joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416a36
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_RtlZeroMemory
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push 0x43b1fb
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
lea eax, [ebp - 0x246]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_FindFirstFileA
cmp eax, 0xffffffff
je 0x416afa
mov dword [ebp - 0x108], eax
test dword [ebp - 0x246], 0x10
jne 0x416ad9
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcpyA
push 0x4415ad
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
lea eax, [ebp - 0x21a]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_DeleteFileA
lea eax, [ebp - 0x246]
push eax
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FindNextFileA
or eax, eax
jne 0x416a8e
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FindClose
leave
ret 4

Function at 0x416afe
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb98
push 0x104
lea eax, [ebp - 0x158]
push eax
call sub.KERNEL32.dll_RtlZeroMemory
push dword [ebp + 0xc]
lea eax, [ebp - 0x158]
push eax
call sub.KERNEL32.dll_lstrcatA
push 0x43b208
push 0
push str.dnlbook
push 0x104
lea eax, [ebp - 0x158]
push eax
call fcn.0040d3bb
cmp eax, 0xffffffff
je 0x416c0f
mov dword [ebp - 0x468], eax
push dword [ebp + 0x14]
push dword [ebp + 8]
push dword [ebp - 0x468]
call fcn.0041136b
or eax, eax
jne 0x416c04
push 0x104
lea eax, [ebp - 0x25c]
push eax
call sub.KERNEL32.dll_GetWindowsDirectoryA
push str.dbplugin.exe
lea eax, [ebp - 0x25c]
push eax
call sub.KERNEL32.dll_lstrcatA
cmp dword [ebp + 0x10], 0
jne 0x416ba7
push 0x43b21b
lea eax, [ebp - 0x464]
push eax
call sub.KERNEL32.dll_lstrcpyA
jmp 0x416bb8
push 0x43b21e
lea eax, [ebp - 0x464]
push eax
call sub.KERNEL32.dll_lstrcpyA
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x464]
push eax
call sub.KERNEL32.dll_lstrcatA
push 0x44
lea eax, [ebp - 0x44]
push eax
call sub.KERNEL32.dll_RtlZeroMemory
mov dword [ebp - 0x44], 0x44
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x25c]
push eax
call sub.KERNEL32.dll_CreateProcessA
push dword [ebp - 0x468]
call sub.KERNEL32.dll_CloseHandle
leave
ret 0x10

Function at 0x416c13
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_RtlZeroMemory
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.KERNEL32.dll_GetTempPathA
test eax, eax
je 0x416c7d
push 0x43b221
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
cmp dword [ebp + 8], 0
je 0x416c73
dec dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call fcn.00416afe
jmp 0x416c7d
push 0x441498
call sub.KERNEL32.dll_DeleteFileA
leave
ret 0xc
Function at 0x416c81
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_RtlZeroMemory
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.KERNEL32.dll_GetTempPathA
test eax, eax
je 0x416ccd
push 0x43b228
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
lea eax, [ebp - 0x104]
push eax
call fcn.00416a36
leave
ret

Function at 0x416d0b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push edx
push 0x104
push dword [ebp + 8]
call sub.KERNEL32.dll_RtlZeroMemory
mov dword [ebp - 8], 0
push dword [ebp + 8]
push 0x104
call sub.KERNEL32.dll_GetTempPathA
test eax, eax
je 0x416dab
push str.dnadwb
push dword [ebp + 8]
call sub.KERNEL32.dll_lstrcatA
cmp dword [ebp + 0xc], 0
je 0x416dab
dec dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.00411d28
mov dword [ebp - 4], eax
add eax, dword [ebp + 0x14]
mov ebx, eax
mov dl, byte [ebx]
mov byte [ebp - 9], dl
mov byte [ebx], 0
push dword [ebp - 4]
push 0
push str.Genbook
push 0x104
push dword [ebp + 8]
call fcn.0040d3bb
mov dl, byte [ebp - 9]
mov byte [ebx], dl
cmp eax, 0xffffffff
je 0x416dab
mov dword [ebp - 4], eax
push dword [ebp + 0x18]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.0041136b
or eax, eax
jne 0x416da3
mov dword [ebp - 8], 1
push dword [ebp - 4]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 8]
pop edx
pop ebx
leave
ret 0x14
Function at 0x418a8f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ecx
push ebx
push 0x400
push 0x453027
call sub.KERNEL32.dll_RtlZeroMemory
lea eax, [ebp - 0x108]
push eax
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
push eax
lea eax, [ebp - 0x108]
push eax
push 0x453027
call fcn.00418c6d
mov dword [ebp - 4], 0x453027
push dword [ebp - 4]
call sub.KERNEL32.dll_lstrlenA
mov dword [ebp - 8], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x108]
push eax
call sub.KERNEL32.dll_RtlZeroMemory
push dword [ebp - 8]
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 4]
call fcn.0042e300
mov eax, 1
jmp 0x418b1a
push 0x4415ad
push dword [ebp - 4]
push 1
call fcn.0042e1a8
add dword [ebp - 4], eax
or eax, eax
jne 0x418b08
mov byte [0x451b48], 0
push dword [ebp - 4]
push 0x451b48
call fcn.0042e2b0
cmp dword [0x441958], 1
jne 0x418b4a
push dword [0x451ad8]
push 0
call fcn.0040c1be
jmp 0x418b58
push str.This_email_attachment_has_been_sent_to_you_by_a_person_using_a_SendMail_facility_inside_the_DigitalWebBook._r_n_r_nPlease_refer_to_the_From:_line_in_the_header_of_this_e_mail_to_identify_the_sender._Please_note_that_if_you_can_not_view_the_attached_file_you_should_download_the_DigitalWebBook_plug_in_viewer_from_www.DigitalWebBooks.com_plugin._When_prompted__either_Open_or_Run_from_current_location._The_plug_in_viewer_will_be_automatically_installed_on_opening._Click_on_the_close_button_to_exit._r_n_r_nOnce_you_have_downloaded_the_152k_plug_in_viewer_which_will_take_approximately_30_seconds_on_a_56k_modem_you_will_be_able_to_view_DigitalWebBooks_in_the_.dnl_format._r_n_r_nEnjoy_the_DigitalWebBook_experience.
push 0x34
push 1
call fcn.0040beda
mov dword [ebp - 4], eax
push 0x4415b2
push 0x451884
call fcn.0040c679
push 0x4415b2
push 0x451884
call fcn.0040c679
push dword [ebp - 4]
push 0x451884
call fcn.0040c679
cmp dword [0x44306c], 0
je 0x418b9e
push 0
push dword [0x44306c]
call fcn.0040c1be
jmp 0x418ba4
lea eax, str.DigitalWebBook
mov dword [ebp - 8], eax
push 0x4415a9
push 0x451878
call fcn.0040c679
push 0x4415d0
push 0x451878
call fcn.0040c679
push 0x4415a9
push 0x451878
call fcn.0040c679
push dword [ebp - 8]
push 0x451878
call fcn.0040c679
mov dword [ebp - 4], 0
mov dword [ebp - 8], 1
cmp dword [0x451894], 0
je 0x418c04
push dword [0x451890]
pop dword [ebp - 4]
inc dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp - 4]
push 0x451b48
lea eax, [ebp - 0x108]
push eax
push 0x451bc8
push 0x451bc8
push dword [0x451884]
push dword [0x451878]
push 1
push dword [ebp - 8]
call fcn.00418dca
or eax, eax
je 0x418c69
jmp 0x418c3f
push eax
push 0x418c3c
push 0x453827
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push 0x453827
push 0x453827
push dword [0x441160]
call sub.USER32.dll_MessageBoxA
pop ebx
pop ecx
leave
ret
Function at 0x41a079
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
cmp dword [0x441610], 0
jne 0x41a0e1
push dword [0x441a60]
call sub.GDI32.dll_CreateCompatibleDC
mov dword [0x441610], eax
cmp eax, 0
je 0x41a262
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [0x441a60]
call sub.GDI32.dll_CreateCompatibleBitmap
or eax, eax
jne 0x41a0d0
push dword [0x441610]
call sub.GDI32.dll_DeleteDC
mov dword [0x441610], 0
jmp 0x41a262
push eax
push dword [0x441610]
call sub.GDI32.dll_SelectObject
mov dword [0x441614], eax
cmp dword [0x441618], 1
jne 0x41a1b8
lea eax, [ebp - 0x20]
push eax
push dword [0x441160]
call sub.USER32.dll_GetWindowRect
mov eax, dword [ebp - 0x20]
sub dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
sub dword [ebp - 0x14], eax
push 0
call fcn.0040fb73
mov dword [0x44313c], 1
mov dword [0x44310c], 1
push 1
push 1
push 1
push 0
push 0
push dword [0x441160]
call sub.USER32.dll_MoveWindow
mov dword [0x44310c], 0
mov dword [0x44313c], 0
cmp dword [0x44176b], 1
jne 0x41a17a
lea eax, [ebp - 0x30]
push eax
push dword [0x4519b4]
call sub.USER32.dll_GetWindowRect
push 0
push 1
push 1
push 0
push 0
push dword [0x4519b4]
call sub.USER32.dll_MoveWindow
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
add eax, dword [ebp + 0x10]
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
add eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
push 0x41a266
call sub.USER32.dll_EnumWindows
cmp dword [0x44169c], 1
jne 0x41a1b8
mov dword [0x44169c], 0
leave
ret 0x10
cmp dword [0x45388f], 5
jbe 0x41a1cb
push 0xc8
call sub.KERNEL32.dll_Sleep
push 0xcc0020
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x441a60]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
push 0
push dword [0x441610]
call sub.GDI32.dll_BitBlt
cmp dword [0x441618], 1
jne 0x41a262
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [0x441160]
call sub.USER32.dll_MoveWindow
cmp dword [0x44176b], 1
jne 0x41a241
mov eax, dword [ebp - 0x30]
sub dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x2c]
sub dword [ebp - 0x24], eax
push 1
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push dword [0x4519b4]
call sub.USER32.dll_MoveWindow
push dword [0x441aae]
call fcn.00419dd3
cmp eax, 1
jne 0x41a258
push 0
call fcn.0041aba3
mov dword [0x44169c], 0
leave
ret 0x10
Function at 0x41b634
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push edi
push esi
push edx
mov edi, dword [ebp + 8]
cmp dword [ebp + 0x14], 3
jne 0x41b64f
mov dword [ebp - 4], 0x3c
jmp 0x41b656
mov dword [ebp - 4], 0x20
push 0x40
push 0x1000
push dword [ebp - 4]
push 0
call sub.KERNEL32.dll_VirtualAlloc
or eax, eax
je 0x41b6ba
mov esi, eax
push dword [ebp + 0xc]
pop dword [esi + 8]
push dword [ebp + 0x14]
pop dword [esi + 0x10]
push dword [ebp + 0x10]
pop dword [esi + 0x14]
push dword [ebp + 0xc]
push esi
call fcn.0041e574
mov dword [esi + 0xc], eax
cmp dword [ebp + 0x14], 3
jne 0x41b696
lea edx, [edi + 0xc]
jmp 0x41b699
lea edx, [edi + 0x18]
cmp dword [edx + 4], 0
jne 0x41b6a3
mov dword [edx], esi
jmp 0x41b6b2
mov eax, esi
mov esi, dword [edx + 4]
mov dword [esi], eax
mov esi, eax
push dword [edx + 4]
pop dword [esi + 4]
mov dword [edx + 4], esi
inc dword [edx + 8]
mov eax, esi
pop edx
pop esi
pop edi
leave
ret 0x10

Function at 0x41b6c1
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push edi
push esi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x18]
add eax, 0x3e8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [edi + 0x18], eax
jg 0x41b798
mov eax, dword [edi]
cmp eax, dword [edi + 4]
jg 0x41b798
push 0x40
push 0x1000
push 0x2c
push 0
call sub.KERNEL32.dll_VirtualAlloc
or eax, eax
je 0x41b791
mov esi, eax
push esi
push dword [edi]
call fcn.0041b49c
or eax, eax
jne 0x41b723
push 0x8000
push 0
push esi
call sub.KERNEL32.dll_VirtualFree
jmp 0x41b791
cmp dword [edi + 0xc], 0
jne 0x41b72e
mov dword [edi + 8], esi
jmp 0x41b73d
mov eax, esi
mov esi, dword [edi + 0xc]
mov dword [esi], eax
mov esi, eax
push dword [edi + 0xc]
pop dword [esi + 4]
mov dword [edi + 0xc], esi
inc dword [edi + 0x10]
push dword [edi]
pop dword [esi + 8]
push 0x41c310
push dword [esi + 0x18]
call fcn.0041c54e
mov dword [esi + 0x18], eax
lea eax, [esi + 0x18]
push eax
call fcn.0041b986
push 0x41c67d
push dword [esi + 0xc]
call fcn.0041c5a1
or eax, eax
je 0x41b775
mov dword [esi + 0xc], eax
lea eax, [esi + 0xc]
push eax
call fcn.0041b986
push esi
call fcn.0041c1d0
push esi
call fcn.0041ba9b
push esi
push edi
call fcn.0041b79e
inc dword [edi]
jmp 0x41b6d7
pop esi
pop edi
leave
ret 4
Function at 0x41b79e
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push edi
push esi
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x28], 0
jbe 0x41b836
cmp dword [esi + 0x24], 0
je 0x41b836
push dword [edi + 0x18]
pop dword [ebp - 8]
mov eax, dword [esi + 0x28]
add dword [edi + 0x18], eax
cmp dword [edi + 0x14], 0
jne 0x41b7d6
push dword [esi + 0x24]
pop dword [edi + 0x14]
jmp 0x41b830
mov eax, dword [edi + 0x18]
inc eax
push 0x40
push 0x1000
push eax
push 0
call sub.KERNEL32.dll_VirtualAlloc
or eax, eax
je 0x41b830
mov dword [ebp - 4], eax
cmp dword [edi + 0x14], 0
je 0x41b810
push dword [edi + 0x14]
push dword [ebp - 4]
call sub.KERNEL32.dll_lstrcpyA
push 0x8000
push 0
push dword [edi + 0x14]
call sub.KERNEL32.dll_VirtualFree
push dword [ebp - 4]
pop dword [edi + 0x14]
push dword [esi + 0x24]
push dword [edi + 0x14]
call sub.KERNEL32.dll_lstrcatA
push 0x8000
push 0
push dword [esi + 0x24]
call sub.KERNEL32.dll_VirtualFree
push dword [ebp - 8]
pop dword [esi + 0x24]
pop esi
pop edi
leave
ret 8

Function at 0x41b83c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push edi
push esi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 8]
mov dword [ebp - 4], 0
mov eax, dword [edi + 0x1c]
dec eax
jmp 0x41b85c
mov dword [ebp - 4], esi
mov esi, dword [esi]
or esi, esi
je 0x41b865
cmp eax, dword [esi + 0x24]
ja 0x41b857
or esi, esi
jne 0x41b878
cmp dword [ebp - 4], 0
je 0x41b878
mov esi, dword [ebp - 4]
push dword [esi + 4]
pop dword [ebp - 4]
cmp dword [ebp - 4], 0
je 0x41b922
or esi, esi
je 0x41b922
mov dword [ebp - 8], esi
push dword [esi + 0x24]
pop dword [ebp - 0x10]
mov eax, dword [edi + 0x18]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
inc eax
push 0x40
push 0x1000
push eax
push 0
call sub.KERNEL32.dll_VirtualAlloc
or eax, eax
je 0x41b922
mov dword [ebp - 0x18], eax
mov eax, dword [edi + 0x14]
add eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0x18]
call sub.KERNEL32.dll_lstrcpyA
push 0x8000
push 0
push dword [edi + 0x14]
call sub.KERNEL32.dll_VirtualFree
push dword [ebp - 0x18]
pop dword [edi + 0x14]
push dword [ebp - 0x14]
pop dword [edi + 0x18]
mov eax, dword [ebp - 0x10]
sub dword [edi + 0x1c], eax
mov esi, dword [ebp - 4]
jmp 0x41b904
push dword [esi + 4]
pop dword [ebp - 0xc]
push esi
call fcn.0041b9db
push 0x8000
push 0
push esi
call sub.KERNEL32.dll_VirtualFree
mov esi, dword [ebp - 0xc]
or esi, esi
jne 0x41b8e8
mov esi, dword [ebp - 8]
mov dword [edi + 8], esi
mov eax, dword [ebp - 0x10]
jmp 0x41b91e
push dword [esi]
pop dword [ebp - 0xc]
sub dword [esi + 0x24], eax
mov esi, dword [ebp - 0xc]
or esi, esi
jne 0x41b913
pop esi
pop edi
leave
ret 4
Function at 0x41bbc7
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push edi
push esi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
push dword [esi + 0x1c]
pop dword [ebp - 4]
push dword [edi + 0x14]
pop dword [ebp - 0xc]
mov eax, dword [esi + 0x24]
and eax, 1
je 0x41bc5c
mov eax, dword [esi + 0x20]
inc eax
push 0x40
push 0x1000
push eax
push 0
call sub.KERNEL32.dll_VirtualAlloc
or eax, eax
jne 0x41bc13
jmp 0x41bcb1
mov dword [ebp - 8], eax
push eax
push dword [ebp - 4]
push eax
call sub.KERNEL32.dll_lstrcatA
pop dword [ebp - 4]
push dword [ebp - 4]
call sub.USER32.dll_CharLowerA
mov eax, dword [edi + 0x18]
inc eax
push 0x40
push 0x1000
push eax
push 0
call sub.KERNEL32.dll_VirtualAlloc
or eax, eax
jne 0x41bc44
jmp 0x41bcb1
mov dword [ebp - 0x10], eax
push eax
push dword [ebp - 0xc]
push eax
call sub.KERNEL32.dll_lstrcatA
pop dword [ebp - 0xc]
push dword [ebp - 0xc]
call sub.USER32.dll_CharLowerA
mov eax, dword [edi + 0x18]
sub eax, dword [esi + 0x20]
js 0x41bcb1
inc eax
mov dword [ebp - 0x14], eax
jmp 0x41bcac
mov eax, dword [edi + 0x1c]
dec eax
add eax, dword [ebp - 0xc]
push dword [ebp - 4]
push eax
push 1
call fcn.0040d6fd
cmp eax, 0
jbe 0x41bca2
push eax
add eax, dword [esi + 0x20]
push dword [edi + 0x1c]
pop dword [ebp - 0x18]
add dword [edi + 0x1c], eax
pop eax
add eax, dword [ebp - 0x18]
dec eax
dec eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041bd17
jmp 0x41bca9
mov eax, dword [edi + 0x18]
inc eax
mov dword [edi + 0x1c], eax
mov eax, dword [ebp - 0x14]
cmp dword [edi + 0x1c], eax
jbe 0x41bc6a
cmp dword [ebp - 8], 0
je 0x41bcc6
push 0x8000
push 0
push dword [ebp - 8]
call sub.KERNEL32.dll_VirtualFree
cmp dword [ebp - 0x10], 0
je 0x41bcdb
push 0x8000
push 0
push dword [ebp - 0x10]
call sub.KERNEL32.dll_VirtualFree
pop esi
pop edi
leave
ret 8
Function at 0x41bd17
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push esi
push edi
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041bce1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41be5a
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.0041be61
mov dword [ebp - 8], eax
or eax, eax
je 0x41be5a
push 0x40
push 0x1000
push 0x30
push 0
call sub.KERNEL32.dll_VirtualAlloc
or eax, eax
jne 0x41bd6a
jmp 0x41be5a
mov esi, dword [ebp - 8]
mov ebx, eax
mov edi, dword [ebp + 8]
push dword [esi + 8]
pop dword [edi + 0x18]
push dword [esi + 8]
pop dword [ebx + 8]
push dword [esi + 0xc]
pop dword [ebx + 0xc]
cmp dword [edi + 0x14], 0
jne 0x41bd90
push dword [esi + 8]
pop dword [edi + 0x14]
cmp dword [edi + 8], 0
jne 0x41bd9b
mov dword [edi + 8], ebx
jmp 0x41bda3
mov esi, dword [edi + 0xc]
mov dword [esi], ebx
mov dword [ebx + 4], esi
mov dword [edi + 0xc], ebx
inc dword [edi + 0x10]
push dword [edi + 0x10]
pop dword [ebx + 0x28]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
add eax, dword [edi + 0x20]
add eax, 0x50
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
sub eax, 0x50
mov dword [ebp - 0xc], eax
push dword [esi + 0x14]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [esi + 0x18]
call fcn.0041d24d
mov eax, dword [ebp - 0xc]
sub dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x41be5a
inc dword [ebp - 0x10]
push str._...
call sub.KERNEL32.dll_lstrlenA
mov dword [ebp - 0x18], eax
add eax, dword [ebp - 0x10]
push 0x40
push 0x1000
push eax
push 0
call sub.KERNEL32.dll_VirtualAlloc
or eax, eax
jne 0x41be0e
jmp 0x41be5a
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x14]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
dec eax
push eax
push dword [ebx + 0x1c]
push dword [ebp - 0x14]
call fcn.0042e300
push str._...
push dword [ebx + 0x1c]
call sub.KERNEL32.dll_lstrcatA
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0xc]
mov dword [ebx + 0x20], eax
add eax, dword [edi + 0x20]
push dword [edi + 0x20]
pop dword [ebx + 0x24]
cmp eax, dword [ebp - 0x10]
jbe 0x41be54
sub eax, dword [ebp - 0x10]
sub dword [ebx + 0x24], eax
mov eax, dword [ebp - 0x18]
add dword [ebx + 0x24], eax
pop ebx
pop edi
pop esi
leave
ret 0xc
Function at 0x41bfec
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push edi
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x41c005
jmp 0x41c090
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0x14], 1
jne 0x41c029
add eax, dword [ebp + 0xc]
dec eax
cmp byte [eax], 0x20
je 0x41c026
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
add dword [ebp - 8], eax
inc dword [ebp - 8]
push 0x40
push 0x1000
push dword [ebp - 8]
push 0
call sub.KERNEL32.dll_VirtualAlloc
or eax, eax
je 0x41c090
mov dword [ebp - 0x10], eax
cmp dword [edi + 0x24], 0
je 0x41c065
push dword [edi + 0x24]
push eax
call sub.KERNEL32.dll_lstrcpyA
push 0x8000
push 0
push dword [edi + 0x24]
call sub.KERNEL32.dll_VirtualFree
push dword [ebp - 0x10]
pop dword [edi + 0x24]
push dword [ebp + 0xc]
push dword [edi + 0x24]
call sub.KERNEL32.dll_lstrcatA
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0xc]
jae 0x41c087
add eax, dword [edi + 0x24]
add eax, dword [edi + 0x28]
mov byte [eax], 0x20
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
add dword [edi + 0x28], eax
mov eax, dword [ebp - 4]
pop edi
leave
ret 0x10

Function at 0x41c265
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push esi
push edi
mov dword [ebp - 0xc], 0
mov esi, dword [ebp + 8]
mov edi, dword [esi + 0x14]
cmp dword [edi + 0x18], 0
jne 0x41c285
jmp 0x41c307
push dword [edi + 0x14]
call fcn.00411d28
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x18]
cmp dword [esi + 0x24], 1
jne 0x41c29b
shl eax, 1
add eax, 2
mov dword [ebp - 8], eax
push 0x40
push 0x1000
push dword [ebp - 8]
push 0
call sub.KERNEL32.dll_VirtualAlloc
or eax, eax
jne 0x41c2b8
jmp 0x41c307
mov dword [ebp - 0xc], eax
cmp dword [esi + 0x24], 1
jne 0x41c2f9
push 0
push 0
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [edi + 0x18]
push dword [ebp - 4]
push 0
push dword [esi + 0x28]
call sub.KERNEL32.dll_WideCharToMultiByte
or eax, eax
jne 0x41c307
push 0x8000
push 0
push dword [ebp - 0xc]
call sub.KERNEL32.dll_VirtualFree
mov dword [ebp - 0xc], 0
jmp 0x41c307
push dword [edi + 0x18]
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.0042e300
mov eax, dword [ebp - 0xc]
pop edi
pop esi
leave
ret 4

Function at 0x41c863
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
push edi
mov esi, dword [ebp + 8]
push 0x40
push 0x1000
push dword [ebp + 0xc]
push 0
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 4], eax
or eax, eax
je 0x41c8a3
mov edi, eax
cmp dword [esi + 4], 0
jne 0x41c892
mov dword [esi], eax
jmp 0x41c89d
push dword [esi + 4]
pop dword [edi + 4]
mov edi, dword [esi + 4]
mov dword [edi], eax
mov dword [esi + 4], eax
inc dword [esi + 8]
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8