joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1809c119
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
mov eax, dword [0x181ce00c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0xc], 0
push ebx
mov ebx, edx
push esi
mov esi, ecx
mov dword [ebp - 0x184], ebx
push edi
mov edx, esi
mov byte [ebx], 0
lea ecx, [ebp - 0xc]
call fcn.1809c2ca
and dword [ebp - 8], 0
call fcn.18006f7b
push eax
lea ecx, [ebp - 8]
call fcn.1800768f
push dword [esi]
lea eax, [ebp - 8]
push 0xbff
push eax
call fcn.18042597
xor eax, eax
mov dword [ebp - 0x44], 0x1819c374
add esp, 0xc
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
push 0x138
push eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x180]
push eax
call fcn.1812f700
pop ecx
pop ecx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x180]
call fcn.1810eace
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x180]
call fcn.1810ebff
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
test eax, eax
jns 0x1809c1fa
push 4
push esi
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
sete cl
test eax, eax
mov byte [ebx], cl
setne bl
jmp 0x1809c22a
push 0
lea ecx, [ebp - 0x17c]
call fcn.1800bc14
xor ebx, ebx
inc ebx
push ebx
push dword [ebp - 0x17c]
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [ebp - 0x44]
call fcn.1809b8fb
mov ecx, dword [ebp - 0x184]
mov al, byte [ebp - 0x54]
mov byte [ecx], al
lea ecx, [ebp - 0x180]
call fcn.1810eb85
lea ecx, [ebp - 0x44]
call fcn.180448a3
lea ecx, [edi - 0x10]
call fcn.18006f52
lea ecx, [esi - 0x10]
call fcn.18006f52
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1811aa48
leave
ret
Function at 0x180f534f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x181ce00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, ecx
mov dword [ebp - 0x28], 0xf
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x3c], ebx
lea esi, [edx + 1]
mov dword [ebp - 0x2c], ebx
mov al, byte [edx]
inc edx
test al, al
jne 0x180f5375
sub edx, esi
push edx
push ecx
lea ecx, [ebp - 0x3c]
call fcn.1801e728
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x20]
call fcn.180d7ee3
mov eax, dword [ebp - 0x28]
cmp eax, 0x10
jb 0x180f53ca
mov ecx, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], ecx
cmp eax, 0x1000
jb 0x180f53c1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.18007b72
mov eax, dword [ebp - 8]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x24]
push eax
push ecx
call fcn.1811af76
pop ecx
pop ecx
cmp dword [ebp - 0xc], 8
lea eax, [ebp - 0x20]
jb 0x180f53d6
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180f53e8
test al, 0x10
jne 0x180f53e8
mov bl, 1
lea ecx, [ebp - 0x20]
call fcn.1800fd5b
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.1811aa48
leave
ret
Function at 0x180f596c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [edi + edi*8 - 1], esi
dec dword [ebx - 0xe0807bb]
test edx, edx
je 0x180f5980
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.180f5692
in eax, 2
aas
push esp
lea eax, [ebp - 0x40]
push eax
call fcn.180f56a2
push eax
push esi
push dword [ebp + 8]
call fcn.180f5657
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.180f5692
jp 0x180f59a4
inc ebp
invalid
push edi
mov byte [0x88e8458d], al
pop ebp
call 0x16ce253
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.180f56a2
push eax
push esi
push dword [ebp + 8]
call fcn.180f5657
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.180f56a2
push eax
push esi
push dword [ebp + 8]
Function at 0x180f5ce9
Capabilities:
Inspect section memory permissions

Disassembly:
cmp eax, ebx
je 0x180f5d46
add eax, esi
cmp dword [eax], ebx
je 0x180f5d46
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x180f5d41
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x180f5d2b
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x180f5d33
cmp edx, ebx
jne 0x180f5e81
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x180f5d02
add eax, dword [eax + 4]
jmp 0x180f5cef
mov dword [ebp + 0xc], ebx
jmp 0x180f5d51
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x180f5d69
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x180f5d87
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x180f5de5
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x180f5dcc
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x180f5dd5
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x180f5ddf
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x180f5dc1
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x180f5d4b
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x180f5e32
dec eax
je 0x180f5e29
sub eax, 3
je 0x180f5e20
mov dword [ebp - 4], 0x40
jmp 0x180f5e4f
mov dword [ebp - 4], 4
jmp 0x180f5e35
mov dword [ebp - 4], 0x20
jmp 0x180f5e35
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x180f5e81
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x180f5e01
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.180f5692
arpl word [ecx + 0x75ff92de], sp
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x180f5e8d
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x180ff01b
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
fild dword [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
fstp qword [esi + 8]
fild dword [ebp + 0xc]
mov dword [esi], 0x1819eb00
fstp qword [esi + 0x10]
fld qword [ebp + 0x10]
fstp qword [esi + 0x18]
fld qword [ebp + 0x18]
fstp qword [esi + 0x20]
fldz
fst qword [esi + 0x28]
fst qword [esi + 0x30]
fstp qword [esi + 0x38]
call fcn.1815742d
or dword [esi + 0x13c4], 0xffffffff
lea edi, [esi + 0x48]
mov ecx, eax
xor edx, edx
mov dword [esi + 0x44], ecx
inc edx
mov ebx, 0x270
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
inc edx
mov dword [edi], ecx
lea edi, [edi + 4]
cmp edx, ebx
jb 0x180ff069
fldz
mov ecx, esi
mov dword [esi + 0x40], ebx
fstp qword [esi + 0x13c8]
fld1
fstp qword [esi + 0x13d0]
call fcn.180ff116
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
Function at 0x18114f80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x181ce00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
call fcn.18007526
and dword [ebp - 8], 0
call fcn.1801b9ec
test al, al
jne 0x18114fb8
lea ecx, [ebp - 8]
call fcn.1801c4ca
mov esi, eax
test esi, esi
js 0x18115099
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 0x5000
push 0x1816dc0c
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov esi, eax
test esi, esi
js 0x18115099
push ebx
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x18115086
push ebx
call fcn.18133750
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
test ecx, ecx
je 0x18115086
mov eax, dword [edi]
mov edx, ebx
sub edx, eax
sar edx, 1
push ecx
mov esi, dword [eax - 0xc]
mov ecx, edi
mov dword [ebp - 0x14], edx
call fcn.18007592
mov edx, dword [ebp - 0x14]
mov ecx, eax
cmp edx, esi
mov esi, dword [ebp - 0x10]
ja 0x1811506b
mov eax, dword [edi]
lea ebx, [ecx + edx*2]
lea edx, [esi + esi]
mov eax, dword [eax - 8]
test edx, edx
je 0x1811507c
test ecx, ecx
jne 0x18115044
call fcn.181335df
mov dword [eax], 0x16
call fcn.181334d5
jmp 0x1811507c
test ebx, ebx
je 0x18115032
add eax, eax
cmp eax, edx
jae 0x1811505b
call fcn.181335df
mov dword [eax], 0x22
jmp 0x1811503d
push edx
push ebx
push ecx
lfence
call fcn.1812f180
add esp, 0xc
jmp 0x1811507c
lfence
mov edx, dword [edi]
push esi
push ebx
mov edx, dword [edx - 8]
call fcn.18007777
pop ecx
pop ecx
push esi
mov ecx, edi
call fcn.18007567
jmp 0x1811508d
mov ecx, edi
call fcn.18007526
push dword [ebp - 0xc]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor esi, esi
pop ebx
cmp dword [ebp - 8], 0
je 0x181150a8
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.1811aa48
leave
ret

Function at 0x1811a672
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push 4
pop edx
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x18199710]
sub edx, 1
jne 0x1811a675
mov eax, ecx
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x403e59
pop dword [ebp - 0x2c]
mov eax, 0x8213b9cd
sub eax, 0x81d37b74
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xbc755be6
sub dword [ebp - 0x3c], 0x6e23169b
mov dword [ebp - 0x38], 0x3cc44f52
add dword [ebp - 0x38], 0xf56efcf3
mov dword [ebp - 0x34], 0x7fe63107
add dword [ebp - 0x34], 0xcc661327
mov dword [ebp - 0x30], 0x108bbe81
sub dword [ebp - 0x30], 0x108bbe81
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x3938ff37
add eax, 0xc7078155
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x6c170eac
add dword [ebp - 0x3c], 0x85b5aaa
mov dword [ebp - 0x38], 0x1de81909
sub dword [ebp - 0x38], 0xdc7bb794
mov dword [ebp - 0x34], 0x83886e65
sub dword [ebp - 0x34], 0x201901f9
mov dword [ebp - 0x30], 0x92bbdeb
sub dword [ebp - 0x30], 0x92bbdeb
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x4d3d546
sub eax, 0x4935472
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x39bbd
push 0
call eax
mov ecx, 0x27dc19f5
sub ecx, 0x27dbc603
xor ebx, ebx
add ebx, eax
mov esi, 0x5032e045
add esi, 0xb00e2fbb
add esi, dword [ebp - 0x2c]
mov edi, 0x3822106a
xor dword [ebp - 0x28], 0xd7282f3e
mov edx, dword [esi]
add dword [ebp - 0x28], 0x14c39b5e
xor edx, edi
xor dword [ebp - 0x10], esi
mov dword [ebx], edx
xor dword [ebp - 0x28], edi
add ebx, 0xa0affd92
sub ebx, 0xa0affd8e
add esi, 0xd56acbcd
sub esi, 0xd56acbc9
loop 0x403f77
add eax, 0xd457c348
sub eax, 0xd45680ad
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x99b205e8
sub ecx, 0x997205e8
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x402240
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x808
mov eax, dword [0x4d044c]
xor eax, esp
mov dword [esp + 0x804], eax
lea eax, [ebp + 0xc]
mov byte [esp], 0
push eax
push 0
push dword [ebp + 8]
lea eax, [esp + 0xc]
push 0xffffffffffffffff
push 0x800
push eax
call fcn.004019e0
push dword [eax + 4]
push dword [eax]
call fcn.0047e029
add esp, 0x20
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x4c0fac
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
Function at 0x402f70
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4d044c]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
lea eax, [ebp - 0x108]
push str.K7Sentry
jb 0x402f9f
push str..Global_s
jmp 0x402fa4
push str.._s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x108]
push esi
push 0
push 0
push 3
push 0
push 0
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x402fe3
or eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
push edi
push 0
lea eax, [ebp - 0x110]
push eax
push 4
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
push 0x95002550
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, 1
je 0x40300f
xor edi, edi
jmp 0x403021
mov edi, dword [ebp - 0x10c]
xor eax, eax
cmp dword [ebp - 0x110], 4
cmovne edi, eax
test esi, esi
je 0x40302c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004606ac
mov esp, ebp
pop ebp
ret
Function at 0x405df0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsConnections
push closesocket
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405e42
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push str.DefaultConnectionSettings
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov ecx, 1
cmove esi, ecx
mov eax, dword [ebp - 4]
test eax, eax
je 0x405e50
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x407980
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x407973
call fcn.00407960
mov ecx, esi
mov edx, 0x200022
pop esi
jmp fcn.004076a0
pop esi
ret

Function at 0x407f00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, ecx
push ebx
mov ebx, edx
mov dword [ebp - 0x1c], eax
push esi
mov edx, dword [eax + 0x10]
mov ecx, dword [eax + 0x24]
push edi
mov dword [ebp - 0x14], ebx
test dword [edx + 0xc], 0x80000
mov eax, dword [edx + 0x10]
mov esi, dword [ecx]
mov dword [ebp - 0xc], eax
lea eax, [ebx + 1]
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
je 0x407f8d
cmp eax, esi
jg 0x40809b
sub esi, eax
lea edi, [ecx + ebx*8]
inc esi
lea ecx, [ecx + eax*8]
add eax, esi
mov dword [ebp - 4], eax
nop dword [eax]
mov edx, dword [ecx + 4]
movzx eax, word [edx + 6]
test eax, 0xc000
je 0x407f77
and eax, 0x7fff
inc ebx
add edi, 8
mov word [edx + 6], ax
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
jmp 0x407f80
and eax, 0xffef
mov word [edx + 6], ax
add ecx, 8
sub esi, 1
jne 0x407f50
jmp 0x408098
mov edi, eax
cmp edi, esi
jg 0x40802c
nop word [eax + eax]
mov ecx, dword [ecx + edi*8 + 4]
movzx eax, word [ecx + 6]
test eax, 0xc000
je 0x407fc4
and eax, 0x7fff
mov word [ecx + 6], ax
mov ecx, dword [ebp - 8]
mov dword [ecx + edi*8], 0
jmp 0x40801d
mov edx, dword [ebp - 8]
and eax, 0xffef
mov edx, dword [edx + edi*8]
imul edx, dword [ebp - 0xc]
mov word [ecx + 6], ax
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 0xc]
test al, 4
je 0x407fe8
mov edx, dword [ecx + 8]
imul edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
xorps xmm0, xmm0
mov dword [ebp - 0x28], eax
sar eax, 0x1f
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x10]
push 0
push edx
push ecx
movlpd qword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40805e
mov ecx, dword [ebp - 8]
inc edi
cmp edi, esi
jle 0x407fa0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp eax, esi
jg 0x40809b
sub esi, eax
lea edi, [ecx + eax*8]
inc esi
lea ebx, [ecx + ebx*8]
add eax, esi
mov dword [ebp - 4], eax
nop
cmp dword [edi], 0
mov ecx, dword [edi + 4]
jne 0x40806b
inc dword [ebp - 0x14]
add ebx, 8
mov eax, dword [edi]
mov dword [ebx], eax
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [ecx]
mov dword [ebx], eax
jmp 0x40808a
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test byte [ecx + 6], 4
je 0x408082
cmp dword [ecx + 8], 1
je 0x408082
push ecx
call fcn.0048b923
add esp, 4
jmp 0x40808a
mov eax, dword [edx + 0x74]
mov dword [ecx], eax
mov dword [edx + 0x74], ecx
mov edx, dword [ebp - 0x10]
add edi, 8
sub esi, 1
jne 0x408040
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
sub eax, ebx
mov edx, dword [ebp - 8]
dec eax
pop edi
pop esi
add dword [ecx + 0x44], eax
xor eax, eax
mov dword [edx], ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408930
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov eax, ecx
mov dword [ebp - 0xc], 0
push esi
push edi
xorps xmm0, xmm0
mov dword [ebp - 4], eax
mov ebx, dword [eax + 0x10]
mov esi, edx
push ebx
push 2
movups xmmword [ebp - 0x1c], xmm0
call fcn.0048e95f
mov edi, eax
add esp, 8
test edi, edi
jne 0x40896c
lea eax, [edi + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
mov eax, 8
mov word [edi + 6], ax
movups xmm0, xmmword [esi]
movups xmmword [edi + 0xc], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [edi + 0x1c], xmm0
movups xmm0, xmmword [esi + 0x20]
movups xmmword [edi + 0x2c], xmm0
movups xmm0, xmmword [esi + 0x30]
movups xmmword [edi + 0x3c], xmm0
movups xmm0, xmmword [esi + 0x40]
movups xmmword [edi + 0x4c], xmm0
mov word [edi + ebx + 6], ax
lea eax, [ebp - 0x1c]
mov dword [edi + ebx], 1
movups xmm0, xmmword [esi]
push eax
lea eax, [ebp - 8]
movups xmmword [edi + ebx + 0xc], xmm0
push eax
movups xmm0, xmmword [esi + 0x10]
mov eax, dword [ebp - 4]
movups xmmword [edi + ebx + 0x1c], xmm0
movups xmm0, xmmword [esi + 0x20]
movups xmmword [edi + ebx + 0x2c], xmm0
movups xmm0, xmmword [esi + 0x30]
movups xmmword [edi + ebx + 0x3c], xmm0
movups xmm0, xmmword [esi + 0x40]
movups xmmword [edi + ebx + 0x4c], xmm0
add ebx, ebx
mov dword [ebp - 0x14], 0
push ebx
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x408a16
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call fcn.0048b923
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esi, 0x1c
cmp dword [ebp - 8], ebx
push edi
cmove esi, eax
call fcn.0048b923
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410bc0
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 0x14], edx
push eax
mov edi, ecx
mov dword [ebp - 4], 0
push 0x20000
mov dword [ebp - 0x18], edi
mov dword [ebp - 0xc], 0
call fcn.004074f0
mov esi, eax
add esp, 8
test esi, esi
jne 0x410d56
push ebx
cmp dword [edi + 0x34], eax
je 0x410c51
mov ecx, dword [ebp - 4]
lea edx, [eax + 4]
call fcn.004076a0
mov ebx, dword [edi + 0x94]
push 0xffffffffffffffff
push ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x410c37
push eax
mov edx, ebx
mov ecx, edi
call fcn.00412070
mov esi, eax
add esp, 4
test esi, esi
jne 0x410d34
mov ecx, dword [ebp - 4]
call fcn.00407180
mov esi, eax
test esi, esi
je 0x410c51
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x410d34
mov eax, dword [edi + 0x10]
mov edi, dword [edi + 0x30]
add eax, eax
mov dword [ebp - 0x1c], eax
mov ebx, eax
je 0x410c95
push 0
lea eax, [ebp - 8]
push eax
push ebx
push edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x410c8d
mov eax, dword [ebp - 8]
test eax, eax
je 0x410c86
xor esi, esi
add edi, eax
sub ebx, eax
jne 0x410c60
jmp 0x410c95
mov esi, 5
jmp 0x410c95
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x410ca3
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test esi, esi
jne 0x410d34
mov eax, dword [ebp - 4]
xor ebx, ebx
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x18]
imul ecx, dword [eax + 0x10]
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x10]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x410cd7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x410cdc
mov ebx, dword [ebp - 0x10]
xor esi, esi
test esi, esi
jne 0x410d34
cmp dword [ebp - 0x18], ebx
cmovbe ebx, dword [ebp - 0x18]
sub ebx, dword [ebp - 0x1c]
je 0x410d34
mov ecx, 0x20000000
cmp ebx, 0x20000000
mov eax, ebx
push 0
cmova eax, ecx
lea ecx, [ebp - 8]
push ecx
push eax
push edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x410d2c
mov eax, dword [ebp - 8]
test eax, eax
je 0x410d25
add edi, eax
mov ecx, 0x20000000
sub ebx, eax
jne 0x410cf1
jmp 0x410d34
mov esi, 5
jmp 0x410d34
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x410d53
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x410d47
call fcn.00407960
mov edx, 0x200022
mov ecx, ebx
call fcn.004076a0
mov eax, esi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret