14]
push eax
call fcn.0044ff60
push eax
lea ecx, [ebp - 0x10]
xor edi, edi
push ecx
mov ebx, str.FunShadow.dll
mov dword [ebp - 4], edi
call fcn.00406680
add esp, 8
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43854b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43855e
test al, 0x10
je 0x438598
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x438584
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
push str.isShadowFunSeed
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x4385b9
call eax
movzx edi, al
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4385e6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret