joyce8/EMBER2024-capa huggingface dataset:
Function at 0x17d1cf0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x13fb015
lea edi, [esi - 0xffa015]
lea eax, [edi + 0x104dc88]
push dword [eax]
mov dword [eax], 0x789cb1ee
push eax
push edi
jmp 0x17d1d1a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x17d1d21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x17d1d10
mov eax, 1
add ebx, ebx
jne 0x17d1d33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x17d1d44
jne 0x17d1d63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x17d1d63
dec eax
add ebx, ebx
jne 0x17d1d50
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x17d1d28
add ebx, ebx
jne 0x17d1d5f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x17d1db5
xor ecx, ecx
sub eax, 3
jb 0x17d1d7b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x17d1dea
sar eax, 1
mov ebp, eax
jmp 0x17d1d86
add ebx, ebx
jne 0x17d1d86
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x17d1d54
inc ecx
add ebx, ebx
jne 0x17d1d94
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x17d1d54
add ebx, ebx
jne 0x17d1da1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x17d1d96
jne 0x17d1db2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x17d1d96
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x17d1dd4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x17d1dc6
jmp 0x17d1d16
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x17d1dd4
add edi, ecx
jmp 0x17d1d16
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x6962
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x17d1df6
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x17d1dfb
lea edi, [esi + 0x13cc000]
mov eax, dword [edi]
or eax, eax
je 0x17d1e6c
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x142e818]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x142e920]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x17d1e21
mov ecx, edi
jns 0x17d1e50
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x142e928]
or eax, eax
je 0x17d1e66
mov dword [ebx], eax
add ebx, 4
jmp 0x17d1e3e
call dword [esi + 0x142e924]
mov ebp, dword [esi + 0x142e92c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x17d1ea0
sub esp, 0xffffff80
jmp 0x64cd80
Function at 0x401bca
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.00402c93
push str.ERROR_
call fcn.00402c93
mov eax, dword [0x4690e4]
call fcn.00402aff
cmp dword [0x468dce], 0
je 0x401c06
push str._IN_LINE
call fcn.00402c93
mov eax, dword [0x468dce]
call fcn.00402aff
push 0x4680b9
call fcn.00402c93
mov edx, str.SUCCESS__not_actually_an_error_
mov eax, dword [0x4690e4]
test eax, eax
je 0x401d81
mov edx, str.INVALID_FUNCTION_NUMBER
dec eax
je 0x401d81
mov edx, str.FILE_NOT_FOUND
dec eax
je 0x401d81
mov edx, str.PATH_NOT_FOUND
dec eax
je 0x401d81
mov edx, str.TOO_MANY_OPEN_FILES
dec eax
je 0x401d81
mov edx, str.ACCESS_DENIED
dec eax
je 0x401d81
mov edx, str.INVALID_HANDLE
dec eax
je 0x401d81
mov edx, str.NOT_ENOUGH_MEMORY
sub eax, 2
je 0x401d81
mov edx, str.BAD_LOAD_FORMAT
sub eax, 3
je 0x401d81
mov edx, str.INVALID_ACCESS
dec eax
je 0x401d81
mov edx, str.INVALID_DATA
dec eax
je 0x401d81
mov edx, str.OUT_OF_MEMORY
dec eax
je 0x401d81
mov edx, str.INVALID_DRIVE
dec eax
je 0x401d81
mov edx, str.CANT_DELETE_CURRENT_DIRECTORY
dec eax
je 0x401d81
mov edx, str.CANT_MOVE_TO_DIFFERENT_DEVICE
dec eax
je 0x401d81
mov edx, str.NO_MORE_FILES_AVAILABLE
dec eax
je 0x401d81
mov edx, str.MEDIA_IS_WRITE_PROTECTED
dec eax
je 0x401d81
mov edx, str.THE_SYSTEM_CANNOT_FIND_THE_DEVICE_SPECIFIED
dec eax
je 0x401d81
mov edx, str.DEVICE_NOT_READY
dec eax
je 0x401d81
mov edx, str.BAD_COMMAND
dec eax
je 0x401d81
mov edx, str.CRC_DATA_ERROR
dec eax
je 0x401d81
mov edx, str.BAD_COMMAND_LENGTH
dec eax
je 0x401d81
mov edx, str.SEEK_ERROR
dec eax
je 0x401d81
mov edx, str.NOT_A_DOS_FORMATTED_DISK
dec eax
je 0x401d81
mov edx, str.SECTOR_NOT_FOUND
dec eax
je 0x401d81
mov edx, str.WRITE_FAULT
sub eax, 2
je 0x401d81
mov edx, str.READ_FAULT
dec eax
je 0x401d81
mov edx, str.GENERAL_FAILURE
dec eax
je 0x401d81
mov edx, str.SHARING_VIOLATION
dec eax
je 0x401d81
mov edx, str.LOCK_VIOLATION
dec eax
je 0x401d81
mov edx, str.WRONG_DISK_IN_DRIVE__disk_change_was_invalid_
dec eax
je 0x401d81
mov edx, str.TOO_MANY_SHARED_FILES
sub eax, 2
je 0x401d81
mov edx, str.REACHED_EOF
sub eax, 2
je 0x401d81
mov edx, str.DISK_FULL
dec eax
je 0x401d81
mov edx, 0x468351
push ecx
push 0xffff
push edx
call fcn.00401000
push 0
push 0x468d58
push eax
push edx
push dword [0x468d68]
call sub.KERNEL32.dll_WriteFile
pop ecx
mov eax, dword [0x468d58]
call fcn.00402ccc
jmp 0x4166f5
Function at 0x401e33
Capabilities:
Write file on windows

Disassembly:
push eax
push ebx
push edi
pushfd
mov ebx, dword [0x4fd0aa]
cmp ebx, 0x200
jae 0x401e87
mov edi, dword [0x4fb09a]
mov dword [ebx*4 + 0x4fb0aa], edi
add ebx, 1
mov dword [0x4fd0aa], ebx
sub eax, eax
mov ecx, 0xffff
repne scasb al, byte es:[edi]
mov eax, 0xffff
sub eax, ecx
test eax, 1
je 0x401e75
add eax, 1
add eax, dword [0x4fb09a]
cmp eax, dword [0x4fd0ae]
jl 0x4020c9
popfd
push dword [0x468dd6]
mov eax, dword [0x469140]
mov dword [0x468dd6], eax
push ecx
push 0xffff
push str._r_nSTRING_MEMORY_OVERFLOW_r_n
call fcn.00401000
push 0
push 0x468d58
push eax
push str._r_nSTRING_MEMORY_OVERFLOW_r_n
push dword [0x469140]
call sub.KERNEL32.dll_WriteFile
pop ecx
mov eax, dword [0x468d58]
push ecx
push 0xffff
push str.Total__of_defined_strings_
call fcn.00401000
push 0
push 0x468d58
push eax
push str.Total__of_defined_strings_
push dword [0x469140]
call sub.KERNEL32.dll_WriteFile
pop ecx
mov eax, dword [0x468d58]
mov eax, dword [0x4fd0aa]
call fcn.00402aff
push ecx
push 0xffff
push str._r_nList_of_strings:_r_n
call fcn.00401000
push 0
push 0x468d58
push eax
push str._r_nList_of_strings:_r_n
push dword [0x469140]
call sub.KERNEL32.dll_WriteFile
pop ecx
mov eax, dword [0x468d58]
sub ecx, ecx
push ecx
push ecx
push ecx
push ecx
push 0xffff
push 0x4683cf
call fcn.00401000
push 0
push 0x468d58
push eax
push 0x4683cf
push dword [0x469140]
call sub.KERNEL32.dll_WriteFile
pop ecx
mov eax, dword [0x468d58]
pop eax
call fcn.00402aff
push ecx
push 0xffff
push str.__len
call fcn.00401000
push 0
push 0x468d58
push eax
push str.__len
push dword [0x469140]
call sub.KERNEL32.dll_WriteFile
pop ecx
mov eax, dword [0x468d58]
pop ebx
mov edi, dword [ebx*4 + 0x4fb0aa]
push edi
push ebx
push edi
sub eax, eax
mov ecx, 0xffff
repne scasb al, byte es:[edi]
mov eax, 0xffff
sub eax, ecx
call fcn.00402aff
push ecx
push 0xffff
push str.__max
call fcn.00401000
push 0
push 0x468d58
push eax
push str.__max
push dword [0x469140]
call sub.KERNEL32.dll_WriteFile
pop ecx
mov eax, dword [0x468d58]
pop edi
pop ebx
add ebx, 1
mov eax, dword [ebx*4 + 0x4fb0aa]
sub eax, edi
call fcn.00402aff
push ecx
push 0xffff
push str.____
invalid

Function at 0x4021b3
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
push edx
push esi
mov ebx, dword [ebp + 8]
sub edx, edx
call sub.KERNEL32.dll_GetCommandLineA
mov esi, eax
cmp dword [0x468dda], 0
add byte [ebp + 5], dh

Function at 0x40260e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov dword [0x4690e4], 0
inc esi
add byte [eax], al
add byte [eax], al
add byte [ebx + 0x5d030c5d], cl
adc byte [ebx + 0x3c601eb], al
add esi, eax
add eax, dword [eax]

Function at 0x402880
Capabilities:
Write file on windows

Disassembly:
mov ecx, 0x20
sub ebx, ebx
cmp dword [ebx*4 + 0x4fd0b2], 0
jne 0x402899
add ebx, 1
sub ecx, 1
jne 0x402887
test ecx, ecx
je 0x40290c
outsd dx, dword [esi]
push 0
push 0x468d58
push 0x20
push str._NOTICE:_auto_closing_handle_s_
push dword [0x468dd6]
ret
Function at 0x402ccc
Capabilities:
Write file on windows

Disassembly:
push esi
push 0
push 0x468d58
push 2
push 0x468001
push dword [0x468dd6]
call sub.KERNEL32.dll_WriteFile
mov eax, dword [0x468d58]
pop esi
ret

Function at 0x404c61
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x468d68]
mov dword [esi], eax
add esi, 4
mov eax, dword [ebp + 8]
mov ecx, 0x10
shl eax, cl
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
and eax, 0xffff
or dword [esi], eax
push dword [esi]
push dword [esi - 4]
call sub.KERNEL32.dll_SetConsoleCursorPosition
sub esi, 4
leave
ret 8

Function at 0x404c95
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push 0x4e9744
push dword [0x468d68]
call sub.KERNEL32.dll_GetConsoleScreenBufferInfo
mov eax, dword [0x468d68]
mov dword [esi], eax
add esi, 4
movzx eax, word [0x4e974a]
mov ecx, 0x10
shl eax, cl
mov dword [esi], eax
mov eax, dword [ebp + 8]
and eax, 0xffff
or dword [esi], eax
push dword [esi]
push dword [esi - 4]
call sub.KERNEL32.dll_SetConsoleCursorPosition
sub esi, 4
leave
ret 4

Function at 0x404e57
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jle 0x404ea9
mov eax, 8
mov dword [esi], eax
add esi, 4
push 0xffff
push str.GET_STRING_ARRAY_BOUNDARY_OVERFLOW
push dword [0x4fb09a]
call fcn.00402d7b
sub esi, 4
mov dword [0x468dce], 0x52f
push dword [0x4fb09a]
push dword [esi]
call fcn.00401de2
mov esi, 0x468de0
jmp 0x4166f5
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov eax, dword [ebx]
cmp eax, 0xffffffff
je 0x404eca
test ecx, ecx
je 0x404eca
add ebx, eax
add ebx, 4
or ebx, 3
add ebx, 1
sub ecx, 1
jmp 0x404eaf
mov dword [ebp + 0x10], ebx
mov dword [ebp + 8], ecx
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebx]
cmp eax, 0xffffffff
jne 0x404f03
mov eax, 0
mov dword [0x4690e0], eax
push 0xffff
push dword [0x4e968c]
push dword [0x4fb09a]
call fcn.00402d7b
mov eax, dword [0x4fb09a]
leave
ret 0xc
mov eax, dword [ebp + 0x10]
add eax, 4
mov dword [0x4690e0], eax
leave
ret 0xc

Function at 0x407353
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 0x810
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
add eax, 0x408
mov dword [ebp - 0x10], eax
add eax, 0x408
mov eax, 1
mov dword [0x4692e8], eax
Function at 0x40939e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push 0x1428
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], eax
add eax, 0x408
add al, 0
add byte [ecx + 0x805e845], cl
call 0x449bc7
add byte [ecx + 0x805e445], cl
add al, 0
add byte [ecx + 0x805e045], cl
add al, 0
add byte [ecx + 0x805dc45], cl
add al, 0
invalid
mov ebx, dword [0x4e96c0]
movzx eax, byte [ebx]
sub edx, edx
mov ecx, 0x20
cmp ecx, eax
je 0x4093f6
mov ecx, 9
cmp ecx, eax
jne 0x4093ff
call fcn.004090a8
push 0xffff
push dword [0x4e96c0]
push dword [0x4fb09a]
call fcn.00402d7b
push 0xffff
push dword [0x4fb09a]
call fcn.00402f8e
push 0x404
push dword [0x4fb09a]
push dword [0x4e96c4]
call fcn.00402d7b
push 0x404
push dword [0x4e968c]
push dword [ebp - 0x14]
call fcn.00402d7b
push 0xffff
push dword [0x4e96c0]
push dword [0x4fb09a]
call fcn.00402d7b
push 2
push 0xffff
push 0x45b6e8
push dword [0x4fb09a]
call fcn.00403008
jne 0x4094c0
push 0xffff
push dword [0x4e9690]
push dword [0x4fb09a]
call fcn.00402d7b
mov eax, dword [0x469158]
mov dword [esi], eax
mov eax, 1
add dword [esi], eax
mov dword [esi + 4], 1
push 0xffff
push dword [esi + 4]
push dword [esi]
push dword [0x4fb09a]
push dword [ebp - 0x14]
call fcn.00402ee1
push 0xffff
push dword [0x4e96c0]
push dword [0x4fb09a]
call fcn.00402d7b
sub edx, edx
push 2
push 0xffff
push 0x45b6ea
push dword [0x4fb09a]
call fcn.00403008
jne 0x4094f4
or edx, 1
mov dword [esi], edx
add esi, 4
push 0xffff
push dword [ebp - 0x14]
push dword [0x4fb09a]
call fcn.00402d7b
sub edx, edx
push 2
push 0xffff
push 0x45b6ec
push dword [0x4fb09a]
call fcn.00403008
jne 0x40952a
sub esi, 4
and dword [esi], edx
je 0x40955e
call fcn.004090a8
push 0x404
push 0x45b6ee
push dword [0x4e96c0]
call fcn.00402d7b
push 0x404
push dword [0x4e968c]
push dword [ebp - 0x14]
call fcn.00402d7b
push 0x104
push dword [0x4e968c]
dec esi
add bh, bh
xor eax, 0x4e96bc
call fcn.00402d7b
mov ebx, dword [0x4e96c0]
movzx eax, byte [ebx]
sub edx, edx
mov ecx, 0x30
cmp eax, ecx
jl 0x40959c
mov ecx, 0x39
cmp eax, ecx
jg 0x409595
sub ecx, ecx
jmp 0x40959a
mov ecx, 1
test ecx, ecx
je 0x40959e
jne 0x4095a3
or edx, 1
mov dword [esi], edx
add esi, 4
push 0xffff
push dword [0x4e96c0]
push dword [0x4fb09a]
call fcn.00402d7b
mov ebx, dword [0x4fb09a]
movzx eax, byte [ebx]
mov dword [esi], eax
mov eax, 0x2e
sub edx, edx
cmp dword [esi], eax
jne 0x4095d7
or edx, 1
mov dword [esi], edx
add esi, 4
push 0xffff
push dword [ebp - 0x14]
push dword [0x4fb09a]
call fcn.00402d7b
mov ebx, dword [0x4fb09a]
movzx eax, byte [ebx]
sub edx, edx
mov ecx, 0x30
cmp eax, ecx
jl 0x409617
mov ecx, 0x39
cmp eax, ecx
jg 0x409610
sub ecx, ecx
jmp 0x409615
mov ecx, 1
test ecx, ecx
je 0x409619
jne 0x40961e
or edx, 1
sub esi, 4
mov eax, dword [esi]
and eax, edx
sub esi, 4
or dword [esi], eax
je 0x409a76
push 0x404
push 0x45b6f1
invalid

Function at 0x40c769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0xffff
push dword [0x4e9694]
push dword [0x4fb09a]
dec edi
add al, ch
mul byte [ebp - 1]
invalid
call fcn.00401e33
push 0xffff
push 0x45ba16
Function at 0x41034d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push 0x1428
push 0x40
inc eax

Function at 0x41189e
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
mov edi, 0x468de0
mov ecx, 0x4fd5d0
sub ecx, edi
sub ecx, 4
shr ecx, 2
sub eax, eax
sal bl, 0xab
push 0x20000
push 0
call sub.KERNEL32.dll_GlobalAlloc
mov dword [0x468800], eax
test eax, eax
jne 0x4118e8
call fcn.004598de
invalid
pushal
invalid

Function at 0x420e28
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
call fcn.00401e33
mov eax, dword [ebp + 8]
push eax
push 0xffff
push 0x460004
push dword [0x4fb09a]
call fcn.00402d7b
mov ecx, dword [0x4fb09a]
mov dword [esi], ecx
add esi, 4
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
push 0xffff
push dword [0x4e968c]
push dword [0x4fb09a]
call fcn.00402d7b
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
call fcn.0040631b
sub esi, 4
mov ecx, dword [esi]
mov dword [0x4fb09a], ecx
invalid
xor dl, byte [edx]

Function at 0x421467
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
mov eax, dword [ebp + 8]
mov dword [esi], eax
cmp dword [esi], 0x3e8
jl 0x421489
mov dword [0x468dce], 0x8b6
jmp fcn.00401db5
mov eax, dword [esi]
mov ecx, 0x48
add bh, dh
loope 0x421498
pop edx
xchg edi, eax
dec esi
invalid
mov edi, eax
mov eax, dword [edi]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, 0xb
sub edx, edx
cmp dword [esi], eax
jne 0x4214b1
or edx, 1
mov dword [esi], edx
add esi, 4
mov eax, dword [ebp + 8]
mov dword [esi], eax
cmp dword [esi], 0x3e8
add byte [eax], al
jl 0x4214d2
mov dword [0x468dce], 0x8b7
jmp fcn.00401db5
mov eax, dword [esi]
mov ecx, 0x48
mul ecx
add eax, 0x4e975a
mov edi, eax
mov eax, dword [edi + 0x14]
mov dword [esi], eax
sub eax, eax
sub edx, edx
cmp dword [esi], eax
jne 0x4214f2
or edx, 1
sub esi, 4
and dword [esi], edx
je 0x42151a
push 0xffff
push dword [ebp + 0xc]
push dword [0x4fb09a]
call fcn.00402d7b
mov eax, dword [0x4fb09a]
leave
ret 8
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, 3
sub edx, edx
cmp dword [esi], eax
jne 0x42152d
invalid

Function at 0x421716
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push 0x1c38
push 0x40
invalid

Function at 0x423504
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push 0x1020
push 0x40
invalid
invalid

Function at 0x4265a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push 0x1428
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x18], eax
add eax, 0x408
mov dword [ebp - 0x1c], eax
add eax, 0x408
mov dword [ebp - 0x20], eax
add eax, 0x408
mov dword [ebp - 0x24], eax
add eax, 0x408

Function at 0x42b91c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0x408
push 0x40
invalid
invalid
invalid
Function at 0x42d5ff
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 0x408
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
add eax, 0x408
mov dword [0x468dca], 0xffffffff
push 0xffff
push str.NOFILE.___
push dword [0x4fb09a]
call fcn.00402d7b
mov dword [esi], 1
invalid
invalid
into

Function at 0x42df8b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push 0x408
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x18], eax
invalid

Function at 0x42ebd2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
invalid
and byte [eax], dl

Function at 0x43096b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0x408
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
add eax, 0x408
call fcn.0040939e

Function at 0x43181d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push 0x1020
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x1c], eax

Function at 0x435077
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push 0x1020
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], eax
add eax, 0x408
mov dword [ebp - 0x30], eax
add eax, 0x408
mov dword [ebp - 0x34], eax
add eax, 0x408
mov dword [ebp - 0x38], eax
add eax, 0x408
push 0x404
push dword [0x4e968c]
push dword [ebp - 0x2c]
call fcn.00402d7b
sub eax, eax
mov dword [ebp - 0x10], eax
mov eax, 0
mov dword [ebp - 0x14], eax
mov eax, 0
mov dword [ebp - 0x1c], eax
mov eax, 0
mov dword [ebp - 0x20], eax
push 0xffff
push dword [0x4e9694]
push dword [0x4fb09a]
call fcn.00402d7b
push 2
push 0xffff
push 0x462b43
Function at 0x43d5e7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push 0x408
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
add eax, 0x408
push 0xffff
push dword [0x4e9694]
push dword [0x4fb09a]
call fcn.00402d7b
push 4
push 0xffff
push 0x4639f8
push dword [0x4fb09a]
call fcn.00403008
jne 0x43d862
call fcn.0040939e
push 0xffff
push dword [0x4e9694]
push dword [0x4fb09a]
call fcn.00402d7b
push 6
push 0xffff
push 0x4639fc
push dword [0x4fb09a]
call fcn.00403008
je 0x43d6c5
call fcn.00401e33
mov dword [esi], 0x7530
mov eax, 0xab6
add dword [esi], eax
push dword [esi]
push 0xffff
push 0x463a02
push dword [0x4fb09a]
call fcn.00402d7b
mov ecx, dword [0x4fb09a]
mov dword [esi], ecx
add esi, 4
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
call fcn.0042d5ff
sub esi, 4
mov ecx, dword [esi]
mov dword [0x4fb09a], ecx
call fcn.004020d3
push 0x404
push dword [0x4e9698]
push dword [ebp - 8]
call fcn.00402d7b
push esi
cld
invalid
mov eax, 1
push eax
call fcn.0042ebd2
mov eax, dword [0x4691d4]
mov dword [ebp - 4], eax
mov eax, 0x20
mov dword [0x4691d4], eax
mov eax, dword [0x469198]
mov dword [esi], eax
cmp dword [esi], 0x3e8
jl 0x43d713
mov dword [0x468dce], 0xab9
jmp fcn.00401db5
mov eax, dword [esi]
push eax
push dword [ebp - 0xc]
call sub.KERNEL32.dll_GlobalFree
pop eax
leave
ret
Function at 0x43f58e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0x408
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
add eax, 0x408
mov eax, 0
mov dword [ebp - 4], eax
push 0xffff
push dword [0x4e9694]
xchg esi, eax
dec esi
add bh, bh
xor eax, 0x4fb09a
call fcn.00402d7b
push 6
push 0xffff
push 0x463ee1
push dword [0x4fb09a]
call fcn.00403008
jne 0x43f738
mov eax, 1
mov dword [0x4692c4], eax
mov eax, 1
mov dword [0x4692c8], eax
mov eax, 1
push eax
call fcn.0042ebd2
mov eax, 0
mov dword [0x4692c4], eax
mov eax, 0
mov dword [0x4692c8], eax
mov eax, dword [0x469198]
mov dword [esi], eax
cmp dword [esi], 0x3e8
jl 0x43f637
mov dword [0x468dce], 0xb8a
jmp fcn.00401db5
mov eax, dword [esi]
mov ecx, 0x48
mul ecx
add eax, 0x4e975a
mov edi, eax
mov eax, dword [edi]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
sub edx, edx
mov ecx, 0xb
cmp ecx, eax
je 0x43f673
mov ecx, 0x1d
cmp ecx, eax
je 0x43f673
mov ecx, 0x24
cmp ecx, eax
je 0x43f673
mov ecx, 0x14
cmp ecx, eax
jne 0x43f6de
mov eax, dword [ebp + 8]
test eax, eax
je 0x43f6d7
mov eax, dword [0x469140]
mov dword [0x468dd6], eax
push dword [0x4e969c]
call fcn.00402c93
push 0x463ee7
call fcn.00402c93
push dword [0x4e9698]
call fcn.00402c93
push 0x463eec
call fcn.00402c93
mov eax, 1
push eax
call fcn.0040713b
push eax
call fcn.00402c93
call fcn.00402ccc
mov eax, dword [0x468d68]
mov dword [0x468dd6], eax
call fcn.0040939e
jmp 0x43f6dc
call fcn.0043ec10
jmp 0x43f733
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov eax, 8
sub edx, edx
cmp dword [esi], eax
jne 0x43f6f1
or edx, 1
mov dword [esi], edx
add esi, 4
mov eax, dword [0x4691d4]
mov dword [esi], eax
add esi, 4
mov eax, 0x10
sub esi, 4
sub edx, edx
cmp dword [esi], eax
jne 0x43f711
or edx, 1
sub esi, 4
and dword [esi], edx
je 0x43f72a
mov eax, 0x20
mov dword [0x4691d4], eax
mov eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.0043dff7
jmp 0x43f81f
call fcn.00401e33
push 0xffff
push dword [0x4e9694]
push dword [0x4fb09a]
call fcn.00402d7b
mov ecx, dword [0x4fb09a]
mov dword [esi], ecx
add esi, 4
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
push 0xffff
push 0x4617e5
push dword [0x4fb09a]
call fcn.00402d7b
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
call fcn.004072c8
sub esi, 4
mov ecx, dword [esi]
mov dword [0x4fb09a], ecx
call fcn.004020d3
test eax, eax
je 0x43f816
mov eax, dword [ebp + 8]
test eax, eax
je 0x43f80f
call fcn.00401e33
mov dword [esi], 0x7530
mov eax, 0xb9a
add dword [esi], eax
push dword [esi]
push 0xffff
push str.PROC_FUNC_based_indirection_not_supported_for_STRINGS___use_____instead
push dword [0x4fb09a]
call fcn.00402d7b
mov ecx, dword [0x4fb09a]
mov dword [esi], ecx
add esi, 4
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
call fcn.0042d5ff
sub esi, 4
mov ecx, dword [esi]
mov dword [0x4fb09a], ecx
call fcn.004020d3
call fcn.0043ec10
jmp 0x43f81f
mov eax, dword [ebp + 8]
push eax
call fcn.0043dff7
invalid