joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406fb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, ecx
jne 0x406fd6
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x40706a
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x407025
cmp eax, 0x40
je 0x407025
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x406fc9
cmp eax, 0x40
je 0x406fc9
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
jmp 0x406fc9
mov dword [esp + 8], 0x34
mov dword [esp + 4], str..._.._runtime_pseudo_reloc.c
mov dword [esp], str.VirtualQuery__addr__b__sizeof_b__
call sym.__assert
lea esi, [esi]
lea edi, [edi]

Function at 0x407598
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x413ac0]
call sym._TlsAlloc_0
cmp eax, 0xffffffff
je 0x4075d4
mov dword [ebx + 0x24], eax
mov dword [esp + 4], 0
mov dword [esp], eax
call sym.___mingwthr_key_dtor
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x28], eax
add esp, 0x14
pop ebx
leave
ret
call sym._GetLastError_0
jmp 0x4075c2
Function at 0x4076f8
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, eax
mov esi, edx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
mov edx, dword [ebx + 0x10]
mov dword [ebp - 0x1c], edx
mov eax, dword [esi]
jmp 0x407721
mov dword [eax + 0x20], edi
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
test eax, eax
je 0x4077e8
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x2c], eax
xor edi, edi
mov eax, 0xa
mov ecx, dword [ebp - 0x1c]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov edx, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
mov dword [esp], 1
call dword [ebp - 0x20]
test eax, eax
jne 0x40780c
cmp edi, 5
je 0x407811
mov edx, dword [ebp - 0x2c]
test edx, edx
je 0x4077ab
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0xa
mov dword [esp], 1
call dword [ebp - 0x2c]
mov edi, eax
cmp eax, 7
je 0x407811
cmp eax, 8
jne 0x40780c
mov eax, dword [esi]
mov edi, dword [eax]
mov eax, dword [0x413ac0]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x4077fc
test edx, edx
je 0x407718
mov dword [esp + 4], edi
mov eax, dword [eax + 0x24]
mov dword [esp], eax
call sym._TlsSetValue_8
sub esp, 8
test eax, eax
jne 0x40771b
call sym._GetLastError_0
jmp 0x40771b
mov dword [ebp - 0x2c], 0
mov edi, 5
mov al, 0x1a
jmp 0x407736
call dbg.fc_key_init_once
mov eax, dword [0x413ac0]
mov edx, dword [eax + 0x28]
jmp 0x4077bb
mov edi, 2
mov eax, edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x407888
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov eax, dword [0x413ac0]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x4078f8
test edx, edx
jne 0x4078d4
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x10], eax
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call dbg._Unwind_ForcedUnwind_Phase2
cmp eax, 7
je 0x407907
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov edi, dword [eax + 0x24]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edi
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sym._SetLastError_4
push ecx
mov eax, dword [ebp - 0x2c]
jmp 0x4078a7
call dbg.fc_key_init_once
mov eax, dword [0x413ac0]
mov edx, dword [eax + 0x28]
jmp 0x4078a0
lea eax, [ebp - 0x1c]
mov edx, esi
call dbg.uw_install_context
lea esi, [esi]
Function at 0x4079ec
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
mov eax, dword [0x413ac0]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x407ad1
test edx, edx
jne 0x407a70
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
test eax, eax
je 0x407a63
lea esi, [ebp - 0x20]
jmp 0x407a23
mov dword [ebp - 0x20], eax
mov eax, dword [eax + 0x18]
test eax, eax
je 0x407a5a
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov edx, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 1
mov dword [esp], 1
call eax
cmp eax, 6
je 0x407a98
cmp eax, 8
jne 0x407ac4
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
test eax, eax
jne 0x407a20
mov eax, 5
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov edi, dword [eax + 0x24]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edi
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sym._SetLastError_4
push ecx
mov eax, dword [ebp - 0x2c]
jmp 0x407a0f
mov dword [ebx + 0xc], 0
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov edx, esi
mov eax, ebx
call dbg._Unwind_RaiseException_Phase2
cmp eax, 7
jne 0x407a68
lea eax, [ebp - 0x1c]
mov edx, esi
call dbg.uw_install_context
nop
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
call dbg.fc_key_init_once
mov eax, dword [0x413ac0]
mov edx, dword [eax + 0x28]
jmp 0x407a08

Function at 0x407ae4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0xc]
test ecx, ecx
jne 0x407b08
mov dword [esp], ebx
call dbg._Unwind_SjLj_RaiseException
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [0x413ac0]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x407b5c
test edx, edx
jne 0x407b38
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call dbg._Unwind_ForcedUnwind_Phase2
cmp eax, 7
je 0x407b6c
call sym._abort
nop
mov edi, dword [eax + 0x24]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edx
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sym._SetLastError_4
push eax
mov eax, dword [ebp - 0x2c]
jmp 0x407b1b
call dbg.fc_key_init_once
mov eax, dword [0x413ac0]
mov edx, dword [eax + 0x28]
jmp 0x407b14
lea eax, [ebp - 0x1c]
mov edx, esi
call dbg.uw_install_context
nop
Function at 0x407c08
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov eax, dword [0x413ac0]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x407c8c
test edx, edx
jne 0x407c68
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov edi, dword [ebx + 0xc]
test edi, edi
jne 0x407c4c
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call dbg._Unwind_RaiseException_Phase2
cmp eax, 7
je 0x407c5d
call sym._abort
nop
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call dbg._Unwind_ForcedUnwind_Phase2
cmp eax, 7
jne 0x407c45
lea eax, [ebp - 0x1c]
mov edx, esi
call dbg.uw_install_context
nop
mov edi, dword [eax + 0x24]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edx
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sym._SetLastError_4
push eax
mov eax, dword [ebp - 0x2c]
jmp 0x407c27
call dbg.fc_key_init_once
mov eax, dword [0x413ac0]
mov edx, dword [eax + 0x28]
jmp 0x407c20
Function at 0x401220
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 4
push 0x40
push 0x3000
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esp, ebp
pop ebp
ret
Function at 0x401a30
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x401a4d
xor eax, eax
jmp 0x401a5d
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov esp, ebp
pop ebp
ret

Function at 0x403a00
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
fld qword [0x435da0]
fstp qword [ebp - 8]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 8]
fadd qword [0x435d98]
fstp qword [ebp - 8]
fld qword [0x435da0]
fstp qword [ebp - 0x10]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x10]
fadd qword [0x435d98]
fstp qword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x435368
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
fld qword [0x435d90]
fstp qword [ebp - 0x18]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x18]
fadd qword [0x435d88]
fstp qword [ebp - 0x18]
fld qword [0x435d90]
fstp qword [ebp - 0x20]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
fld qword [ebp - 0x20]
fadd qword [0x435d88]
fstp qword [ebp - 0x20]
mov esp, ebp
pop ebp
ret
Function at 0x40f82a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43d120]
jne 0x40f834
repz ret
jmp fcn.0041350c

Function at 0x42c8d1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00412e3c
and dword [ebp - 4], 0
cmp dword [0x441874], 0
mov ebx, eax
jne 0x42c982
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42ca33
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x42ca33
push eax
call fcn.00412dca
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x441874], eax
call esi
push eax
call fcn.00412dca
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x441878], eax
call esi
push eax
call fcn.00412dca
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44187c], eax
call esi
push eax
call fcn.00412dca
pop ecx
mov dword [0x441884], eax
test eax, eax
je 0x42c982
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00412dca
pop ecx
mov dword [0x441880], eax
mov eax, dword [0x441880]
cmp eax, ebx
je 0x42c9da
cmp dword [0x441884], ebx
je 0x42c9da
push eax
call fcn.00412e45
push dword [0x441884]
mov esi, eax
call fcn.00412e45
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42c9da
test edi, edi
je 0x42c9da
call esi
test eax, eax
je 0x42c9d1
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42c9d1
test byte [ebp - 0xc], 1
jne 0x42c9da
or dword [ebp + 0x10], 0x200000
jmp 0x42ca13
mov eax, dword [0x441878]
cmp eax, ebx
je 0x42ca13
push eax
call fcn.00412e45
pop ecx
test eax, eax
je 0x42ca13
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42ca13
mov eax, dword [0x44187c]
cmp eax, ebx
je 0x42ca13
push eax
call fcn.00412e45
pop ecx
test eax, eax
je 0x42ca13
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x441874]
call fcn.00412e45
pop ecx
test eax, eax
je 0x42ca33
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42ca35
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408b42
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
cmp edi, 0xffffffff
je 0x408c39
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x408b7d
call ebx
test eax, eax
jne 0x408c37
and esi, 0xffff7fff
cmp esi, 2
jne 0x408bc7
lea eax, [ebp - 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
jne 0x408b9e
call ebx
cmp eax, 6
je 0x408bc7
mov ecx, dword [ebp + 8]
lea edx, [ecx + 2]
xor esi, esi
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x408ba6
push esi
sub ecx, edx
lea eax, [ebp - 0xc]
push eax
sar ecx, 1
push ecx
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x408c37
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
xor esi, esi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
mov dword [ebp - 8], eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 4], eax
test eax, eax
je 0x408c37
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x408c37
push esi
push esi
push dword [ebp - 4]
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
push esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x408c28
push esi
lea ecx, [ebp - 0xc]
push ecx
dec eax
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
pop edi
leave
ret 4
Function at 0x40b574
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 8], esi
cmp esi, 0xffffffff
jne 0x40b5e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 2
je 0x40b5cd
cmp esi, 3
je 0x40b5cd
push esi
mov eax, edi
call fcn.0040b952
push esi
push edi
push 0x4028b0
push 4
call fcn.0040d3c6
add esp, 0x10
jmp 0x40b6b0
push edi
push 0x402918
push 2
call fcn.0040d3c6
add esp, 0xc
jmp 0x40b6b0
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x40b617
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
mov eax, edi
call fcn.0040b952
push esi
push edi
push 0x4029a8
push 4
call fcn.0040d3c6
add esp, 0x10
jmp 0x40b6a7
cmp dword [ebp - 0xc], ebx
je 0x40b639
push 0x57
pop esi
push esi
mov eax, edi
call fcn.0040b952
push edi
push 0x402a0c
push 4
call fcn.0040d3c6
add esp, 0xc
jmp 0x40b6a7
push ebx
push dword [ebp - 0x10]
push ebx
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x40b668
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
mov eax, edi
call fcn.0040b952
push esi
push edi
push 0x402a38
jmp 0x40b608
push dword [ebp - 0x10]
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
jne 0x40b6b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
mov eax, edi
call fcn.0040b952
push esi
push edi
push 0x402a98
push 4
call fcn.0040d3c6
mov eax, dword [ebp - 4]
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x40b6cf
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov dword [ecx], esi
mov dword [ecx + 4], eax
mov dword [ecx + 8], ebx
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x40b9e0
Capabilities:
Acquire debug privileges

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push 1
push eax
mov dword [ebp - 8], 0x402f70
call fcn.0040d5de
mov edi, eax
test edi, edi
je 0x40ba18
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.0040d498
mov edi, eax
cmp dword [ebp - 4], 0
je 0x40ba30
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
leave
ret 8

Function at 0x40bb97
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov esi, edi
test edx, edx
jne 0x40bbc2
mov dword [0x422750], edi
jmp 0x40bcd0
cmp word [edx], 0x5c
jne 0x40bc34
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x40bbcd
sub ecx, esi
sar ecx, 1
xor eax, eax
shld eax, ecx, 1
add ecx, ecx
mov ebx, 0xc0000095
cmp eax, edi
ja 0x40bbf8
jb 0x40bbf4
cmp ecx, 0xffffffff
ja 0x40bbf8
mov esi, edi
jmp 0x40bbfd
or ecx, 0xffffffff
mov esi, ebx
test esi, esi
js 0x40bcd0
lea edi, [ecx + 2]
cmp edi, ecx
jb 0x40bc10
xor esi, esi
jmp 0x40bc15
or edi, 0xffffffff
mov esi, ebx
test esi, esi
js 0x40bcd0
push edx
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0041bcf9
add esp, 0xc
jmp 0x40bc9f
push 0x104
lea eax, [ebp - 0x210]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x40bc52
mov esi, 0xc000000d
jmp 0x40bcd0
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x40bc5b
sub ecx, edx
sar ecx, 1
xor eax, eax
shld eax, ecx, 1
add ecx, ecx
mov ebx, 0xc0000095
cmp eax, edi
ja 0x40bc82
jb 0x40bc87
cmp ecx, 0xffffffff
jbe 0x40bc87
or ecx, 0xffffffff
mov esi, ebx
test esi, esi
js 0x40bcd0
lea edi, [ecx + 2]
cmp edi, ecx
jb 0x40bc96
xor esi, esi
jmp 0x40bc9b
or edi, 0xffffffff
mov esi, ebx
test esi, esi
js 0x40bcd0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x422750], eax
test eax, eax
jne 0x40bcbf
mov esi, 0xc0000017
jmp 0x40bcd0
push edi
lea ecx, [ebp - 0x210]
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041b8aa
leave
ret
Function at 0x40d113
Capabilities:
Access pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
call fcn.0040d1b8
cmp eax, 2
jne 0x40d186
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
xor ebx, ebx
call fcn.0040b574
test eax, eax
je 0x40d151
push eax
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
test eax, eax
je 0x40d149
movzx ebx, word [eax + 4]
lea esi, [ebp - 0x10]
call fcn.0040b9af
sub ebx, 0x14c
je 0x40d174
sub ebx, 0x76
je 0x40d16d
sub ebx, 0x84a2
jne 0x40d186
push 0x4043c4
jmp 0x40d179
push 0x4043dc
jmp 0x40d179
push 0x404390
mov ebx, dword [ebp + 8]
push 0x4043ac
call fcn.0040dbba
pop esi
pop ebx
leave
ret 4

Function at 0x40d191
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40d1ac
test al, 0x50
jne 0x40d1ac
inc esi
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x40d2d9
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ecx
push ebx
push esi
mov esi, eax
mov ebx, 0x80
cmp esi, ebx
je 0x40d30b
test esi, 0xffffff78
je 0x40d30b
push edi
push esi
push 0x404418
push 4
xor ebx, ebx
call fcn.0040d3c6
add esp, 0x10
push 0x57
jmp 0x40d38d
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40d34b
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
mov eax, edi
call fcn.0040b952
cmp esi, 2
je 0x40d339
push esi
push edi
push 0x404478
push 3
jmp 0x40d384
push edi
push 0x4044d8
push 2
call fcn.0040d3c6
add esp, 0xc
jmp 0x40d38c
and eax, 0x3120
or eax, esi
or eax, ebx
cmp eax, ebx
je 0x40d35d
and eax, 0xffffff7f
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebx, eax
test ebx, ebx
jne 0x40d393
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
mov eax, edi
call fcn.0040b952
push esi
push edi
push 0x404538
push 4
call fcn.0040d3c6
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x40d6b8
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0x400
xor esi, esi
and dword [ebp - 4], esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
jne 0x40d6eb
push 8
xor edi, edi
pop esi
jmp 0x40d775
cmp dword [ebp + 0xc], esi
jne 0x40d714
lea eax, [ebp - 4]
push eax
call fcn.0040d79d
mov edi, eax
test edi, edi
jne 0x40d709
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x40d765
push dword [ebp - 4]
push dword [ebp - 4]
push dword [ebp - 4]
jmp 0x40d71c
mov eax, 0x404720
push eax
push eax
push eax
push dword [ebp + 0x10]
push 0x200
push ebx
call fcn.0041bc4c
add esp, 0x18
push ebx
push dword [ebp + 8]
call fcn.0040d901
mov edi, eax
test edi, edi
jne 0x40d765
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 2
je 0x40d765
mov eax, dword [ebp + 8]
push esi
call fcn.0040b952
push esi
push dword [ebp + 8]
push 0x4047a0
push 4
call fcn.0040d3c6
add esp, 0x10
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 4], 0
je 0x40d784
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
jne 0x40d78f
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x40dfdf
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov edx, edi
test esi, esi
je 0x40e050
test eax, eax
je 0x40e050
add eax, esi
lea ebx, [esi + 0x10040]
mov dword [ebp - 4], eax
cmp ebx, eax
jbe 0x40e049
mov ebx, eax
jmp 0x40e049
mov ecx, dword [eax - 4]
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x40e046
lea eax, [esi + 0xf8]
add eax, ecx
cmp eax, dword [ebp - 4]
jae 0x40e046
cmp dword [ecx + esi], 0x4550
jne 0x40e046
mov eax, 0x14c
cmp word [ecx + esi + 4], ax
jne 0x40e046
push esi
call fcn.0040e05e
mov edi, eax
mov ecx, edi
or ecx, edx
jne 0x40e050
add esi, dword [ebp + 8]
lea eax, [esi + 0x40]
cmp eax, ebx
jb 0x40e009
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4