joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb08962
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0xb08990
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0xb08997
cmp ebx, dword [eax + 4]
jae 0xb08997
xor eax, eax
jmp 0xb08b87
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0xb089a8
xor eax, eax
inc eax
jmp 0xb08b86
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0xb089be
cmp ecx, edx
jae 0xb08b03
cmp dword [eax + 4], 0
je 0xb089c7
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0xb089af
cmp dword [ebp + 8], 0
je 0xb089e9
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0xb08b03
cmp eax, esi
jae 0xb08b03
mov eax, dword [0x100149c0]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0xb08a0e
cmp dword [esi*4 + 0x100149c8], edi
je 0xb08b07
inc esi
cmp esi, eax
jl 0xb089fc
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x10011118]
test eax, eax
je 0xb08b83
cmp dword [ebp - 8], 0x1000000
jne 0xb08b83
test byte [ebp - 0xc], 0xcc
je 0xb08a8c
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0xb08b83
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0xb08b83
cmp word [eax + 0x18], 0x10b
jne 0xb08b83
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0xb08b83
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0xb08a8c
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0xb08a8c
test byte [ecx + 0x27], 0x80
jne 0xb08b03
push 1
push 0x10014a08
call dword [0x10011028]
test eax, eax
jne 0xb089a0
mov ecx, dword [0x100149c0]
test ecx, ecx
mov edx, ecx
jle 0xb08ac0
lea eax, [ecx*4 + 0x100149c4]
cmp dword [eax], edi
je 0xb08ac0
dec edx
sub eax, 4
test edx, edx
jg 0xb08ab4
test edx, edx
jne 0xb08af1
push 0xf
pop ebx
cmp ecx, ebx
jg 0xb08acd
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0xb08ae5
lea eax, [edx*4 + 0x100149c8]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0xb08ad3
cmp ecx, 0x10
jge 0xb08af1
inc ecx
mov dword [0x100149c0], ecx
push 0
push 0x10014a08
call dword [0x10011028]
jmp 0xb089a0
xor eax, eax
jmp 0xb08b86
test esi, esi
jle 0xb089a0
mov ebx, dword [0x10011028]
push 1
push 0x10014a08
call ebx
test eax, eax
jne 0xb089a0
cmp dword [esi*4 + 0x100149c8], edi
je 0xb08b5d
mov eax, dword [0x100149c0]
lea esi, [eax - 1]
test esi, esi
jl 0xb08b4b
cmp dword [esi*4 + 0x100149c8], edi
je 0xb08b47
dec esi
jns 0xb08b3b
test esi, esi
jge 0xb08b5b
cmp eax, 0x10
jge 0xb08b56
inc eax
mov dword [0x100149c0], eax
lea esi, [eax - 1]
jmp 0xb08b5d
je 0xb08b75
xor ecx, ecx
test esi, esi
jl 0xb08b75
lea eax, [ecx*4 + 0x100149c8]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0xb08b63
push 0
push 0x10014a08
call ebx
jmp 0xb089a0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1c66fa9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.01c73721
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi]
mov eax, 0x1000
cmp esi, eax
jge 0x1c67028
test esi, esi
jl 0x1c67028
push eax
lea eax, [ebp - 0x1000]
push 0
push eax
call fcn.01c73761
push esi
add edi, 4
lea eax, [ebp - 0x1000]
push edi
push eax
call fcn.01c72641
lea eax, [esi - 2]
add esp, 0x18
test eax, eax
jl 0x1c67005
mov cl, byte [ebp + eax - 0xfff]
xor byte [ebp + eax - 0x1000], cl
dec eax
jns 0x1c66ff4
lea eax, [esi + 1]
cmp eax, dword [ebp + 0x10]
jle 0x1c67010
mov eax, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 0xc]
call fcn.01c72641
mov eax, dword [ebp + 0xc]
add esp, 0xc
jmp 0x1c6702a
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x1c79713
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x1c79741
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x1c79748
cmp ebx, dword [eax + 4]
jae 0x1c79748
xor eax, eax
jmp 0x1c79938
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x1c79759
xor eax, eax
inc eax
jmp 0x1c79937
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x1c7976f
cmp ecx, edx
jae 0x1c798b4
cmp dword [eax + 4], 0
je 0x1c79778
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x1c79760
cmp dword [ebp + 8], 0
je 0x1c7979a
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x1c798b4
cmp eax, esi
jae 0x1c798b4
mov eax, dword [0x1002e498]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x1c797bf
cmp dword [esi*4 + 0x1002e4a0], edi
je 0x1c798b8
inc esi
cmp esi, eax
jl 0x1c797ad
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x100260ec]
test eax, eax
je 0x1c79934
cmp dword [ebp - 8], 0x1000000
jne 0x1c79934
test byte [ebp - 0xc], 0xcc
je 0x1c7983d
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x1c79934
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1c79934
cmp word [eax + 0x18], 0x10b
jne 0x1c79934
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x1c79934
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x1c7983d
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x1c7983d
test byte [ecx + 0x27], 0x80
jne 0x1c798b4
push 1
push 0x1002e4e0
call dword [0x100260e8]
test eax, eax
jne 0x1c79751
mov ecx, dword [0x1002e498]
test ecx, ecx
mov edx, ecx
jle 0x1c79871
lea eax, [ecx*4 + 0x1002e49c]
cmp dword [eax], edi
je 0x1c79871
dec edx
sub eax, 4
test edx, edx
jg 0x1c79865
test edx, edx
jne 0x1c798a2
push 0xf
pop ebx
cmp ecx, ebx
jg 0x1c7987e
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x1c79896
lea eax, [edx*4 + 0x1002e4a0]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x1c79884
cmp ecx, 0x10
jge 0x1c798a2
inc ecx
mov dword [0x1002e498], ecx
push 0
push 0x1002e4e0
call dword [0x100260e8]
jmp 0x1c79751
xor eax, eax
jmp 0x1c79937
test esi, esi
jle 0x1c79751
mov ebx, dword [0x100260e8]
push 1
push 0x1002e4e0
call ebx
test eax, eax
jne 0x1c79751
cmp dword [esi*4 + 0x1002e4a0], edi
je 0x1c7990e
mov eax, dword [0x1002e498]
lea esi, [eax - 1]
test esi, esi
jl 0x1c798fc
cmp dword [esi*4 + 0x1002e4a0], edi
je 0x1c798f8
dec esi
jns 0x1c798ec
test esi, esi
jge 0x1c7990c
cmp eax, 0x10
jge 0x1c79907
inc eax
mov dword [0x1002e498], eax
lea esi, [eax - 1]
jmp 0x1c7990e
je 0x1c79926
xor ecx, ecx
test esi, esi
jl 0x1c79926
lea eax, [ecx*4 + 0x1002e4a0]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x1c79914
push 0
push 0x1002e4e0
call ebx
jmp 0x1c79751
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5e3688
Capabilities:
Encode data using xor

Disassembly:
in al, dx
push 0x8fd8825b
dec edi
lodsd eax, dword [esi]
or al, byte [ecx + ebp*8]
imul dl
mov byte [esi], bh
das
in al, dx
push 0xe782755b
ret 0xfd9f
xchg dword [esi - 0x40], esp
jmp 0x5e36eb
outsd dx, dword [esi]
fcomp dword [ecx]
jmp 0x5e365d
push ds
jnp 0x5e36c7
dec ebx
xchg esp, eax
xchg esp, eax
jb 0x5e36a4
mov bh, 0xf2
sbb dword [esi + 0x72], esi
mov dword [eax], 0x4fd87276
pushfd
mov byte [ebx + ebp + 0x6f], ch
mov edi, 0x7b19d695
std
push edx
lahf
jne 0x5e3767
xchg esp, eax
push ds
jnp 0x5e36eb
dec ebx
xchg esp, eax
xchg esp, eax
jb 0x5e36c8
mov dh, 0xf2
sbb dword [esi + 0x72], esi
invalid
pop ds
jbe 0x5e379b
fadd st(1)
mov ah, 0x81
fcomp dword [ecx]
test dh, dl
xlatb
sbb eax, 0xd7d68419
sbb dword [esi - 0x78], esi
inc ebp
cli
out 0xb8, al
lodsd eax, dword [esi]
lds esp, [ebx + 0x1a2848]
cmp dl, al
mov bl, byte [edx - 0x11b1278b]
xor ch, al
xchg ebp, eax
arpl word [edx - 0x28], si
jb 0x5e3726
sbb dword [esi + 0x761a254b], ecx
pop ebx
sbb dh, byte [esi + 0x5b]
sbb byte [0x9d07276], dl
mov eax, dword [0x346d875]
jb 0x5e37a8
cmc
add edi, dword [ecx]
inc esi
adc eax, 0x15507304
jbe 0x5e37df
add al, 0x73
push eax
adc eax, 0x88587276
out dx, al
pop eax
mov dh, ch
loop 0x5e374c
sbb dword [esi - 0x7e], esi
fadd dword [esi + 0x40a9e3b]
xchg esp, eax
mov ebx, 0x6aea2e32
fmul dword [ecx]
out dx, eax
aaa
fcomp dword [ecx]
jbe 0x5e37e4
in al, 0x19
jbe 0x5e37ff
pushal
jo 0x5e3752
bound ebx, qword [0xe0f81d8e]
ja 0x5e372c
cmpsb byte [esi], byte es:[edi]
salc
outsb dx, byte [esi]
invalid
Function at 0x412082
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x418680], 0
push ebx
push esi
mov esi, 0x418688
jne 0x4120ae
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x4186a0], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x418680], 1
push dword [0x4186a0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x41214b
push 0x14
push 8
push dword [0x418010]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412175
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x418684]
test eax, eax
je 0x4120f0
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x418684], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41217a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x4186a0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418010]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412175
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x664f4b02
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
mov ecx, 0xa147d67
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401ff0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 8
mov ecx, 0x4390f2
push ebx
push ebp
push esi
push edi
mov ebp, edx
call fcn.00427378
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
sub eax, dword [0x438ce0]
cmp eax, 0x3e8
jbe 0x402038
push 0
call fcn.0041001e
add esp, 4
mov esi, eax
call ebx
add eax, esi
push eax
call fcn.0040d502
add esp, 4
call ebx
mov dword [0x438ce0], eax
call fcn.0040d4e1
mov edi, eax
call fcn.0040d4e1
xor edi, eax
call fcn.0040d4e1
mov esi, eax
call fcn.0040d4e1
imul eax, esi
cdq
idiv edi
mov esi, eax
call ebx
imul eax, esi
push eax
call fcn.0040d502
add esp, 4
call ebx
mov esi, eax
call fcn.0040d4e1
xor edx, edx
div esi
push edx
call fcn.0040d502
add esp, 4
call fcn.0040d4e1
cdq
idiv ebp
pop edi
pop esi
pop ebp
mov eax, edx
pop ebx
add esp, 8
ret

Function at 0x402090
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x40c
mov eax, dword [0x43704c]
xor eax, esp
mov dword [esp + 0x408], eax
mov ecx, 0x4390f2
call fcn.00427378
push 0x104
lea eax, [esp + 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp]
push 0x5c
push eax
call fcn.00409e60
add esp, 8
xor ecx, ecx
mov byte [eax], 0
mov al, byte [esp + ecx]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x103], al
test al, al
jne 0x4020d3
lea ecx, [esp + 0x104]
dec ecx
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4020f0
mov eax, dword [str.RakSAMP_Lite.exe]
mov dword [ecx], eax
mov eax, dword [0x43378c]
mov dword [ecx + 4], eax
mov eax, dword [0x433790]
mov dword [ecx + 8], eax
mov eax, dword [0x433794]
push esi
mov esi, dword [0x438cb8]
mov dword [ecx + 0xc], eax
mov ax, word [0x433798]
mov word [ecx + 0x10], ax
lea eax, [esi + 0x400]
mov cl, byte [eax]
push edi
mov edi, 0x1e61
test cl, cl
je 0x402165
nop dword [eax]
lea esi, [eax + 1]
cmp cl, 0x3a
jne 0x402157
push esi
mov byte [eax], 0
call fcn.004109c1
add esp, 4
movzx edi, ax
mov eax, esi
mov cl, byte [eax]
test cl, cl
jne 0x402140
mov esi, dword [0x438cb8]
push 0x200
lea eax, [esp + 0x214]
push 0
push eax
call fcn.0040a650
add esp, 0xc
lea eax, [esi + 0x200]
cmp byte [0x438c7c], 0
jne 0x402190
mov eax, 0x43370f
push eax
push esi
movzx eax, di
push eax
lea eax, [esi + 0x400]
push eax
lea eax, [esp + 0x220]
push str._h__s__p__d__n__s__z__s
push eax
call fcn.004011c0
add esp, 0x18
lea eax, [esp + 8]
push 5
push eax
lea eax, [esp + 0x218]
push eax
lea eax, [esp + 0x118]
push eax
push str.open
push dword [0x438c8c]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
cmp eax, 0xb
ja case.0x4021e1.279
jmp dword [eax*4 + 0x40225c]
push 0x10
push str.Error
push str.Insufficient_system_recources
jmp 0x40223a
push 0x10
push str.Error
push str.File_does_not_exists:_RakSAMP_Lite.exe
jmp 0x40223a
push 0x10
push str.Error
push str.Wrong_path
jmp 0x40223a
push 0x10
push str.Error
push str.File_damaged
jmp 0x40223a
push 0x10
push str.Error
push str.Access_denied
jmp 0x40223a
push 0x10
push str.Error
push str.Not_enough_memory
push dword [0x438c8c]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.004089f8
add esp, 0x40c
ret
Function at 0x402290
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4274bd
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x43704c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x4390f2
mov dword [ebp - 4], 0
call fcn.00427378
cmp dword [ebp + 0x1c], 0x10
lea ebx, [ebp + 8]
push 0x104
cmovae ebx, dword [ebp + 8]
push str.C:Users_admin1AppDataLocalTemp_settingsRakSAMP_Lite.ini
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push str.C:Users_admin1AppDataLocalTemp_settingsRakSAMP_Lite.ini
call fcn.00409e60
add esp, 8
mov esi, ebx
mov byte [eax + 1], 0
nop
mov al, byte [ebx]
inc ebx
test al, al
jne 0x402300
mov edi, str.C:Users_admin1AppDataLocalTemp_settingsRakSAMP_Lite.ini
sub ebx, esi
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402310
mov ecx, ebx
mov dword [ebp - 0x58], 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov dword [ebp - 0x48], 0
and ecx, 3
mov dword [ebp - 0x44], 0xf
rep movsb byte es:[edi], byte [esi]
mov ecx, str.C:Users_admin1AppDataLocalTemp_settingsRakSAMP_Lite.ini
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402343
sub ecx, edx
push ecx
push str.C:Users_admin1AppDataLocalTemp_settingsRakSAMP_Lite.ini
lea ecx, [ebp - 0x58]
call fcn.00406360
cmp dword [ebp - 0x44], 0x10
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push ecx
push eax
call fcn.0040e775
mov ecx, dword [ebp - 0x44]
add esp, 8
test eax, eax
je 0x4023e7
cmp ecx, 0x10
jb 0x4023aa
mov edx, dword [ebp - 0x58]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4023a0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402476
push ecx
push edx
call fcn.00408c8c
add esp, 8
push 0
push str.C:Users_admin1AppDataLocalTemp_settingsRakSAMP_Lite.ini
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x402455
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40244b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402471
jmp 0x40244b
test dword [ebp - 0x3a], 0x4000
je 0x40241f
cmp ecx, 0x10
jb 0x4023b7
mov edx, dword [ebp - 0x58]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402413
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402476
push ecx
push edx
call fcn.00408c8c
add esp, 8
jmp 0x4023b7
cmp ecx, 0x10
jb 0x4023aa
mov edx, dword [ebp - 0x58]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4023a0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402476
jmp 0x4023a0
push ecx
push edx
call fcn.00408c8c
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004089f8
mov esp, ebp
pop ebp
ret
call fcn.0041135b
call fcn.0041135b
int3
Function at 0x404a80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
mov dword [esp + 0xc], ecx
mov ecx, 0x4390ef
push edi
call fcn.00427378
mov ecx, dword [esp + 0x10]
cmp dword [ecx + 0x38], 0
je 0x404b88
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test esi, esi
jl 0x404b77
jg 0x404acb
test edx, edx
je 0x404b77
lea edx, [ecx + 0x30]
nop
mov eax, dword [ecx + 0x20]
mov dword [esp + 0x1c], edx
mov eax, dword [eax]
mov dword [esp + 0x18], eax
test eax, eax
je 0x404ae7
mov eax, dword [edx]
mov eax, dword [eax]
jmp 0x404ae9
xor eax, eax
cdq
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x404b37
jg 0x404afc
test esi, esi
je 0x404b37
cmp ebx, eax
jg 0x404b0c
jl 0x404b06
cmp edi, esi
jae 0x404b0c
mov esi, edi
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0xc]
push esi
push eax
push dword [esp + 0x20]
call fcn.0040a010
mov edx, dword [esp + 0x28]
add esp, 0xc
mov ecx, dword [esp + 0x10]
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [edx]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x404b5b
mov eax, dword [esp + 0xc]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x404b71
mov ecx, dword [esp + 0x10]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
lea edx, [ecx + 0x30]
add dword [esp + 0xc], esi
test ebx, ebx
jg 0x404ad0
jl 0x404b71
test edi, edi
jne 0x404ad0
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov edx, dword [eax]
lea eax, [ecx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
test edx, edx
je 0x404bb0
mov eax, dword [eax]
mov edx, dword [eax]
jmp 0x404bb6
xor edx, edx
mov dword [esp + 0x18], eax
mov eax, edx
cdq
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], edx
test edi, edi
jl 0x404c1e
jg 0x404bcb
test esi, esi
je 0x404c1e
test edx, edx
jl 0x404c19
jg 0x404bd5
test eax, eax
je 0x404c19
cmp edi, edx
jg 0x404be9
jl 0x404bdf
cmp esi, eax
jae 0x404be9
mov eax, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], edi
mov ebx, dword [ebp + 8]
push eax
push ebx
push dword [esp + 0x24]
call fcn.0040a010
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x14]
add ebx, edx
mov ecx, dword [esp + 0x10]
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0xc]
sub dword [eax], edx
mov eax, dword [ecx + 0x20]
add dword [eax], edx
jmp 0x404c21
mov ebx, dword [ebp + 8]
jmp 0x404c2b
mov ebx, dword [ebp + 8]
test edi, edi
jl 0x404c44
jg 0x404c2b
test esi, esi
je 0x404c44
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x404c44
push eax
push esi
push 1
push ebx
call fcn.0040eb31
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4051af
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x43704c]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push esi
mov esi, ecx
mov ecx, 0x4390ef
call fcn.00427378
mov ebx, dword [esp + 0x3c]
cmp ebx, 0xffffffff
jne 0x4051da
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004089f8
add esp, 0x30
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x405217
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x405217
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004089f8
add esp, 0x30
ret 4
cmp dword [esi + 0x4c], 0
je 0x40530d
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x40523f
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x405273
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0040d3cc
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004089f8
add esp, 0x30
ret 4
lea eax, [esp + 0xc]
mov byte [esp + 0x17], bl
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x2b]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x4052dc
sub eax, 1
je 0x4052dc
sub eax, 2
jne 0x40530d
push dword [esi + 0x4c]
movsx eax, byte [esp + 0x1b]
push eax
call fcn.0040d3cc
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004089f8
add esp, 0x30
ret 4
mov edi, dword [esp + 0xc]
lea eax, [esp + 0x18]
sub edi, eax
je 0x4052fb
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0040eb31
add esp, 0x10
cmp edi, eax
jne 0x40530d
lea eax, [esp + 0x17]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x10], eax
jne 0x405201
mov ecx, dword [esp + 0x38]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004089f8
add esp, 0x30
ret 4
Function at 0x405f40
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x43704c]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, ecx
mov ecx, 0x4390ef
call fcn.00427378
cmp dword [esi + 0x38], 0
je 0x40600c
cmp byte [esi + 0x3d], 0
je 0x40600c
mov eax, dword [esi]
mov ecx, esi
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x405ff9
mov ecx, dword [esi + 0x38]
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x30]
push eax
mov edx, dword [ecx]
lea eax, [esp + 0x14]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x405fbe
sub eax, 1
je 0x405fc2
sub eax, 2
jne 0x405ff9
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004089f8
add esp, 0x28
ret
mov byte [esi + 0x3d], 0
mov edi, dword [esp + 8]
lea eax, [esp + 0xc]
sub edi, eax
je 0x405fe1
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0040eb31
add esp, 0x10
cmp edi, eax
jne 0x405ff9
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004089f8
add esp, 0x28
ret
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004089f8
add esp, 0x28
ret
mov ecx, dword [esp + 0x28]
mov al, 1
pop esi
xor ecx, esp
call fcn.004089f8
add esp, 0x28
ret