joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b1940
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x4b1957
add esp, 0xfffffff0
call fcn.004052dc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0043e738
mov eax, dword [0x4be08c]
cmp byte [eax], 0
jne 0x4b1984
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x4be300]
cmp word [eax + 2], 0
jne 0x4b199e
mov eax, dword [0x4be300]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004b3a38
mov eax, dword [0x4be3f4]
cmp word [eax + 2], 0
jne 0x4b19b8
mov eax, dword [0x4be3f4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004b3c48
mov byte [ebx + 0x35], 0
mov dl, 1
mov eax, dword [0x44909c]
call fcn.0044f370
mov esi, eax
mov dword [ebx + 0x3c], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x4b41f8
mov dl, 1
mov eax, dword [0x427c3c]
call fcn.00404d78
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x427c3c]
call fcn.00404d78
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x44d534]
call fcn.004587e0
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x4b1b98
mov eax, dword [0x4be1ec]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00458c74
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4b44e0
mov dl, 1
mov eax, dword [0x427c3c]
call fcn.00404d78
mov dword [ebx + 0x98], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x4be1ec]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00412e50
test eax, eax
je 0x4b1ac9
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00412c34
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00412e34
test eax, eax
je 0x4b1ae1
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00406a54
push ebx
push 0x4b3408
call fcn.004a7594
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xd0], 0
mov eax, dword [0x4be08c]
cmp byte [eax], 0
jne 0x4b1b32
mov eax, ebx
call fcn.004b1d0c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
mov byte [ebx + 0xd1], 0
mov byte [ebx + 0xdc], 0
xor eax, eax
mov dword [ebx + 0xd4], eax
mov byte [ebx + 0xd3], 0
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.004b470c
mov eax, ebx
call fcn.004b5340
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4b1b8f
call fcn.00405334
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b1fe0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4b2082
cmp dword [ebx + 0x94], 0
jne 0x4b207c
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4b1f2c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4b207c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4b2042
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4b207c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00432b44
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4b2051
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4b22a0
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4c42bc]
cmp dword [eax + 0x170], 0
je 0x4b2405
test bl, bl
jne 0x4b2353
cmp dword [esi + 0x9c], 0
jne 0x4b2348
mov eax, esi
call fcn.004b5190
push eax
push 0x4b21ac
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4b2319
mov eax, dword [0x4c42bc]
cmp byte [eax + 0xd3], 0
je 0x4b2319
mov eax, dword [esi + 0xd8]
call fcn.00407e78
mov edi, eax
cmp edi, 0
jl 0x4b2319
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4b2302
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4b2348
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00432b44
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4b2328
inc dword [esi + 0x9c]
jmp 0x4b2405
cmp dword [esi + 0x9c], 0
jle 0x4b2405
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4b2405
cmp dword [esi + 0x44], 0
je 0x4b23b0
mov eax, dword [0x4c42bc]
cmp byte [eax + 0xd3], 0
je 0x4b23b0
mov eax, dword [esi + 0xd8]
call fcn.00407e78
mov edi, eax
cmp edi, 0
jl 0x4b23b0
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4b2399
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4b23df
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00432b44
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4b23bf
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x4a546c]
call fcn.00408038
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4b3054
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4b30bf
cmp byte [ebx + 0xd3], 0
jne 0x4b30bf
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004069a8
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4b30ac
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4b30cc
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040686c
jmp 0x4b30cc
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040686c
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4b48f4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4b4962
mov eax, esi
call fcn.0048ced4
test al, al
je 0x4b4962
mov eax, dword [ebx + 0x84]
call fcn.0048cb28
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4b4962
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4b4956
push 0
mov eax, dword [ebx + 0x84]
call fcn.0048cb28
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00483b00
jmp 0x4b4962
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004b472c
pop esi
pop ebx
ret
Function at 0x406128
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x40614d
mov dword [0x40a0f4], eax
add esp, 0xfffffff8
push 0x4060ec
push eax
call fcn.00407c20
jmp 0x406152
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x406168
mov dword [0x409054], 0x40624c
jmp 0x406172
mov dword [0x409054], 0x406200
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x43590c74
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x57677ceb
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x409eab
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov eax, edx
xor esi, esi
push edi
push 0x1000
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], esi
mov dword [eax], esi
call dword [sym.imp.msvcrt.dll_malloc]
mov ebx, eax
mov dword [ebp - 0x10], ebx
pop ecx
test ebx, ebx
jne 0x409ef8
push 0x4106e0
push 0x40211c
push 0x4039d4
push dword [ebp + 8]
call fcn.00409fd2
add esp, 0x10
xor eax, eax
jmp 0x409fa8
lea eax, [ebp - 0x18]
push eax
push 0x8000
push 0x4106e0
call dword [sym.imp.msvcrt.dll__open]
mov edi, eax
add esp, 0xc
mov dword [ebp - 0xc], edi
cmp edi, 0xffffffff
jne 0x409f7d
push 0x4106e0
push 0x40211c
push 0x403178
push dword [ebp + 8]
call fcn.00409fd2
add esp, 0x10
jmp 0x409f9d
push 0x1000
push ebx
push edi
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x409fb1
test eax, eax
je 0x409f7d
or edx, 0xffffffff
mov edi, ebx
sub edx, esi
mov ebx, eax
movzx ecx, byte [edi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x401660]
inc edi
sub ebx, 1
jne 0x409f5a
mov edi, dword [ebp - 0xc]
or esi, 0xffffffff
mov ebx, dword [ebp - 0x10]
sub esi, edx
push edi
call dword [sym.imp.msvcrt.dll__eof]
pop ecx
test eax, eax
je 0x409f35
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 1
mov dword [eax], esi
push edi
call dword [sym.imp.msvcrt.dll__close]
pop ecx
push ebx
call dword [sym.imp.msvcrt.dll_free]
mov eax, dword [ebp - 4]
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x4106e0
push 0x40211c
push 0x4039f8
push dword [ebp + 8]
call fcn.00409fd2
add esp, 0x10
jmp 0x409f95

Function at 0x40a50f
Capabilities:
Get file attributes
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ebx, 0xffffffff
cmp eax, ebx
jne 0x40a547
push 0x4106e0
push 0x40211c
push 0x403b0c
push dword [ebp + 8]
call fcn.00409fd2
add esp, 0x10
mov eax, ebx
jmp 0x40a5a4
test al, 0x50
je 0x40a55c
push 0x4106e0
push 0x40211c
push 0x403b24
jmp 0x40a538
xor eax, eax
push eax
push eax
push 3
push eax
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, ebx
je 0x40a529
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x40a529
cmp dword [ebp - 4], 0
jle 0x40a5a2
push 0x4106e0
push 0x40211c
push 0x403b38
jmp 0x40a538
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40afc6
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor edi, edi
mov ebx, edx
push edi
push edi
push 3
push edi
push edi
push 0x40000000
push 0x4104e0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40b017
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push edi
push 3
push edi
push edi
push 0x40000000
push 0x4104e0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40b092
lea eax, [ebp - 0xc]
push eax
movzx eax, word [ebx + 2]
push eax
movzx eax, word [ebx]
push eax
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
mov edi, eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
or edi, eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
or edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, word [ebx + 4]
test ax, ax
jne 0x40b064
mov eax, 0x80
jmp 0x40b067
and eax, 0x27
push eax
mov ebx, 0x4104e0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
or eax, edi
jne 0x40b092
push ebx
push 0x40211c
push 0x403c98
push dword [ebp + 8]
call fcn.00409fd2
add esp, 0x10
xor eax, eax
jmp 0x40b095
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40b207
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor edi, edi
mov esi, 0x4106e0
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
cmp dword [ebp + 0x18], edi
je 0x40b232
mov edx, 0x8000
mov ecx, esi
call fcn.0040b0a3
jmp 0x40b240
push 0x8000
push esi
call dword [sym.imp.msvcrt.dll__open]
pop ecx
pop ecx
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40b263
push esi
push 0x40211c
push 0x403af4
push dword [ebp + 0x1c]
call fcn.00409fd2
add esp, 0x10
jmp 0x40b3b6
mov ebx, dword [ebp + 0x1c]
lea ecx, [ebp - 0x18]
push ebx
push dword [ebp + 0x18]
mov edx, esi
call fcn.0040aed6
test eax, eax
je 0x40b39d
mov eax, fcn.00408570
test eax, eax
je 0x40b29a
push ebx
push dword [ebp + 0x14]
lea eax, [ebp - 0x18]
push eax
call fcn.00408570
test eax, eax
je 0x40b39d
cmp dword [ebp + 8], edi
jne 0x40b2a7
xor edi, edi
inc edi
jmp 0x40b39d
push 0x8000
call dword [sym.imp.msvcrt.dll_malloc]
mov dword [ebp - 8], eax
pop ecx
test eax, eax
jne 0x40b2d8
push 0x4104e0
push esi
push 0x4020e0
push 0x403cc8
push ebx
call fcn.00409fd2
add esp, 0x14
jmp 0x40b39d
cmp dword [ebp + 0x18], edi
je 0x40b2ee
mov edx, 0x8301
mov ecx, 0x4104e0
call fcn.0040b0a3
jmp 0x40b306
push 0x180
push 0x8301
push 0x4104e0
call dword [sym.imp.msvcrt.dll__open]
add esp, 0xc
mov edi, eax
cmp edi, 0xffffffff
jne 0x40b360
push 0x4104e0
push 0x40211c
push 0x403af4
push ebx
call fcn.00409fd2
add esp, 0x10
xor edi, edi
jmp 0x40b39d
push 0x8000
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
je 0x40b3ce
test eax, eax
je 0x40b360
push eax
push dword [ebp - 8]
push edi
call dword [sym.imp.msvcrt.dll__write]
add esp, 0xc
cmp eax, dword [ebp - 0x10]
jne 0x40b3c1
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll__eof]
pop ecx
test eax, eax
je 0x40b329
push edi
call dword [sym.imp.msvcrt.dll__close]
pop ecx
push ebx
lea edx, [ebp - 0x18]
or edi, 0xffffffff
call fcn.0040afc6
test eax, eax
je 0x40b325
mov dword [ebp - 0xc], 1
cmp edi, 0xffffffff
je 0x40b39a
push edi
call dword [sym.imp.msvcrt.dll__close]
pop ecx
mov edi, dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll__close]
mov eax, dword [ebp - 8]
pop ecx
test eax, eax
je 0x40b3b6
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push esi
push 0x40211c
push 0x403d0c
jmp 0x40b3d9
push esi
push 0x40211c
push 0x403cf4
push ebx
call fcn.00409fd2
add esp, 0x10
jmp 0x40b38d
Function at 0x40c0cf
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov eax, edx
mov ebx, ecx
push edi
mov dword [ebp - 4], eax
call fcn.0040c171
test eax, eax
je 0x40c165
xor edi, edi
mov esi, dword [ebx + edi*4]
test esi, esi
je 0x40c154
cmp dword [esi], 0
je 0x40c0ff
push dword [esi]
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
push dword [esi + 4]
call dword [sym.imp.msvcrt.dll_remove]
pop ecx
test eax, eax
je 0x40c128
push dword [esi + 4]
push dword [esi + 8]
push 0x4020e0
push 0x403adc
push dword [ebp - 4]
call fcn.00409fd2
add esp, 0x14
cmp dword [esi + 8], 0
je 0x40c138
push dword [esi + 8]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
cmp dword [esi + 4], 0
je 0x40c148
push dword [esi + 4]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push esi
call dword [sym.imp.msvcrt.dll_free]
and dword [ebx + edi*4], 0
pop ecx
inc edi
cmp edi, 3
jl 0x40c0ea
push ebx
call dword [sym.imp.msvcrt.dll_free]
xor eax, eax
pop ecx
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c722
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x800
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], ecx
mov eax, dword [edi + 8]
mov ebx, dword [edi + 4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], ebx
call dword [sym.imp.msvcrt.dll_malloc]
mov dword [ebp - 4], eax
pop ecx
test eax, eax
jne 0x40c778
push dword [ebp - 8]
push ebx
push dword [ebp - 0xc]
push 0x402548
push 0x4040a8
push dword [ebp + 0x10]
call fcn.00409fd2
add esp, 0x18
jmp 0x40c867
push 0x404078
push ebx
call dword [sym.imp.msvcrt.dll_fopen]
mov ebx, dword [ebp + 0x10]
mov dword [edi], eax
pop ecx
pop ecx
test eax, eax
jne 0x40c7a8
push dword [edi + 4]
push dword [edi + 8]
push 0x4020e0
push 0x403ac8
push ebx
call fcn.00409fd2
add esp, 0x14
cmp dword [edi], esi
je 0x40c851
mov esi, dword [edi]
jmp 0x40c7fc
push esi
push 0x800
push 1
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_fread]
push esi
mov dword [ebp - 0x18], eax
call dword [sym.imp.msvcrt.dll_ferror]
add esp, 0x14
test eax, eax
jne 0x40c835
mov eax, dword [ebp - 0x18]
test eax, eax
jle 0x40c7fc
push dword [ebp - 0x10]
push eax
push 1
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_fwrite]
push dword [ebp - 0x10]
call dword [sym.imp.msvcrt.dll_ferror]
add esp, 0x14
test eax, eax
jne 0x40c820
push esi
call dword [sym.imp.msvcrt.dll_feof]
pop ecx
test eax, eax
je 0x40c7b4
mov edx, ebx
mov ecx, edi
call fcn.0040a367
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_free]
xor eax, eax
pop ecx
inc eax
jmp 0x40c869
push dword [ebp - 8]
push dword [ebp - 0x14]
push dword [ebp - 0xc]
push 0x402548
push 0x4040ec
jmp 0x40c848
push dword [ebp - 8]
push dword [ebp - 0x14]
push dword [ebp - 0xc]
push 0x402548
push 0x4040cc
push ebx
call fcn.00409fd2
add esp, 0x18
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
test esi, esi
je 0x40c867
push esi
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40e382
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0
mov edi, ecx
push 0x8000
push edi
call dword [sym.imp.msvcrt.dll__open]
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40e3c5
push edi
push 0x40211c
push 0x404534
push dword [ebp + 0xc]
call fcn.00409fd2
add esp, 0x10
xor eax, eax
jmp 0x40e473
push 0x428
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
jne 0x40e3e4
push edi
push 0x40211c
push 0x40454c
jmp 0x40e3b3
push 0x1000
call dword [sym.imp.msvcrt.dll_malloc]
mov ebx, eax
mov dword [esi + 0xc], ebx
pop ecx
test ebx, ebx
jne 0x40e403
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x40e3d7
push edi
call dword [sym.imp.msvcrt.dll__strdup]
mov dword [ebp - 0xc], eax
mov dword [esi], eax
pop ecx
test eax, eax
jne 0x40e41e
push ebx
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x40e3f9
mov eax, dword [ebp - 8]
xor ecx, ecx
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x24], ecx
lea ecx, [ebp - 4]
push 3
push ecx
push eax
mov dword [esi + 4], eax
mov dword [esi + 8], 0x1000
mov dword [esi + 0x10], ebx
mov dword [esi + 0x20], 1
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
cmp eax, 3
jne 0x40e47c
cmp byte [ebp - 4], 0xef
jne 0x40e47c
cmp byte [ebp - 3], 0xbb
jne 0x40e47c
cmp byte [ebp - 2], 0xbf
jne 0x40e47c
mov dword [esi + 0x24], 1
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll__lseek]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40e471
push dword [ebp - 0xc]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push ebx
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x40e3a8
Function at 0x40e4b5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov ecx, 0x400
mov esi, ebx
mov dword [ebp - 8], ecx
cmp dword [edi + 0x20], 0
jne 0x40e514
push dword [edi]
push 0x40211c
push 0x40456c
push dword [ebp + 0xc]
call fcn.00409fd2
add esp, 0x10
jmp 0x40e5a0
mov edx, dword [edi + 0x10]
mov al, byte [edx]
cmp al, 0xa
je 0x40e585
cmp al, 0xd
je 0x40e519
cmp al, 0x1a
je 0x40e564
cmp ecx, 1
jle 0x40e55f
dec ecx
mov byte [esi], al
inc esi
mov dword [ebp - 8], ecx
inc dword [edi + 0x10]
mov eax, dword [edi + 0x10]
jmp 0x40e51f
lea eax, [edx + 1]
mov dword [edi + 0x10], eax
cmp eax, dword [edi + 0x14]
jbe 0x40e4f0
cmp dword [edi + 0x18], 0
jne 0x40e592
push dword [edi + 8]
push dword [edi + 0xc]
push dword [edi + 4]
call dword [sym.imp.msvcrt.dll__read]
mov ecx, eax
add esp, 0xc
cmp ecx, dword [edi + 8]
je 0x40e54a
mov dword [edi + 0x18], 1
mov eax, dword [edi + 0xc]
mov dword [edi + 0x10], eax
dec eax
add eax, ecx
mov ecx, dword [ebp - 8]
mov dword [edi + 0x14], eax
test ecx, ecx
jg 0x40e514
jmp 0x40e5a0
mov byte [esi], 0
jmp 0x40e5a0
mov eax, dword [edi + 0xc]
xor ecx, ecx
and dword [edi + 0x14], 0
inc ecx
mov dword [edi + 0x18], ecx
mov dword [edi + 0x10], eax
mov byte [esi], 0
cmp esi, ebx
ja 0x40e57e
mov dword [edi + 0x1c], ecx
inc esi
sub esi, ebx
mov eax, esi
jmp 0x40e5a2
inc dword [edi + 0x10]
mov byte [esi], 0
sub esi, ebx
lea eax, [esi + 1]
jmp 0x40e5a2
mov byte [esi], 0
cmp esi, ebx
ja 0x40e58b
mov dword [edi + 0x1c], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8