joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004ef06
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x24]
mov ecx, dword [esi + 0x64]
mov eax, dword [esi + 0x34]
mov edx, dword [esi + 0x6c]
sub eax, ecx
sub eax, edx
mov dword [ebp + 8], eax
jne 0x1004ef30
test ecx, ecx
jne 0x1004ef3a
test edx, edx
jne 0x1004ef3a
mov eax, edi
jmp 0x1004efa6
cmp eax, 0xffffffff
jne 0x1004ef3a
push 0xfffffffffffffffe
pop eax
jmp 0x1004efa6
mov edx, dword [esi + 0x24]
lea edx, [edi + edx - 0x106]
cmp ecx, edx
jb 0x1004efa6
mov eax, dword [esi + 0x30]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.10043b20
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x3c]
sub dword [esi + 0x68], edi
sub dword [esi + 0x64], edi
add esp, 0xc
sub dword [esi + 0x54], edi
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx edx, word [eax]
mov ebx, edx
sub ebx, edi
cmp edx, edi
sbb edx, edx
not edx
and edx, ebx
dec ecx
mov word [eax], dx
jne 0x1004ef6b
mov eax, dword [esi + 0x38]
mov edx, edi
lea eax, [eax + edi*2]
dec eax
dec eax
movzx ecx, word [eax]
mov ebx, ecx
sub ebx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, ebx
dec edx
mov word [eax], cx
jne 0x1004ef8a
mov eax, dword [ebp + 8]
add eax, edi
mov ecx, dword [esi]
cmp dword [ecx + 4], 0
je 0x1004f001
push eax
mov eax, dword [esi + 0x6c]
add eax, dword [esi + 0x64]
add eax, dword [esi + 0x30]
push eax
push ecx
call fcn.1004f006
add dword [esi + 0x6c], eax
mov ebx, dword [esi + 0x6c]
add esp, 0xc
cmp ebx, 3
jb 0x1004efed
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x30]
lea edx, [eax + ecx]
mov ecx, dword [esi + 0x50]
movzx eax, byte [edx]
mov dword [esi + 0x40], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x4c]
mov dword [esi + 0x40], eax
cmp ebx, 0x106
jae 0x1004f001
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x1004ef12
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10058130
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
push 0
push esi
push edi
call fcn.100581b0
add esp, 0xc
cmp eax, esi
je 0x1005814f
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ecx
push edi
call fcn.1004bf48
add esp, 0xc
pop edi
pop esi
ret
Function at 0x401690
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x10
push ebx
push esi
push edi
push edx
pop edi
push edi
push 0
push dword [section..data]
mov dword [ebp - 8], edi
push ecx
pop esi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, edi
shr ebx, 2
mov dword [ebp - 4], eax
or ebx, ebx
je 0x4016d4
push esi
pop edi
mov ecx, eax
sub edi, eax
mov edx, ebx
mov eax, dword [edi + ecx]
mov dword [ecx], eax
lea ecx, [ecx + 4]
dec edx
jne 0x4016c3
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
shl ebx, 2
cmp ebx, edi
jae 0x4016ef
push edi
pop edx
sub esi, eax
lea ecx, [ebx + eax]
sub edx, ebx
mov al, byte [ecx + esi]
mov byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x4016e4
mov eax, dword [ebp - 4]
lea esi, [edi - 8]
lea ecx, [eax - 8]
add ecx, edi
push esi
pop ebx
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx]
shr ebx, 2
and esi, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
or ebx, ebx
je 0x401731
lea ecx, [ebx + edx]
mov edx, dword [eax]
movzx ecx, cl
ror edx, cl
mov ecx, dword [ebp - 8]
add eax, 4
xor edx, ecx
sub edx, ebx
mov dword [eax - 4], edx
mov edx, dword [ebp - 0xc]
dec ebx
jne 0x401714
test esi, esi
je 0x40173d
xor byte [eax], cl
lea eax, [eax + 1]
dec esi
jne 0x401735
mov edi, dword [ebp - 0x10]
mov edi, dword [edi - 4]
push edi
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, dword [ebp - 4]
push eax
pop esi
mov edx, esi
push ebx
pop ecx
call section..text
push ebx
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x150303f7
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x52d40575
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x5734ad
Capabilities:
Get number of processors

Disassembly:
add edi, 2
sal esi, cl
jmp 0x67b5d6
mov dword [edi], esi
call fcn.007b5892

Function at 0x58573b
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [edi]
push 0x1a1d7d19
call fcn.00582863
mov byte [0x67b26e62], al
invalid

Function at 0x58a867
Capabilities:
Authenticate hmac

Disassembly:
jno 0x795375
add dword [ecx + 0x2ad6b115], esp
xor byte [edx - 0xd], 0x5b
cmc
add dword [ecx], ecx
rcl dword [edx - 0x3a]
test byte [edx + 0xf], 0xdf
fld dword [0x8e4ead55]
sbb byte [edx], 3
iretd
xor bl, cl
or esi, 0x6634139a
adc ecx, esp
rol esi, 0xa6
jb 0x653624
dec ebx
push 0x7ea2e8a2
lea esp, [esp + 8]
jne 0x777015
mov eax, 0x532c0517
call fcn.005a7b6c
jno 0x78a402
add esi, 4
push 0xc7ba6813
shld di, ax, cl
not byte [esp + 9]
push 0xc8211802
mov word [esi], di
push 0x831602a9
lea esp, [esp + 0x14]
jmp fcn.0076ff2a
neg esi
mov esi, dword [ecx + esi - 0x72fb1967]
call fcn.007976a7
mov edx, 0x130d49c
and edx, 0x612c5709
lea ebp, [ebp + edx - 0x1205409]
movzx edx, byte [edx + ebp - 0x1205408]
mov ecx, 0x73170fa0
lea ecx, [ecx*4 + 0x702489a1]
xor dl, bl
xor dl, 0xa9
xchg ch, cl
sal cx, 0xca
neg dl
bswap ecx
inc dl
sar ecx, 0x67
inc cl
ror dl, cl
and ecx, 0x539fffbc
call fcn.00612465
call fcn.0065e99f
cmpsb byte [esi], byte es:[edi]
push es
pop esi
fiadd dword [esi]
inc dx
add byte [eax], al
add byte [eax], al
push esp
fimul word [esi]
cmp eax, dword [esi + 0x6e]
mov edi, dword [edx]
invalid
push eax
jae 0x586b53
cmp dl, dh
mov ah, 0x4c
jo 0x66a333
sub ebx, dword [ebx - 0x19f18439]
mov byte [eax + 0x3c], bl
fdiv qword [edi - 0x25]
adc dword [edi], 0x3a
inc byte [eax + ebx*8]
mov byte [ebx + ebx*4 + 0x3f], dh
pop ds
adc dword [esi - 0x6bf76fc2], 0x14
lahf
pop ds
rcl dword [ebx - 0x15], cl
idiv ecx
push esp
mov esi, 0xffffffff
call dword [0x5a6d37f5]
xlatb
aad 0xf
outsb dx, byte [esi]
sub al, 0x81
test eax, 0x1d135e34
mov bh, 0xef
mov dl, 2
mov edi, 0x6c168fe5
pushfd
jno 0x66a40d
push esp
cmpsb byte [esi], byte es:[edi]
pop esp
or eax, 0xc7481f37
dec eax
invalid
inc esp
and al, 8
scasd eax, dword es:[edi]
invalid
leave
mov eax, 0x2dbb47ac
xor ax, 0xc006
mov eax, dword [ebp + ebx*4]
ja 0x66a37e
mov word [edi], dx
lea esp, [esp + 8]
jmp fcn.00602c7d
neg dl
dec dl
not dword [esp]
not dl
dec dl
call fcn.005a1aba
jmp 0x58a854
call 0x58a867
cwde
hlt

Function at 0x58a881
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov dword [ebp - 4], eax
test ebx, ebx
jmp 0x5bfcfb
mov dword [esp], 0xec952d36
adc eax, edx
jmp 0x588e89
jmp 0x7bd447
lea esp, [esp + 0xc]
je 0x7c44c7
mov eax, dword [ebp + ebx*4]
call fcn.005bf602
add esi, 6
call fcn.007cac4b
cmpsb byte [esi], byte es:[edi]
jbe 0x5bfd8c
add byte [eax + ebp + 0x1ba3ab37], 0x62
fimul word [esp + esi*4 - 0x78]
je 0x5bfcc5
invalid
aad 0x20
mov cl, 0xe8
salc
invalid
movzx ecx, byte [ebp]
call fcn.0066d4b0
mov eax, 0x1236ff07
bswap eax
call fcn.005d3301
mov ecx, 0x8cbe3100
jmp 0x7770c1
Function at 0x5a0b70
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec eax
sub edx, ecx
dec eax
lea edi, [edi*8 - 0x214dd7d3]
dec eax
mov esp, edx
pushfd
inc eax
movsx esi, bh
push edi
dec ecx
mov esi, ebx
dec eax
shl dword [esp + edi*2 + 0x42993ac6], 0x6f
adc dword [esp + edi + 0x214c9d66], 0x34b5071d
sal byte [esp + edi + 0x214c9d63], 6
dec eax
mov edi, edx
jp 0x7a2961
cld
rep movsb byte es:[edi], byte [esi]
dec eax
ror dword [esp], 0xf
push dword [esp + 8]
popfd
call fcn.0061d367

Function at 0x5a0bac
Capabilities:
Parse pe header

Disassembly:
push ebp
neg ebp
btc bp, di
mov ebp, esp
add edx, edi
test si, 0xb094
mov edx, dword [ebp + 8]
stc
test eax, 0x23bed205
cmc
sub esp, 0x114
push esi
test edx, edx
jmp 0x5bc2b0
je 0x56ca55
mov esi, dword [ebp + 0xc]
jmp 0x5b7508

Function at 0x5ab7f0
Capabilities:
Authenticate hmac

Disassembly:
add edx, 0xc3a0bd35
xor edx, 0x7c1cc435
sal dword [esp + 4], 0x5c
jbe 0x653a35
xor ebx, edx
mov dword [esp], 0x1d2f00b0
sub esi, 4
mov dword [esi], edx
lea esp, [esp + 8]
jmp fcn.00585ea4

Function at 0x5b668c
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov dword [esp], ecx
mov cl, byte [ebp + 4]
push 0x29b7eb29
add ebp, 4
shrd si, ax, cl
mov word [ebp], si
call fcn.007b950d
invalid

Function at 0x5bc2a0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0x2ca27686
mov dword [esp + 4], ecx
mov dword [esp], edi
call fcn.007b72a9
mov edx, 0xaa993b2a
shr edx, 0xef
mov edx, edi
jne 0x7c8d10
jmp 0x5bc28f
sbb edi, 2
push 0xef1b7a33
call fcn.007b5bb9
mov cs, ebx
dec eax
insd dword es:[edi], dx
push ss
pop ebx
in al, 0xb3
aam 0x62
xchg ecx, eax
insb byte es:[edi], dx
xchg dword [esi + 0x3615ba41], edx
pop eax
test ebx, esp
bound edx, qword [eax - 0x2bc5295f]
push es
dec esi
jo 0x7c8d05
xor bh, byte [ebp - 0x710b9e8]
mov bh, bh
ror byte [ebx - 0x7e017a08], 1
cld
sub dh, byte [esi - 0x7b]
mov eax, 0x22e9ff85
retf

Function at 0x5c10b4
Capabilities:
Encode data using xor

Disassembly:
add esi, 2
and cl, dl
call fcn.0057a5f7
mov dl, 0x1a
out 0x95, eax
out 0xf4, eax
push ebp
mov dh, 0x62
xchg ebx, eax
aad 0xbb
lodsb al, byte [esi]
adc eax, 0xcd3ec86e
mov ch, 0xf5
aaa
sbb dl, byte [ebx + 0x58e3c593]
add al, 0xc1
mov dx, 0x2878
invalid
Function at 0x61165e
Capabilities:
Authenticate hmac

Disassembly:
jno 0x795375
add dword [ecx + 0x2ad6b115], esp
xor byte [edx - 0xd], 0x5b
cmc
add dword [ecx], ecx
rcl dword [edx - 0x3a]
test byte [edx + 0xf], 0xdf
fld dword [0x8e4ead55]
sbb byte [edx], 3
iretd
xor bl, cl
or esi, 0x6634139a
adc ecx, esp
rol esi, 0xa6
jb 0x653624
dec ebx
push 0x7ea2e8a2
lea esp, [esp + 8]
jne 0x777015
mov eax, 0x532c0517
call fcn.005a7b6c
jno 0x78a402
add esi, 4
push 0xc7ba6813
shld di, ax, cl
not byte [esp + 9]
push 0xc8211802
mov word [esi], di
push 0x831602a9
lea esp, [esp + 0x14]
jmp fcn.0076ff2a
neg esi
mov esi, dword [ecx + esi - 0x72fb1967]
call fcn.007976a7
mov edx, 0x130d49c
and edx, 0x612c5709
lea ebp, [ebp + edx - 0x1205409]
movzx edx, byte [edx + ebp - 0x1205408]
mov ecx, 0x73170fa0
lea ecx, [ecx*4 + 0x702489a1]
xor dl, bl
xor dl, 0xa9
xchg ch, cl
sal cx, 0xca
neg dl
bswap ecx
inc dl
sar ecx, 0x67
inc cl
ror dl, cl
and ecx, 0x539fffbc
call fcn.00612465
call fcn.0065e99f
cmpsb byte [esi], byte es:[edi]
push es
pop esi
fiadd dword [esi]
inc dx
add byte [eax], al
add byte [eax], al
push esp
fimul word [esi]
cmp eax, dword [esi + 0x6e]
mov edi, dword [edx]
invalid
push eax
jae 0x586b53
cmp dl, dh
mov ah, 0x4c
jo 0x66a333
sub ebx, dword [ebx - 0x19f18439]
mov byte [eax + 0x3c], bl
fdiv qword [edi - 0x25]
adc dword [edi], 0x3a
inc byte [eax + ebx*8]
mov byte [ebx + ebx*4 + 0x3f], dh
pop ds
adc dword [esi - 0x6bf76fc2], 0x14
lahf
pop ds
rcl dword [ebx - 0x15], cl
idiv ecx
push esp
mov esi, 0xffffffff
call dword [0x5a6d37f5]
xlatb
aad 0xf
outsb dx, byte [esi]
sub al, 0x81
test eax, 0x1d135e34
mov bh, 0xef
mov dl, 2
mov edi, 0x6c168fe5
pushfd
jno 0x66a40d
push esp
cmpsb byte [esi], byte es:[edi]
pop esp
or eax, 0xc7481f37
dec eax
invalid
inc esp
and al, 8
scasd eax, dword es:[edi]
invalid
leave
mov eax, 0x2dbb47ac
xor ax, 0xc006
mov eax, dword [ebp + ebx*4]
ja 0x66a37e
mov word [edi], dx
lea esp, [esp + 8]
jmp fcn.00602c7d
neg dl
dec dl
not dword [esp]
not dl
dec dl
call fcn.005a1aba
jmp 0x58a854
call 0x58a867
cwde
hlt
Function at 0x657181
Capabilities:
Encode data using xor

Disassembly:
call fcn.006797a7
pop esp
sbb dword [esi + 0x22c9784a], ebx
das
jo 0x6571c1
mov byte [0x6e8a0879], al
push edi
insb byte es:[edi], dx
sub edx, dword [esi + 0x329f2c49]
adc eax, 0x9b8112bf
sbb byte [ecx - 0x699f7e59], dh
popal
adc esp, 0x2408cf4a
pop ss
jle 0x657223
and dword [eax - 0x6a], 0x4ad48161
iretd
jnp 0x65721c
cmp eax, ecx
inc dl
adc ah, byte [esi + 0x1badd48a]
pop ebp
mov dh, 0x4c
pop ebp
into
pop esp
outsb dx, byte [esi]
sub ebp, ebp
mov ch, 6
xchg esp, eax
jne 0x6571a5
call 0x93af1d53
invalid
test dword [ebp - 0x44], ebp
and eax, 0xa563fe17
movsd dword es:[edi], dword [esi]
cli
fsub st(4)
add ecx, edx
mov ah, 0x54
pop es
cmpsd dword [esi], dword es:[edi]
call 0x6572f333
lodsb al, byte [esi]
pop ds
lodsd eax, dword [esi]
jbe 0x65726b
mov eax, 0xc3ce766a
pop ss
mov dword [0x494729f3], eax
in eax, 0xe3
or byte [esi + 0x6a17df79], ch
push eax
lodsb al, byte [esi]
sbb byte [eax], ah
xchg edx, eax
test byte [edi - 0x6f], ch
inc esi
fcom dword [eax]
adc dword [edi], ebp
retf 0x8d01
fsubr qword [eax + 0x10]
std
pop ebx
imul eax, dword [edx - 0x36caff4], 0x883a26a
test dword [esi], eax
push ds
dec ebp
fcom qword [eax + 0x1e8a772]
pushal
outsb dx, byte [esi]
cld
or al, 0xe6
and al, cl
jl 0x657291
jns 0x657290
jg 0x657225
xchg esp, eax
push esi
or bl, bl
outsb dx, byte [esi]
clc
fld xword [esi - 8]
xor byte [ebp + 0x70], bl
psubsw mm2, qword [ebx - 0x690db94e]
sbb eax, 0xf37d96a4
bound ebx, qword [0xbb9a52d8]
add al, 0x76
dec esi
sub ah, byte [edi + 0x590381e8]
xchg ecx, eax
stc
cmp eax, 0x5c0222e0
and byte [esp + 0x37], ah
out 0x1e, al
add ch, byte [edi - 0x4f300561]
sbb al, dh
mov eax, 0x3266b027
out dx, eax
salc
popal
les ecx, [esi + esi*2 - 0x588cf16d]
add ch, bl
jg 0x657293
or al, 0xb0
sbb ebp, dword [0x9430376e]
mov bh, 0x2d
fmul qword [ecx]
pushal
mov ecx, 0x71977848
adc esi, dword [ecx]
call 0x1e219376
and byte [edx + ebx*4], ch
out 0x35, al
into
pop ss
invalid

Function at 0x67ad83
Capabilities:
Check for vm using instruction vpcext

Disassembly:
jmp 0x7c44bd
dec ebx
jmp 0x5a0d27
lea esp, [esp + 8]
jne 0x5bfd05

Function at 0x777000
Capabilities:
Authenticate hmac

Disassembly:
push 0x4e202786
mov dword [ebp - 4], eax
test ebx, ebx
lea esp, [esp + 8]
je 0x58a877
Function at 0x401950
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push 0x419588
push 0x41958c
call fcn.004060e9
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4019d3
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401400
add esp, 4
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
push edx
push 1
push 4
lea eax, [ebp - 0xc]
push eax
call fcn.00406257
add esp, 0x10
cmp dword [ebp - 4], 0
je 0x4019c5
mov ecx, dword [ebp - 8]
push ecx
push 1
push 0x288
mov edx, dword [ebp - 4]
push edx
call fcn.00406257
add esp, 0x10
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x284]
mov dword [ebp - 4], ecx
jmp 0x40199a
mov edx, dword [ebp - 8]
push edx
call fcn.0040633e
add esp, 4
jmp 0x4019e0
push 0x41959c
call fcn.004063b2
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x4019f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
push 0x4195ac
push str.userinfo.dat
call fcn.004060e9
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401ab1
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
push eax
push 1
push 4
lea ecx, [ebp - 0xc]
push ecx
call fcn.004066b9
add esp, 0x10
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
test edx, edx
je 0x401aa3
push 0x288
call fcn.004066d6
add esp, 4
mov dword [ebp - 0x10], eax
push 0x288
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0040b0a0
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
push 1
push 0x288
mov eax, dword [ebp - 0x10]
push eax
call fcn.004066b9
add esp, 0x10
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x284], 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00401290
add esp, 8
mov dword [ebp - 8], eax
jmp 0x401a37
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040633e
add esp, 4
jmp 0x401abe
push 0x4195c0
call fcn.004063b2
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x401af0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push 0x4195d0
push 0x4195d4
call fcn.004060e9
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x401b73
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401760
add esp, 4
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
push edx
push 1
push 4
lea eax, [ebp - 0xc]
push eax
call fcn.00406257
add esp, 0x10
cmp dword [ebp - 4], 0
je 0x401b65
mov ecx, dword [ebp - 8]
push ecx
push 1
push 0x590
mov edx, dword [ebp - 4]
push edx
call fcn.00406257
add esp, 0x10
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x58c]
mov dword [ebp - 4], ecx
jmp 0x401b3a
mov edx, dword [ebp - 8]
push edx
call fcn.0040633e
add esp, 4
jmp 0x401b80
push 0x4195e4
call fcn.004063b2
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x401b90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
push 0x4195f4
push str.bookinfo.dat
call fcn.004060e9
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401c51
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
push eax
push 1
push 4
lea ecx, [ebp - 0xc]
push ecx
call fcn.004066b9
add esp, 0x10
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
test edx, edx
je 0x401c43
push 0x590
call fcn.004066d6
add esp, 4
mov dword [ebp - 0x10], eax
push 0x590
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0040b0a0
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
push 1
push 0x590
mov eax, dword [ebp - 0x10]
push eax
call fcn.004066b9
add esp, 0x10
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x58c], 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00401440
add esp, 8
mov dword [ebp - 8], eax
jmp 0x401bd7
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040633e
add esp, 4
jmp 0x401c5e
push 0x419608
call fcn.004063b2
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x401c90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push 0x419618
push 0x41961c
call fcn.004060e9
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x401d13
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401910
add esp, 4
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
push edx
push 1
push 4
lea eax, [ebp - 0xc]
push eax
call fcn.00406257
add esp, 0x10
cmp dword [ebp - 4], 0
je 0x401d05
mov ecx, dword [ebp - 8]
push ecx
push 1
push 0x588
mov edx, dword [ebp - 4]
push edx
call fcn.00406257
add esp, 0x10
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x584]
mov dword [ebp - 4], ecx
jmp 0x401cda
mov edx, dword [ebp - 8]
push edx
call fcn.0040633e
add esp, 4
jmp 0x401d20
push 0x41962c
call fcn.004063b2
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x401d30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
push 0x41963c
push str.recordinfo.dat
call fcn.004060e9
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401df1
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
push eax
push 1
push 4
lea ecx, [ebp - 0xc]
push ecx
call fcn.004066b9
add esp, 0x10
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
test edx, edx
je 0x401de3
push 0x588
call fcn.004066d6
add esp, 4
mov dword [ebp - 0x10], eax
push 0x588
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0040b0a0
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
push 1
push 0x588
mov eax, dword [ebp - 0x10]
push eax
call fcn.004066b9
add esp, 0x10
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x584], 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004017a0
add esp, 8
mov dword [ebp - 8], eax
jmp 0x401d77
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040633e
add esp, 4
jmp 0x401dfe
push 0x419650
call fcn.004063b2
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4077aa
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4077d1
call fcn.00406b4a
mov dword [eax], esi
call fcn.00406b37
push 0x16
pop esi
mov dword [eax], esi
call fcn.004072d3
mov eax, esi
jmp 0x407826
test dword [ebp + 0xc], 0xfffffff9
jne 0x4077b7
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4077fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00406b5d
pop ecx
call fcn.00406b37
mov eax, dword [eax]
jmp 0x407826
test al, 0x10
jne 0x407824
test al, 1
je 0x407824
test byte [ebp + 0xc], 2
je 0x407824
call fcn.00406b4a
mov dword [eax], 5
call fcn.00406b37
mov dword [eax], 0xd
jmp 0x4077f5
xor eax, eax
pop esi
pop ebp
ret

Function at 0x40873d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41d594]
jne 0x408747
repz ret
jmp fcn.0040e27d
Function at 0x4104bf
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41d594]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040cc46
and dword [ebp - 0x14], 0
cmp dword [0x41efb4], 0
mov dword [ebp - 0x18], eax
jne 0x410572
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41061a
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41061a
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x41efb4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x41efb8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x41efbc], eax
call edi
push eax
call esi
mov dword [0x41efc4], eax
test eax, eax
je 0x410572
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x41efc0], eax
mov eax, dword [0x41efc0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4105cb
cmp dword [0x41efc4], ecx
je 0x4105cb
push eax
call esi
push dword [0x41efc4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4105cb
test ebx, ebx
je 0x4105cb
call edi
test eax, eax
je 0x4105c2
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4105c2
test byte [ebp - 8], 1
jne 0x4105cb
or dword [ebp + 0x10], 0x200000
jmp 0x4105fe
mov eax, dword [0x41efb8]
cmp eax, dword [ebp - 0x18]
je 0x4105fe
push eax
call esi
test eax, eax
je 0x4105fe
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4105fe
mov eax, dword [0x41efbc]
cmp eax, dword [ebp - 0x18]
je 0x4105fe
push eax
call esi
test eax, eax
je 0x4105fe
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x41efb4]
call esi
test eax, eax
je 0x41061a
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41061c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040873d
leave
ret