joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006b86c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x1006b87b
pop dword [ebp - 0x18]
mov eax, 0x1006b87b
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xc4ea0902
add dword [ebp - 0x28], 0x89683c49
mov dword [ebp - 0x24], 0x18b675c5
add dword [ebp - 0x24], 0x197cd680
mov dword [ebp - 0x20], 0x6098ff4c
add dword [ebp - 0x20], 0xebb344e2
mov dword [ebp - 0x1c], 0x5ac1ab2f
add dword [ebp - 0x1c], 0xa53e54d1
lea eax, [ebp - 0x28]
push eax
mov eax, 0xcf6ba54a
sub eax, 0xbf60a50e
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x56fc56d9
sub dword [ebp - 0x28], 0xe289ed83
mov dword [ebp - 0x24], 0xecc5dafd
add dword [ebp - 0x24], 0x54a68678
mov dword [ebp - 0x20], 0xe2731ecf
add dword [ebp - 0x20], 0x80fc4d9d
mov dword [ebp - 0x1c], 0x10793110
add dword [ebp - 0x1c], 0xef86cef0
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x63e1f621
sub eax, 0x53d6f5a1
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x51890
push 0
call eax
mov ecx, 0x9733cdc2
sub ecx, 0x97337738
xor edx, edx
add edx, eax
mov esi, 0x9ca23399
add esi, 0x73703867
add esi, dword [ebp - 0x18]
mov ebx, 0x3532394
add ebx, 0x6b3bbe62
add dword [ebp - 4], esi
mov edi, dword [esi]
add dword [ebp - 0xc], edi
sub edi, ebx
sub dword [ebp - 8], ebx
mov dword [edx], edi
xor dword [ebp - 0x10], 0xdef0f1f8
add edx, 4
add esi, 4
loop 0x1006b99a
add eax, 0x3c941ba
sub eax, 0x3c7f4bf
mov ebx, eax
add eax, 0xf5dfe318
add eax, 0xa201ced
mov ecx, 0xf012a420
add ecx, 0x1fed5be0
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x100705e5
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0x22c
mov eax, 0x100a9fc5
call fcn.1009de72
mov dword [ebp - 0x234], edx
mov edi, ecx
push edi
lea ecx, [ebp - 0x238]
call dword [sym.imp.fpsrvutl.dll_Ordinal_5241]
xor esi, esi
mov dword [ebp - 4], esi
mov ebx, dword [0x100f5db8]
add ebx, 0xe8
cmp dword [ebx], esi
jne 0x1007062e
push 0xf0000040
push 1
push esi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ebx, dword [ebx]
test ebx, ebx
je 0x10070740
lea eax, [ebp - 0x230]
push eax
push 0x18
push ebx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x10070740
mov eax, dword [ebp - 0x21c]
xor edx, edx
push 0x24
pop ecx
div ecx
movzx eax, word [edx*2 + str.abcdefghijklmnopqrstuvwxyz0123456789]
xor edx, edx
push eax
mov eax, dword [ebp - 0x220]
div ecx
movzx eax, word [edx*2 + str.abcdefghijklmnopqrstuvwxyz0123456789]
xor edx, edx
push eax
mov eax, dword [ebp - 0x224]
div ecx
movzx eax, word [edx*2 + str.abcdefghijklmnopqrstuvwxyz0123456789]
xor edx, edx
push eax
mov eax, dword [ebp - 0x228]
div ecx
movzx eax, word [edx*2 + str.abcdefghijklmnopqrstuvwxyz0123456789]
xor edx, edx
push eax
mov eax, dword [ebp - 0x22c]
div ecx
movzx eax, word [edx*2 + str.abcdefghijklmnopqrstuvwxyz0123456789]
xor edx, edx
push eax
mov eax, dword [ebp - 0x230]
div ecx
movzx eax, word [edx*2 + str.abcdefghijklmnopqrstuvwxyz0123456789]
push eax
push dword [ebp - 0x238]
lea eax, [ebp - 0x218]
push str._wswe_c_c_c_c_c_c.tmp
push 0xffffffffffffffff
push eax
call fcn.1006b86c
add esp, 0x28
lea eax, [ebp - 0x218]
cmp byte [ebp + 8], 0
je 0x10070731
push esi
push 0x80
push 1
push esi
push esi
push 0x40000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x10070724
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
je 0x10070638
cmp eax, 0x50
je 0x10070638
jmp 0x10070746
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
lea eax, [ebp - 0x218]
mov ecx, dword [ebp - 0x234]
push eax
call dword [sym.imp.fpsrvutl.dll_Ordinal_5525]
jmp 0x10070755
call dword [sym.imp.kernel32.dll_GetLastError]
push edi
mov edx, eax
mov ecx, 0x20002
call fcn.1002070b
mov esi, eax
lea ecx, [ebp - 0x238]
call dword [sym.imp.fpsrvutl.dll_Ordinal_2017]
mov eax, esi
call fcn.1009de27
ret 4
Function at 0x100707f0
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x100aa006
call fcn.1009de3f
mov esi, ecx
mov dword [ebp - 0x14], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.fpsrvutl.dll_Ordinal_4936]
push ebx
mov dword [ebp - 4], ebx
push ebx
mov dword [ebp - 0x10], 1
call dword [sym.imp.kernel32.dll_GetTempPathA]
mov edi, eax
test edi, edi
jle 0x1007088d
lea ecx, [edi + 1]
call fcn.1001d3c4
mov ebx, eax
test ebx, ebx
je 0x1007088d
push ebx
push edi
call dword [sym.imp.kernel32.dll_GetTempPathA]
push ebx
mov ecx, esi
mov byte [eax + ebx], 0
call dword [sym.imp.fpsrvutl.dll_Ordinal_4818]
push 0
mov ecx, esi
call dword [sym.imp.fpsrvutl.dll_Ordinal_3947]
push 0x5c
push 2
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
call dword [sym.imp.fpsrvutl.dll_Ordinal_5801]
push eax
mov ecx, esi
call dword [sym.imp.fpsrvutl.dll_Ordinal_687]
push 0x2f
push 2
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
call dword [sym.imp.fpsrvutl.dll_Ordinal_5801]
push eax
mov ecx, esi
call dword [sym.imp.fpsrvutl.dll_Ordinal_687]
push ebx
call fcn.1006b86c
pop ecx
mov eax, esi
call fcn.1009de13
ret
Function at 0x3203d2f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x3203d303
pop dword [ebp - 0x30]
mov eax, 0xadefdd05
sub eax, 0x7bec0a02
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x6f4cedba
add dword [ebp - 0x40], 0xdf055791
mov dword [ebp - 0x3c], 0xb6d36b39
sub dword [ebp - 0x3c], 0x84a01ef4
mov dword [ebp - 0x38], 0x9afc412f
add dword [ebp - 0x38], 0xb15002ff
mov dword [ebp - 0x34], 0x1352cd82
sub dword [ebp - 0x34], 0x1352cd82
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x86b06da4
add dword [ebp - 0x40], 0xedc1fbb2
mov dword [ebp - 0x3c], 0x32554039
sub dword [ebp - 0x3c], 0xf0e8dec4
mov dword [ebp - 0x38], 0xe19ccd45
sub dword [ebp - 0x38], 0x7e2d60d9
mov dword [ebp - 0x34], 0x6ee87434
add dword [ebp - 0x34], 0x91178bcc
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x2367fe58
add eax, 0xe9d3224
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x4501e
push 0
call eax
mov ecx, 0x3e7e
mov edx, eax
mov ebx, 0x3207a200
add ebx, dword [ebp - 0x30]
mov esi, 0x685f40bf
sub esi, 0x5366edcf
add dword [ebp - 0x10], 0xaf045ba2
mov edi, dword [ebx]
xor dword [ebp - 0x28], 0x619aea6a
add edi, esi
mov dword [edx], edi
sub dword [ebp - 0x28], edx
add edx, 0xc64a5d0d
add edx, 0x39b5a2f7
add ebx, 0xd8f1820a
add ebx, 0x270e7dfa
loop 0x3203d414
add eax, 0xeccb
xor ebx, ebx
add ebx, eax
add eax, 0x98c82bca
sub eax, 0x98c82bc5
mov ecx, 0x32000000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x63fdb2
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp]
mov dword [esp], esi
call 0x63fdb2
xor bl, ch
pop esi
call fcn.0063fdf0
cmp dh, byte [edi + 0x9b14227]
and byte [eax + 0x1aa8593e], ch
inc ebp
hlt
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d7a
nop
sub eax, 0x403d20
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x404a30
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x44cffb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x461b64]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
push 0x38
call fcn.004362e3
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
mov dword [esp + 0x18], 0
je 0x404a96
mov edi, dword [esi + 4]
test edi, edi
jne 0x404a83
xor edx, edx
push edx
push esi
mov ecx, eax
call fcn.0040f800
jmp 0x404a98
mov edx, dword [esi + 8]
sub edx, edi
sar edx, 2
push edx
push esi
mov ecx, eax
call fcn.0040f800
jmp 0x404a98
xor eax, eax
test eax, eax
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0xc], eax
jne 0x404ad3
push str.No_enough_memory.
push 0x463178
call fcn.00403ad0
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00404220
mov ecx, esi
call fcn.00402a00
push 2
call fcn.00436c40
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.0040d980
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x40adf0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x18
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
push eax
mov esi, ecx
call fcn.004373c3
mov ebx, eax
add esp, 4
test ebx, ebx
mov dword [esp + 0x18], ebx
jne 0x40ae3a
push str.No_enough_memory.
push 0x463178
call fcn.00403ad0
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00404220
mov ecx, esi
call fcn.00402a00
push 2
call fcn.00436c40
push edi
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0x45069c
push ebx
mov dword [esp + 0x24], 1
call fcn.00410210
mov edi, eax
add esp, 0x10
test edi, edi
je 0x40afaf
push 0x4519d0
push edi
call fcn.00437373
add esp, 8
test eax, eax
jne 0x40af0c
xor ebx, ebx
mov ecx, esi
mov dword [esp + 0x10], ebx
call fcn.004012c0
test eax, eax
jbe 0x40af8b
lea ecx, [ecx]
mov edi, dword [esi + 4]
test edi, edi
je 0x40afc4
mov ecx, dword [esi + 8]
mov eax, ecx
sub eax, edi
sar eax, 2
cmp eax, ebx
jbe 0x40afc4
cmp edi, ecx
jbe 0x40aeb6
call fcn.004362ba
mov dword [esp + 0x24], edi
lea edi, [edi + ebx*4]
cmp edi, dword [esi + 8]
ja 0x40aec7
cmp edi, dword [esi + 4]
jae 0x40aecc
call fcn.004362ba
cmp edi, dword [esi + 8]
jb 0x40aed6
call fcn.004362ba
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov edi, dword [edi]
push ebp
push edx
push eax
push edi
push esi
call dword [esp + 0x40]
add esp, 0x14
test eax, eax
jne 0x40aef4
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x10]
add ebx, 1
mov ecx, esi
mov dword [esp + 0x10], ebx
call fcn.004012c0
cmp ebx, eax
jb 0x40ae90
jmp 0x40af8b
lea ecx, [esp + 0x10]
push ecx
push edi
call fcn.00410410
add esp, 8
test eax, eax
je 0x40af55
mov ebx, dword [esp + 0x10]
test ebx, ebx
jl 0x40af55
mov ecx, esi
call fcn.004012c0
cmp ebx, eax
jae 0x40af55
push ebx
mov ecx, esi
call fcn.00409d80
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov eax, dword [eax]
push ebp
push edx
push ecx
push eax
push esi
call dword [esp + 0x40]
add esp, 0x14
test eax, eax
jne 0x40af8b
jmp 0x40af83
push edi
push str.Invalid_port
push 0x463178
call fcn.00403ad0
add esp, 8
push eax
call fcn.00403ad0
add esp, 8
mov edi, eax
push 0xa
mov ecx, edi
call fcn.00404220
mov ecx, edi
call fcn.00402a00
mov dword [esp + 0x14], 0
push 0
lea edx, [esp + 0x1c]
push edx
push 0x45069c
push 0
call fcn.00410210
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x40ae62
mov ebx, dword [esp + 0x1c]
push ebx
call fcn.00437035
mov eax, dword [esp + 0x18]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
jmp fcn.00409840

Function at 0x40afd0
Capabilities:
Terminate process

Disassembly:
push esi
push 0
push 0
push eax
mov esi, edx
push 0x409440
mov eax, esi
call fcn.0040adf0
add esp, 0x10
test eax, eax
jne 0x40b020
push esi
push str.Invalid_echo_route
push 0x463178
call fcn.00403ad0
add esp, 8
push eax
call fcn.00403ad0
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00404220
mov ecx, esi
call fcn.00402a00
push 1
call fcn.00436c40
pop esi
ret
Function at 0x40b060
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
push esi
push eax
call fcn.004373c3
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x40b0a8
push str.No_enough_memory.
push 0x463178
call fcn.00403ad0
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00404220
mov ecx, esi
call fcn.00402a00
push 2
call fcn.00436c40
push edi
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x4519f8
push ebx
call fcn.00410210
push 0
lea edx, [esp + 0x24]
push edx
push 0x4519f8
push 0
mov esi, eax
call fcn.00410210
mov ecx, dword [esp + 0x50]
mov edi, eax
mov eax, dword [esp + 0x4c]
add esp, 0x20
test esi, esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
je 0x40b141
test edi, edi
je 0x40b141
mov ecx, dword [esp + 0x20]
push ebp
lea edx, [esp + 0x18]
push edx
push edi
push 0x40b030
mov eax, esi
call fcn.0040adf0
add esp, 0x10
test eax, eax
je 0x40b141
cmp dword [esp + 0x28], 0
je 0x40b130
mov ecx, dword [esp + 0x20]
push ebp
lea eax, [esp + 0x18]
push eax
push esi
push 0x40b030
mov eax, edi
call fcn.0040adf0
add esp, 0x10
test eax, eax
je 0x40b141
push ebx
call fcn.00437035
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, dword [esp + 0x24]
push ecx
push str.Invalid_route
push 0x463178
call fcn.00403ad0
add esp, 8
push eax
call fcn.00403ad0
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00404220
mov ecx, esi
call fcn.00402a00
push 1
call fcn.00436c40
int3
Function at 0x40b180
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
push ebx
push esi
push eax
call fcn.004373c3
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x40b1bf
push str.No_enough_memory.
push 0x463178
call fcn.00403ad0
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00404220
mov ecx, esi
call fcn.00402a00
push 2
call fcn.00436c40
push 0
lea ecx, [esp + 0xc]
push ecx
push 0x4519f8
push ebx
call fcn.00410210
push 0
lea edx, [esp + 0x1c]
push edx
push 0x451a1e
push 0
mov esi, eax
call fcn.00410210
add esp, 0x20
test esi, esi
mov dword [esp + 0xc], eax
je 0x40b2f3
cmp byte [esi], 0
je 0x40b2f3
push 0
lea eax, [esp + 0xc]
push eax
push 0x45069c
push esi
call fcn.00410210
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b2f3
cmp byte [esi], 0
je 0x40b2f3
push ebp
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x20]
push esi
push 1
call fcn.0040d4a0
mov ebp, eax
test ebp, ebp
jne 0x40b27e
push esi
push str.No_filter_module
push 0x463178
call fcn.00403ad0
add esp, 8
push eax
call fcn.00403ad0
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00404220
mov ecx, esi
call fcn.00402a00
push ebx
call fcn.00437035
add esp, 4
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
push edi
push 0
lea edx, [esp + 0x14]
push edx
push 0x45069c
push 0
call fcn.00410210
mov edi, eax
add esp, 0x10
test edi, edi
je 0x40b2a0
cmp byte [edi], 0
jne 0x40b2a2
mov edi, esi
push 0
lea eax, [esp + 0x14]
push eax
push 0x451a1e
push 0
call fcn.00410210
add esp, 0x10
test eax, eax
je 0x40b2c1
cmp byte [eax], 0
jne 0x40b2c3
mov eax, edi
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x28]
push edx
push eax
push edi
push ebp
call fcn.00408340
test eax, eax
pop edi
push ebx
je 0x40b26d
call fcn.00437035
add esp, 4
pop ebp
pop esi
mov eax, 1
pop ebx
add esp, 0xc
ret
push str.No_module_name.
push 0x463178
call fcn.00403ad0
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00404220
mov ecx, esi
call fcn.00402a00
push ebx
call fcn.00437035
add esp, 4
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x40b9d0
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push ebp
call fcn.004373c3
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x40ba12
push str.No_enough_memory.
push 0x463178
call fcn.00403ad0
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00404220
mov ecx, esi
call fcn.00402a00
push 2
call fcn.00436c40
push edi
push 0
lea eax, [esp + 0x14]
push eax
push 0x4519f8
push ebx
call fcn.00410210
push 0
lea ecx, [esp + 0x24]
push ecx
push 0x451a1e
push 0
mov esi, eax
call fcn.00410210
add esp, 0x20
test esi, esi
mov edi, eax
je 0x40bad8
cmp byte [esi], 0
je 0x40bad8
test edi, edi
je 0x40bad8
cmp byte [edi], 0
je 0x40bad8
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 0
push edi
push edx
push 0x40b330
mov eax, esi
call fcn.0040adf0
add esp, 0x10
test eax, eax
jne 0x40bac9
push esi
push str._to_ports
push edi
push str.Cant_add_filters
push 0x463178
call fcn.00403ad0
add esp, 8
push eax
call fcn.00403ad0
add esp, 8
push eax
call fcn.00403ad0
add esp, 8
push eax
call fcn.00403ad0
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00404220
mov ecx, esi
call fcn.00402a00
push 1
call fcn.00436c40
push ebx
call fcn.00437035
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push ebp
push str.Invalid_filter_parameters
push 0x463178
jmp 0x40ba9f
Function at 0x412b80
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
push esi
push edi
mov esi, ecx
je 0x412b9c
cmp byte [eax], 0
je 0x412b9c
push eax
call fcn.004373c3
add esp, 4
jmp 0x412b9e
xor eax, eax
mov dword [esi + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x412bc0
cmp byte [eax], 0
je 0x412bc0
push eax
call fcn.004373c3
add esp, 4
jmp 0x412bc2
xor eax, eax
mov edi, dword [esp + 0xc]
mov dword [esi + 0xc], eax
mov eax, edi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x412bd0
sub eax, edx
add eax, 5
push eax
call fcn.00435571
add esp, 4
test eax, eax
mov dword [esi + 0x10], eax
jne 0x412c19
push str.No_enough_memory.
push 0x463178
call fcn.00403ad0
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00404220
mov ecx, esi
call fcn.00402a00
push 2
call fcn.00436c40
mov dword [eax], esi
add dword [esi + 0x10], 4
mov edx, dword [esi + 0x10]
mov ecx, edi
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x412c24
pop edi
pop esi
ret 0x10
Function at 0x414950
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x44df90
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x461b64]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x14], ebp
xor ebx, ebx
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
xor edi, edi
cmp dword [esp + 0x3c], ebx
mov dword [esp + 0x34], ebx
mov dword [ebp + 0x10], ebx
jle 0x414a5c
jmp 0x4149a0
mov eax, dword [esp + 0x40]
mov esi, dword [eax + edi*4]
mov eax, esi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x24], ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x4149c0
sub eax, edx
add eax, 5
push eax
call fcn.00435571
add esp, 4
cmp eax, ebx
mov dword [esp + 0x28], eax
je 0x414a74
lea ecx, [esp + 0x18]
mov dword [eax], ecx
mov edx, dword [esp + 0x28]
add edx, 4
mov dword [esp + 0x28], edx
mov ecx, esi
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
cmp al, bl
jne 0x4149f6
lea edx, [esp + 0x18]
push edx
mov ecx, ebp
mov byte [esp + 0x38], 1
call fcn.00413d90
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov byte [esp + 0x34], bl
je 0x414a2d
add eax, 0xfffffffc
push eax
call fcn.00436810
add esp, 4
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x414a3e
push eax
call fcn.00437035
add esp, 4
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x414a4f
push eax
call fcn.00437035
add esp, 4
add edi, 1
cmp edi, dword [esp + 0x3c]
jl 0x4149a0
mov eax, ebp
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
push str.No_enough_memory.
push 0x463178
call fcn.00403ad0
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00404220
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx + esi]
xor edi, edi
test byte [eax + 8], 6
jne 0x414ab7
mov eax, dword [eax + 0x28]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x30]
call eax
cmp eax, 0xffffffff
jne 0x414ab7
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x414ad6
mov eax, dword [ecx + 8]
or eax, edi
cmp dword [ecx + 0x28], ebx
jne 0x414acf
or eax, 4
push ebx
push eax
call fcn.00401cc0
push 2
call fcn.00436c40
int3
Function at 0x41be90
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
xor eax, eax
push edi
mov edi, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], eax
push 0x41be10
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
push esi
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 0x24]
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFileEx]
test eax, eax
jne 0x41befe
mov esi, dword [esi + 0x14]
mov eax, dword [esi]
add eax, 4
cmp dword [eax + 0x18], 0x10
jb 0x41bed9
mov eax, dword [eax + 4]
jmp 0x41bedc
add eax, 4
mov esi, dword [esi + 0x24]
push eax
push esi
push str.WriteOverlapped::StartWrite__:_WriteFileEx__x___s
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
call fcn.0041a5c0
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
mov eax, dword [esi + 0x14]
add dword [eax + 4], 1
mov dword [esi + 0x1c], edi
pop edi
mov dword [esi + 0x18], ebx
pop esi
mov eax, 1
pop ebx
ret 8

Function at 0x41bf90
Capabilities:
Read file on windows

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
push 0x40
mov dword [esi + 0x10], eax
call dword [0x462fa4]
test eax, eax
mov dword [esi + 0x18], eax
je 0x41bff8
mov ecx, dword [esi + 0x14]
mov ecx, dword [ecx + 0x24]
push 0x41bf20
push esi
push 0x40
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFileEx]
test eax, eax
jne 0x41bffc
mov edx, dword [esi + 0x14]
mov eax, dword [edx]
add eax, 4
cmp dword [eax + 0x18], 0x10
jb 0x41bfdf
mov eax, dword [eax + 4]
jmp 0x41bfe2
add eax, 4
push eax
push str.ReadOverlapped::StartRead__:_ReadFileEx____s
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
call fcn.0041a5c0
add esp, 8
xor eax, eax
pop esi
ret
mov esi, dword [esi + 0x14]
mov eax, 1
add dword [esi + 4], eax
pop esi
ret

Function at 0x422db0
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
xor eax, eax
push edi
mov edi, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], eax
push 0x422d50
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
push esi
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 0x34]
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFileEx]
test eax, eax
jne 0x422e19
mov esi, dword [esi + 0x14]
cmp dword [esi + 0x6c], 0x10
jb 0x422df4
mov eax, dword [esi + 0x58]
jmp 0x422df7
lea eax, [esi + 0x58]
mov esi, dword [esi + 0x34]
push eax
push esi
push str.WriteOverlapped::StartWrite__:_WriteFileEx__x___s
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
call fcn.0041a5c0
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
mov dword [esi + 0x1c], edi
pop edi
mov dword [esi + 0x18], ebx
pop esi
mov eax, 1
pop ebx
ret 8