joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402155
Capabilities:
Delete file
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x4150f0]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x198]
test edi, edi
mov dword [ebp + 0x18c], eax
je 0x40231d
cmp byte [edi], 0
je 0x40231d
mov esi, dword [ebp + 0x19c]
test esi, esi
je 0x40231d
cmp byte [esi], 0
je 0x40231d
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4021c3
test cl, cl
je 0x4021bf
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4021c3
inc eax
inc eax
inc esi
inc esi
test cl, cl
jne 0x4021a1
xor eax, eax
jmp 0x4021c8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40231d
push edi
lea eax, [ebp + 0x88]
push str._s.___
push eax
call fcn.0040627d
push edi
lea eax, [ebp - 0x7c]
push 0x411350
push eax
call fcn.0040627d
mov ebx, 0x4112bc
lea eax, [ebp + 0x88]
push ebx
push eax
call fcn.0040668b
add esp, 0x20
test eax, eax
mov dword [ebp - 0x80], eax
jne 0x402211
push 2
jmp 0x402240
mov esi, 0x41123c
push esi
push edi
call fcn.0040668b
pop ecx
mov edi, eax
test edi, edi
pop ecx
push dword [ebp - 0x80]
jne 0x402232
call fcn.004065de
pop ecx
push 3
jmp 0x402240
push edi
call fcn.004017f0
test eax, eax
pop ecx
pop ecx
jne 0x402246
push 4
pop eax
jmp 0x402320
push dword [ebp - 0x80]
call fcn.004065de
push edi
call fcn.004065de
push 5
pop edi
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.0040668b
mov ebx, eax
lea eax, [ebp + 0x88]
push esi
push eax
call fcn.0040668b
push esi
push dword [ebp + 0x19c]
mov dword [ebp - 0x80], eax
call fcn.0040668b
add esp, 0x20
test ebx, ebx
mov esi, eax
je 0x4022ae
cmp dword [ebp - 0x80], 0
je 0x4022b7
test esi, esi
je 0x4022b1
push ebx
push esi
push dword [ebp - 0x80]
call fcn.00401b22
mov edi, eax
add esp, 0xc
add eax, 0x989680
neg edi
sbb edi, edi
and edi, eax
jmp 0x4022c1
push 6
pop edi
cmp dword [ebp - 0x80], 0
jne 0x4022ba
push 7
pop edi
test esi, esi
jne 0x4022c1
push 8
pop edi
test ebx, ebx
je 0x4022cc
push ebx
call fcn.004065de
pop ecx
cmp dword [ebp - 0x80], 0
je 0x4022db
push dword [ebp - 0x80]
call fcn.004065de
pop ecx
test esi, esi
je 0x4022e6
push esi
call fcn.004065de
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp + 0x88]
push eax
call esi
test edi, edi
je 0x402301
lea eax, [ebp - 0x7c]
push eax
call esi
jmp 0x402319
push dword [ebp + 0x198]
call esi
push dword [ebp + 0x198]
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov eax, edi
jmp 0x402320
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x18c]
pop edi
pop esi
pop ebx
call fcn.004068c2
add ebp, 0x190
leave
ret

Function at 0x4031fc
Capabilities:
Read file via mapping

Disassembly:
push esi
push str.GlobalCommon_GEM_MAP_1A2B3C4D
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov esi, eax
test esi, esi
jne 0x403215
inc eax
pop esi
ret
push 4
push 0
push 0
push 2
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x40322d
push 2
pop eax
pop esi
ret
push eax
mov dword [eax], 1
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
ret
Function at 0x403245
Capabilities:
Read file via mapping

Disassembly:
push esi
push str.GlobalCommon_GEM_MAP_1A2B3C4D
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov esi, eax
test esi, esi
jne 0x40325f
mov al, 1
pop esi
ret
push edi
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
xor edi, edi
test eax, eax
je 0x40327e
mov edi, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test edi, edi
pop edi
sete al
pop esi
ret
Function at 0x40328f
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov eax, 0x40ffb4
call fcn.004070f0
sub esp, 0x344
mov eax, dword [0x4150f0]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push dword [ebp + 8]
mov dword [ebp - 0x14], eax
call fcn.00404a9d
mov dword [esp], 0x4115b8
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0x41
pop ecx
xor eax, eax
lea edi, [ebp - 0x344]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x348]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWAREChangYouFirestone
push 0x80000002
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x403348
lea eax, [ebp - 0x350]
push eax
lea eax, [ebp - 0x344]
push eax
lea eax, [ebp - 0x34c]
push eax
push ebx
push str.InstDirPath
push dword [ebp - 0x348]
mov dword [ebp - 0x350], 0xff
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x403336
cmp dword [ebp - 0x34c], 1
je 0x40333c
mov byte [ebp - 0x344], bl
push dword [ebp - 0x348]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x344], bl
jne 0x4033e6
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x114]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x114]
push eax
push 0xff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, str.shdata
push esi
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x240]
push str._s_sperinfo.pak
push eax
call fcn.0040627d
lea eax, [ebp - 0x240]
push eax
call fcn.00404c30
add esp, 0x14
cmp eax, ebx
lea eax, [ebp - 0x114]
je 0x403423
push esi
push eax
lea eax, [ebp - 0x240]
push str._s_sgame.exe
push eax
call fcn.0040627d
lea eax, [ebp - 0x240]
push eax
call fcn.00404c30
add esp, 0x14
cmp eax, ebx
je 0x4033e6
lea ecx, [ebp - 0x114]
lea edx, [ebp - 0x344]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, bl
jne 0x4033dc
mov esi, dword [sym.imp.USER32.dll_SetDlgItemTextA]
lea eax, [ebp - 0x344]
push eax
push 0x3ed
push dword [ebp + 8]
call esi
push 0x411534
push 0x3e8
push dword [ebp + 8]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.004068c2
pop edi
pop esi
pop ebx
leave
ret
push eax
lea eax, [ebp - 0x240]
push str._sperinfo.pak
push eax
call fcn.0040627d
lea eax, [ebp - 0x240]
push eax
call fcn.00404c30
add esp, 0x10
cmp eax, ebx
je 0x4033e6
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x240]
push str._sgame.exe
push eax
call fcn.0040627d
lea eax, [ebp - 0x240]
push eax
call fcn.00404c30
add esp, 0x10
cmp eax, ebx
je 0x4033e6
lea ecx, [ebp - 0x114]
lea edx, [ebp - 0x344]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, bl
jne 0x403483
jmp 0x4033e6
Function at 0x403a16
Capabilities:
Check if file exists
Copy file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x4150f0]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
push esi
push edi
je 0x403b34
cmp byte [eax], 0
je 0x403b34
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x403b34
cmp byte [esi], 0
je 0x403b34
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x403a67
xor eax, eax
jmp 0x403b37
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
call ebx
cmp eax, 0xffffffff
jne 0x403a79
push 2
jmp 0x403ab8
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403a7e
sub eax, edx
cmp eax, 4
ja 0x403a90
push 3
jmp 0x403ab8
lea edi, [eax + esi - 4]
push str..exe
push edi
call fcn.0040e8de
test eax, eax
pop ecx
pop ecx
je 0x403abb
push str..dll
push edi
call fcn.0040e8de
test eax, eax
pop ecx
pop ecx
je 0x403abb
push 4
pop eax
jmp 0x403b37
lea edx, [ebp - 0xc]
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x403ac2
and dword [ebp - 0x13c], 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x13c]
lea eax, [ebp - 0x138]
push str._old_d_s
push edi
push eax
call fcn.0040627d
add esp, 0x14
push 1
lea eax, [ebp - 0x138]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push esi
call ebx
cmp eax, 0xffffffff
je 0x403b19
inc dword [ebp - 0x13c]
cmp dword [ebp - 0x13c], 0x14
jl 0x403ad3
push 0
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x403b34
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0x64
jmp 0x403b37
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.004068c2
leave
ret

Function at 0x403c67
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x403c74
or eax, 0xffffffff
jmp 0x403c96
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [esp + 0x10]
push dword [esp + 0x18]
push 0
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
ret 0xc

Function at 0x404b17
Capabilities:
Accept command line arguments

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
cmp byte [esi], 0x22
jne 0x404b50
push ebx
lea ebx, [esi + 1]
push 0x22
push ebx
call fcn.004072b0
mov edi, eax
sub edi, esi
mov esi, dword [esp + 0x18]
lea eax, [edi - 1]
push eax
push ebx
push esi
call fcn.004075f0
add esp, 0x14
mov byte [edi + esi - 1], 0
pop ebx
jmp 0x404b89
push 0x20
push esi
call fcn.004072b0
test eax, eax
pop ecx
pop ecx
jne 0x404b72
mov edx, dword [esp + 0xc]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x404b66
jmp 0x404b89
mov edi, eax
sub edi, esi
push edi
push esi
mov esi, dword [esp + 0x14]
push esi
call fcn.004075f0
add esp, 0xc
mov byte [edi + esi], 0
pop edi
pop esi
ret
Function at 0x404c30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x404c47
test al, 0x10
jne 0x404c47
xor eax, eax
inc eax
ret
xor eax, eax
ret

Function at 0x404c4a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x404c61
test al, 0x10
je 0x404c61
xor eax, eax
inc eax
ret
xor eax, eax
ret
Function at 0x404c64
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
lea ebp, [esp - 0x2d8]
sub esp, 0x358
mov eax, dword [0x4150f0]
mov dword [ebp + 0x2d4], eax
mov eax, dword [ebp + 0x2e0]
lea edx, [ebp - 0x74]
mov dword [ebp - 0x78], 1
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x404c8f
push esi
push edi
lea edi, [ebp - 0x74]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404c9f
mov esi, str..
lea eax, [ebp + 0x90]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x74]
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x7c], eax
jne 0x404cce
xor eax, eax
jmp 0x404e02
lea edx, [ebp + 0x1d0]
sub edx, dword [ebp + 0x2e0]
push ebx
mov ebx, dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x80], edx
jmp 0x404ce9
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp + 0x2e0]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x404cef
lea edi, [ebp + 0x1d0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404d00
mov esi, 0x411210
lea eax, [ebp + 0xbc]
movsw word es:[edi], word [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404d17
lea edi, [ebp + 0x1d0]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x404d27
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test byte [ebp + 0x90], 0x10
rep movsb byte es:[edi], byte [esi]
je 0x404d86
push 2
mov edi, 0x411364
lea esi, [ebp + 0xbc]
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x404dac
push 3
mov edi, 0x411360
lea esi, [ebp + 0xbc]
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x404dac
lea eax, [ebp + 0x1d0]
push eax
call fcn.00404c64
test eax, eax
pop ecx
jne 0x404dac
and dword [ebp - 0x78], eax
jmp 0x404dac
lea eax, [ebp + 0x1d0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x404dac
and dword [ebp - 0x78], eax
push 0x10
push str.Can_NOT_delete:
lea eax, [ebp + 0x1d0]
push eax
push 0
call ebx
lea eax, [ebp + 0x90]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x404ce6
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
jne 0x404dd4
and dword [ebp - 0x78], eax
xor esi, esi
cmp dword [ebp - 0x78], esi
je 0x404dfe
push dword [ebp + 0x2e0]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x404dfe
push 0x10
push str.Can_NOT_delete:
push dword [ebp + 0x2e0]
mov dword [ebp - 0x78], esi
push esi
call ebx
mov eax, dword [ebp - 0x78]
pop ebx
mov ecx, dword [ebp + 0x2d4]
pop edi
pop esi
call fcn.004068c2
add ebp, 0x2d8
leave
ret
Function at 0x405463
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405487
test al, 0x10
push esi
jne 0x405481
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x405487
call fcn.00404c64
pop ecx
push esi
call fcn.00402ef6
pop ecx
pop esi
ret

Function at 0x405490
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push dword [ebp + 0xc]
mov eax, dword [0x4150f0]
push dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x108]
push str._s_s
push eax
call fcn.0040627d
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00404e88
add esp, 0x1c
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4054f9
push 0xb
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push dword [ebp + 0x10]
lea eax, [ebp - 0x108]
push eax
call fcn.00402f68
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
call fcn.004068c2
leave
ret

Function at 0x405514
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4150f0]
push ebx
push esi
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x108]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
xor ebx, ebx
cmp dword [esi + 0xc], ebx
jle 0x4055b7
push ebx
mov ecx, esi
call fcn.00404f58
test eax, eax
je 0x4055b1
mov ecx, dword [eax + 4]
dec ecx
dec ecx
je 0x40557d
dec ecx
dec ecx
jne 0x4055b1
lea ecx, [eax + 0xa1c]
push ecx
add eax, 0x10
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00405490
add esp, 0xc
jmp 0x4055a8
add eax, 0x10
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push str._s_s
push eax
call fcn.0040627d
lea eax, [ebp - 0x20c]
push eax
call fcn.00405463
add esp, 0x14
lea eax, [ebp - 0x108]
push eax
call edi
inc ebx
cmp ebx, dword [esi + 0xc]
jl 0x40554a
lea eax, [ebp - 0x108]
push eax
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor eax, eax
pop ebx
call fcn.004068c2
leave
ret
Function at 0x407714
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.004068e0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4077af
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x5adbf8]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x4077af
cmp eax, 1
je 0x4077d0
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4077af
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x40777c
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x4077ab
xor eax, eax
inc eax
jmp 0x4077ef
cmp edi, eax
jae 0x4077b3
xor eax, eax
jmp 0x4077ef
cmp eax, esi
jae 0x4077ba
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x5adbf8]
jmp 0x4077d3
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4079e8
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x411fc8
call fcn.00407370
mov edi, 0x94
mov eax, edi
call fcn.004068e0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x5adbf8], ecx
mov eax, dword [esi + 4]
mov dword [0x5adc04], eax
mov edx, dword [esi + 8]
mov dword [0x5adc08], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x5adbfc], esi
cmp ecx, 2
je 0x407a48
or esi, 0x8000
mov dword [0x5adbfc], esi
shl eax, 8
add eax, edx
mov dword [0x5adc00], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x407a83
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x407a83
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x407a9b
cmp eax, 0x20b
je 0x407a88
mov dword [ebp - 0x1c], esi
jmp 0x407aaf
cmp dword [ecx + 0x84], 0xe
jbe 0x407a83
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x407aa9
cmp dword [ecx + 0x74], 0xe
jbe 0x407a83
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0040a3b2
pop ecx
test eax, eax
jne 0x407ac3
push 0x1c
call fcn.004079c4
pop ecx
call fcn.00409f77
test eax, eax
jne 0x407ad4
push 0x10
call fcn.004079c4
pop ecx
call fcn.0040d314
mov dword [ebp - 4], esi
call fcn.0040985f
test eax, eax
jge 0x407aed
push 0x1b
call fcn.0040799f
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x5af2e4], eax
call fcn.0040d1f2
mov dword [0x5ada0c], eax
call fcn.0040d150
test eax, eax
jge 0x407b13
push 8
call fcn.0040799f
pop ecx
call fcn.0040cf1d
test eax, eax
jge 0x407b24
push 9
call fcn.0040799f
pop ecx
push 1
call fcn.0040bf7e
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x407b3a
push eax
call fcn.0040799f
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0040cec0
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x407b5b
movzx eax, word [ebp - 0x40]
jmp 0x407b5e
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.004055cf
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x407b7c
push edi
call fcn.0040c0ab
call fcn.0040c0cd
jmp 0x407bae
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.004073ab
ret
Function at 0x40894e
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x4150f0]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x40897f
xor eax, eax
jmp 0x408b08
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x5ae1c0]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x4089bb
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.0040d535
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x408a96
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x408ad4
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x408a1f
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x408a10
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x4089f0
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x408a5f
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x408a68
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x4089e1
jmp 0x408a6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x408b03
cmp dword [ebp - 0x6c], edi
je 0x408ad4
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x408ac9
call fcn.004096bb
mov dword [eax], 9
call fcn.004096c4
mov dword [eax], esi
jmp 0x408afe
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x408abe
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x408a6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x408a6a
push dword [ebp - 0x6c]
call fcn.004096cd
pop ecx
jmp 0x408afe
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x408aec
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x408aec
xor eax, eax
jmp 0x408b06
call fcn.004096bb
mov dword [eax], 0x1c
call fcn.004096c4
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x408b06
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.004068c2
add ebp, 0x3a0
leave
ret