joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433f20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
mov ebp, ecx
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x80]
mov edi, dword [esp + 0x70]
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x34], eax
mov esi, eax
lea eax, [ecx + 0x6c]
mov dword [esp], eax
call method.std::ctype_wchar_t__const_std::use_facet_std.ctype_wchar_t____std::locale_const_
lea eax, [esp + 0x4c]
mov ecx, dword [esp + 0x80]
mov dword [esp], edi
mov dword [esp + 4], ebx
mov dword [esp + 0x1c], 4
mov dword [esp + 0x24], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x18], 0x270f
mov dword [esp + 0x20], ecx
mov dword [esp + 0x14], 0
mov ecx, ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc], esi
mov dword [esp + 0x4c], 0
mov dword [esp + 8], eax
call sym.__ZNKSt7__cxx118time_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE14_M_extract_numES4_S4_RiiijRSt8ios_baseRSt12_Ios_Iosta
sub esp, 0x28
mov bx, dx
mov ebp, eax
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x38], eax
mov edi, edx
mov dword [esp + 0x3c], edx
test ecx, ecx
jne 0x434020
mov ecx, dword [esp + 0x48]
test ecx, ecx
lea esi, [ecx - 0x76c]
js 0x434082
mov ecx, dword [esp + 0x88]
test eax, eax
mov dword [ecx + 0x14], esi
je 0x43402e
cmp dx, 0xffff
mov ecx, edx
je 0x434061
mov eax, dword [esp + 0x30]
mov edi, ecx
test eax, eax
je 0x43400c
cmp word [esp + 0x34], 0xffff
je 0x434090
mov eax, dword [esp + 0x84]
or dword [eax], 2
add esp, 0x5c
mov bx, di
mov eax, ebp
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov esi, dword [esp + 0x84]
or dword [esi], 4
test eax, eax
jne 0x433fe4
mov edx, dword [esp + 0x30]
xor ebp, ebp
test edx, edx
je 0x434002
cmp word [esp + 0x34], 0xffff
mov edx, 1
jne 0x43400c
mov esi, dword [esp + 0x30]
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
jae 0x434094
movzx eax, word [eax]
cmp ax, 0xffff
sete al
cmp al, dl
je 0x434002
jmp 0x43400c
mov edx, dword [eax + 8]
cmp edx, dword [eax + 0xc]
jae 0x4340b0
movzx ecx, word [edx]
cmp cx, 0xffff
je 0x43402e
mov eax, dword [esp + 0x30]
mov edi, ecx
test eax, eax
jne 0x433ff6
jmp 0x43400c
lea esi, [ecx + 0x64]
jmp 0x433fd6
xor edx, edx
jmp 0x434045
mov ecx, dword [esp + 0x30]
mov byte [esp + 0x34], dl
mov eax, dword [ecx]
call dword [eax + 0x24]
movzx edx, byte [esp + 0x34]
jmp 0x434054
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x24]
mov ecx, eax
jmp 0x43406c
Function at 0x4370b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov edx, dword [esp + 0x90]
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x2c], ecx
mov edi, dword [esp + 0x78]
mov ebp, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x34], edx
mov esi, dword [esp + 0x8c]
mov word [esp + 0x28], bx
add eax, 0x6c
mov dword [esp], eax
call method.std::ctype_wchar_t__const_std::use_facet_std.ctype_wchar_t____std::locale_const_
mov ecx, eax
mov eax, dword [esp + 0x84]
mov dword [eax], 0
mov eax, dword [ecx]
mov dword [esp], 0x25
call dword [eax + 0x28]
sub esp, 4
mov edx, dword [esp + 0x34]
mov word [esp + 0x48], ax
test dl, dl
jne 0x4371d0
mov eax, esi
xor edx, edx
movsx si, al
mov word [esp + 0x4c], dx
mov word [esp + 0x4a], si
lea eax, [esp + 0x48]
mov bx, word [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 8], edi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 4], ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sym.__ZNKSt7__cxx118time_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE21_M_extract_via_formatES4_S4_RSt8ios_baseRSt12_Ios_Ios
sub esp, 0x20
test eax, eax
mov bx, dx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov esi, eax
je 0x437201
cmp dx, 0xffff
mov eax, edx
je 0x4371f0
test edi, edi
mov edx, eax
je 0x4371b9
cmp bp, 0xffff
je 0x437230
mov eax, dword [esp + 0x84]
or dword [eax], 2
add esp, 0x5c
mov bx, dx
mov eax, esi
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x24
mov eax, esi
movsx dx, dl
movsx si, al
xor eax, eax
mov word [esp + 0x4a], dx
mov word [esp + 0x4c], si
mov word [esp + 0x4e], ax
jmp 0x437139
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
jae 0x437234
movzx eax, word [eax]
cmp ax, 0xffff
jne 0x43719f
xor esi, esi
test edi, edi
je 0x4371af
cmp bp, 0xffff
jne 0x4371b9
mov ebp, 1
mov eax, dword [edi + 8]
cmp eax, dword [edi + 0xc]
jae 0x437245
movzx eax, word [eax]
cmp ax, 0xffff
mov ecx, ebp
sete al
cmp al, cl
je 0x4371af
jmp 0x4371b9
xor ebp, ebp
jmp 0x437212
mov eax, dword [esi]
mov dword [esp + 0x28], edx
mov ecx, esi
call dword [eax + 0x24]
mov edx, dword [esp + 0x28]
jmp 0x4371fb
mov eax, dword [edi]
mov dword [esp + 0x28], edx
mov ecx, edi
call dword [eax + 0x24]
mov edx, dword [esp + 0x28]
jmp 0x43721d
Function at 0x458980
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x50
mov edi, dword [esp + 0x70]
mov ebx, dword [esp + 0x74]
lea eax, [edi + 0x6c]
mov dword [esp], eax
call method.std::ctype_wchar_t__const_std::use_facet_std.ctype_wchar_t____std::locale_const_
lea eax, [esp + 0x4c]
mov edx, dword [esp + 0x6c]
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], 4
mov dword [esp + 0x18], 0x270f
mov ecx, esi
mov dword [esp + 0x24], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x64]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x4c], 0
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call method.std::time_get_wchar_t__std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t_____._M_extract_num_std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t_____std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t_____int__int__int__unsi
sub esp, 0x28
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x60], eax
movzx eax, word [esp + 0x3c]
mov word [esp + 0x64], ax
mov eax, dword [esp + 0x4c]
test eax, eax
jne 0x458a65
mov eax, dword [esp + 0x48]
test eax, eax
lea edx, [eax - 0x76c]
js 0x458a70
mov eax, dword [esp + 0x78]
mov dword [eax + 0x14], edx
lea ecx, [esp + 0x60]
call method.std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t___._M_get___const
lea ecx, [esp + 0x68]
mov esi, eax
call method.std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t___._M_get___const
cmp si, 0xffff
sete dl
cmp ax, 0xffff
sete al
cmp dl, al
jne 0x458a54
or dword [ebx], 2
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
add esp, 0x50
pop ebx
pop esi
pop edi
ret 0x1c
or dword [ebx], 4
jmp 0x458a2b
lea edx, [eax + 0x64]
jmp 0x458a24
Function at 0x458dc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, ecx
sub esp, 0x8c
mov eax, dword [esp + 0xb0]
mov ebx, dword [esp + 0xb4]
lea ebp, [eax + 0x6c]
mov dword [esp], ebp
call method.std::__timepunct_wchar_t__const_std::use_facet_std.__timepunct_wchar_t____std::locale_const_
mov dword [esp], ebp
mov edi, eax
call method.std::ctype_wchar_t__const_std::use_facet_std.ctype_wchar_t____std::locale_const_
mov eax, dword [edi + 8]
mov dword [esp + 0x44], 0
mov ecx, esi
mov edx, dword [eax + 0x48]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 0x4c]
mov dword [esp + 0x4c], edx
mov edx, dword [eax + 0x50]
mov dword [esp + 0x50], edx
mov edx, dword [eax + 0x54]
mov dword [esp + 0x54], edx
mov edx, dword [eax + 0x58]
mov dword [esp + 0x58], edx
mov edx, dword [eax + 0x5c]
mov dword [esp + 0x5c], edx
mov edx, dword [eax + 0x60]
mov dword [esp + 0x60], edx
mov edx, dword [eax + 0x2c]
mov dword [esp + 0x64], edx
mov edx, dword [eax + 0x30]
mov dword [esp + 0x68], edx
mov edx, dword [eax + 0x34]
mov dword [esp + 0x6c], edx
mov edx, dword [eax + 0x38]
mov dword [esp + 0x70], edx
mov edx, dword [eax + 0x3c]
mov dword [esp + 0x74], edx
mov edx, dword [eax + 0x40]
mov eax, dword [eax + 0x44]
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x44]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xb0]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x48]
mov edx, dword [esp + 0xac]
mov dword [esp + 0x18], 7
mov dword [esp + 0x14], eax
lea eax, [esp + 0x40]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xa4]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xa8]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov eax, dword [esp + 0xa0]
mov dword [esp], eax
call sym.__ZNKSt8time_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE24_M_extract_wday_or_monthES3_S3_RiPPKwjRSt8ios_baseRSt12_Ios_I
sub esp, 0x24
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0xa0], eax
movzx eax, word [esp + 0x3c]
mov word [esp + 0xa4], ax
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x458f30
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0xb8]
mov dword [eax + 0x18], edx
lea eax, [esp + 0xa8]
lea ecx, [esp + 0xa0]
mov dword [esp], eax
call method.std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t___.equal_std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t____const__const
sub esp, 4
test al, al
je 0x458f0e
or dword [ebx], 2
mov eax, dword [esp + 0xa0]
mov edx, dword [esp + 0xa4]
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
or dword [ebx], 4
jmp 0x458eee
Function at 0x471970
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
mov ebp, ecx
push esi
push ebx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov eax, dword [ebp]
mov eax, dword [eax + 0x10]
mov dword [esp], eax
call sym._read
cmp eax, 0xffffffff
mov ebx, eax
je 0x4719b0
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 8
call sym.__errno
cmp dword [eax], 4
je 0x471981
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x17505c20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1752d129
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 8], 0
mov eax, dword [esp + 0x28]
mov eax, dword [eax + 0x14]
push esi
mov esi, dword [eax + 4]
cmp byte [esi + 0xf], 0
push edi
mov edi, eax
mov byte [esp + 0xc], 1
jne 0x17505c7d
mov edi, edi
mov al, byte [ebx]
mov cl, byte [esi + 0xc]
mov edi, esi
cmp cl, al
ja 0x17505d08
mov esi, dword [esi + 8]
mov byte [esp + 0xc], 0
cmp byte [esi + 0xf], 0
je 0x17505c60
mov ecx, dword [esp + 0xc]
push ebx
push ecx
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x3c]
mov ecx, edi
call fcn.17506a40
mov esi, eax
mov edi, 1
mov dword [esp + 0x28], edi
mov ecx, esi
mov edx, ebp
mov dword [ebp], 0
mov dword [ebp + 4], 0
call fcn.17501040
mov eax, dword [esi + 8]
mov dword [ebp + 8], eax
mov byte [ebp + 0xc], 1
push 3
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], edi
mov byte [esp + 0x2c], 0
call fcn.17508240
lea edi, [esp + 0x14]
mov dword [esp + 0x28], 2
call fcn.17501120
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.17508280
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov eax, ebp
mov dword fs:[0], ecx
pop ebp
add esp, 0x20
ret 8
mov esi, dword [esi]
mov byte [esp + 0xc], 1
jmp 0x17505c77
Function at 0x17506090
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x1752d08a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x38], ebx
mov edi, 1
mov dword [esp + 0x30], edi
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
jne 0x175060d0
mov dword [esp + 0x14], ebx
jmp 0x17506154
lea esi, [esp + 0x1c]
mov ecx, ebp
call fcn.17506ee0
mov esi, eax
mov byte [esp + 0x30], 2
mov eax, dword [esp + 0x40]
mov ebx, edi
mov dword [esp + 0x38], ebx
test eax, eax
je 0x175060f4
cmp eax, dword [esi]
je 0x17506149
push 0xfb
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VCinclude_vector
push str.vector_iterators_incompatible
call fcn.17508140
add esp, 0xc
push str.__Standard_C_Libraries_Invalid_Argument___0_
push 0
push 0xfc
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VCinclude_vector
push 2
call fcn.17509560
add esp, 0x14
cmp eax, edi
jne 0x1750612b
int3
push 0
push 0xfc
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VCinclude_vector
push str.std::_Vector_const_iterator_unsigned_char_class_std::allocator_unsigned_char___::_Compat
push str._invalid_argument_
call fcn.17508dd0
add esp, 0x14
mov eax, dword [esp + 0x48]
sub eax, dword [esi + 8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x30], edi
test bl, 1
je 0x1750618b
and ebx, 0xfffffffe
push 3
lea ecx, [esp + 0x1c]
mov dword [esp + 0x3c], ebx
call fcn.17508240
lea edi, [esp + 0x1c]
mov byte [esp + 0x30], 3
call fcn.17501120
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.17508280
mov ecx, dword [esp + 0x4c]
push ecx
push 1
sub esp, 0xc
mov esi, esp
lea ecx, [esp + 0x54]
mov edx, esi
mov dword [esp + 0x60], esp
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.17501040
mov edx, dword [esp + 0x5c]
push ebp
mov dword [esi + 8], edx
call fcn.17506f00
lea esi, [esp + 0x1c]
mov ecx, ebp
call fcn.17506ee0
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x30], 4
mov esi, dword [esp + 0x3c]
push ecx
push esi
mov ecx, eax
call fcn.17507330
or ebx, 2
push 3
lea ecx, [esp + 0x50]
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x34], 1
call fcn.17508240
lea edi, [esp + 0x1c]
mov byte [esp + 0x30], 5
call fcn.17501120
lea ecx, [esp + 0x4c]
mov byte [esp + 0x30], 1
call fcn.17508280
push 3
lea ecx, [esp + 0x50]
mov byte [esp + 0x34], 0
call fcn.17508240
lea edi, [esp + 0x40]
mov dword [esp + 0x30], 6
call fcn.17501120
lea ecx, [esp + 0x4c]
mov byte [esp + 0x30], 0
call fcn.17508280
mov ecx, dword [esp + 0x28]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 0x18
Function at 0x1750d0d0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1753a32c]
jne 0x1750d0da
repz ret
jmp fcn.1751a570
Function at 0x4076a2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x470824]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x4076fb
cmp byte [esi + 0x3d], bl
je 0x4076fb
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x407734
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, ebx
je 0x40770c
sub eax, 1
je 0x40770f
dec eax
sub eax, 1
jne 0x407734
mov byte [esi + 0x3d], bl
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042dc3d
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40772c
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00435022
add esp, 0x10
cmp edi, eax
jne 0x407734
cmp byte [esi + 0x3d], bl
sete al
jmp 0x4076fd
xor al, al
jmp 0x4076fd

Function at 0x4092b8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x470824]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x4092de
xor eax, eax
jmp 0x4093a4
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x409307
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x409307
dec dword [edx]
mov eax, ebx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x4093a4
cmp dword [esi + 0x4c], 0
je 0x4093a2
mov ecx, esi
call fcn.004083dd
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x409333
push dword [esi + 0x4c]
push eax
call fcn.00405faa
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x4093a2
mov byte [ebp - 0x28], al
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x409371
sub eax, 1
je 0x409371
dec eax
sub eax, 1
jne 0x4093a2
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x409325
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x409394
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call fcn.00435022
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x4093a2
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x4093a4
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042dc3d
leave
ret 4
Function at 0x409928
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
test esi, esi
jg 0x40994a
jl 0x409941
test ebx, ebx
jne 0x40994a
xor eax, eax
xor edx, edx
jmp 0x409a0e
cmp dword [ecx + 0x38], 0
je 0x40995f
push esi
push ebx
push dword [ebp + 8]
call fcn.00409a14
jmp 0x409a0e
mov eax, dword [ecx + 0x1c]
push edi
mov edi, ebx
mov edx, dword [eax]
test edx, edx
je 0x4099a3
mov eax, dword [ecx + 0x2c]
cmp dword [eax], 0
jbe 0x4099a3
cmp dword [eax], ebx
mov esi, ebx
mov edi, dword [ebp + 8]
cmovb esi, dword [eax]
push esi
push edx
push edi
call fcn.0042f520
mov ecx, dword [ebp - 4]
add edi, esi
mov dword [ebp + 8], edi
add esp, 0xc
mov edi, ebx
sub edi, esi
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0x10]
jmp 0x4099a9
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
cmp dword [ecx + 0x4c], 0
je 0x409a04
call fcn.004083dd
mov ecx, dword [ebp + 8]
mov edx, edi
cmp edi, 0xfff
jbe 0x4099ec
mov eax, dword [ebp - 4]
push dword [eax + 0x4c]
push 0xfff
push 1
push ecx
call fcn.0043499b
mov ecx, dword [ebp + 8]
sub edi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp + 8], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x409a04
jmp 0x4099b9
test edx, edx
je 0x409a04
mov eax, dword [ebp - 4]
push dword [eax + 0x4c]
push edi
push 1
push ecx
call fcn.0043499b
add esp, 0x10
sub edi, eax
sub ebx, edi
mov eax, ebx
sbb esi, 0
mov edx, esi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x409af0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x409b12
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00409bd5
jmp 0x409bd0
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
test ecx, ecx
je 0x409b38
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x409b3d
xor ecx, ecx
mov dword [ebp - 8], eax
mov eax, ecx
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x409b9d
jg 0x409b52
test esi, esi
je 0x409b9d
test ecx, ecx
jl 0x409b98
jg 0x409b5c
test eax, eax
je 0x409b98
cmp edi, ecx
jg 0x409b6e
jl 0x409b66
cmp esi, eax
jae 0x409b6e
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 0xc]
call fcn.0042f520
mov eax, dword [ebp - 8]
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [ebp - 4]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x409ba0
mov ecx, dword [ebp + 8]
jmp 0x409baa
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x409bc4
jg 0x409baa
test esi, esi
je 0x409bc4
cmp dword [ebx + 0x4c], 0
je 0x409bc4
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00435022
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40a1e8
Capabilities:
Read file via mapping
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x470824]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
xor edi, edi
inc edi
cmp word [0x47b298], 0
jne 0x40a2fb
mov esi, str.ENGINE_DATA
lea edi, [ebp - 0x18]
lea ecx, [ebp - 0x18]
lea edx, [ecx + 1]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a220
sub ecx, edx
movsx eax, cx
mov byte [ebp + eax - 0x18], 0x31
inc eax
cmp eax, 0x14
jae 0x40a3fa
mov esi, str.Local_
mov byte [ebp + eax - 0x18], 0
lea edi, [ebp - 0x38]
lea edx, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x40a251
lea edi, [ebp - 0x38]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40a25e
mov ecx, edx
lea eax, [ebp - 0x38]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
push 0x1e8480
push 0
push 4
mov ecx, edx
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [0x47b208], eax
test eax, eax
je 0x40a3b7
xor ecx, ecx
push ecx
push ecx
push ecx
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x47b210], eax
test eax, eax
jne 0x40a2de
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x454e1b
push 0x454e21
push 0x47a9ac
push 0x47b254
push str.could_not_setup_MapViewOfFile
mov word [0x47b218], ax
push 0x454fb0
jmp 0x40a3e1
lea ecx, [eax + 4]
xor edi, edi
add eax, 8
mov dword [0x47b290], ecx
inc edi
mov dword [0x47b294], eax
mov word [0x47b298], di
jmp 0x40a301
mov ecx, dword [0x47b290]
mov esi, dword [ebp + 0xc]
cmp esi, 0x1e8480
jbe 0x40a33e
push 0x454e22
push 0x454e23
push 0x47a9ac
push 0x47b254
push str.message_size_too_large
push 0x454fd0
push 0
push 0
push edi
push 0x47a89e
call fcn.0040ce4c
add esp, 0x28
jmp 0x40a3a8
mov dword [ecx], esi
test ebx, ebx
jne 0x40a372
push 0x454e33
push 0x454e51
push 0x47a9ac
push 0x47b254
push str.data_buff_is_0_size___if_during_autozoning_this_is_indicates_inability_to_zone_image
push 0x455030
push ebx
push ebx
push edi
push 0x47a89e
call fcn.0040ce4c
add esp, 0x28
push esi
push ebx
push dword [0x47b294]
call fcn.0042f520
mov eax, dword [0x47b210]
add esp, 0xc
cmp word [ebp + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
je 0x40a3a8
test ecx, ecx
je 0x40a3a8
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x47b210]
cmp dword [eax], 0
jne 0x40a397
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042dc3d
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x454e19
push 0x454e1a
push 0x47a9ac
push 0x47b254
push str.could_not_create_OCRDATA_file_handle
mov word [0x47b218], ax
push 0x454f88
xor ebx, ebx
push ebx
push ebx
push 1
push 0x47a89e
call fcn.0040ce4c
add esp, 0x28
push ebx
call fcn.00432e84
call fcn.0042db62
int3