joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c3860
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d184b
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x100e7034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x144]
push 0
push eax
call fcn.100c3f00
add esp, 8
cmp byte [0x100ef901], 0
mov dword [ebp - 4], 0
je 0x100c3985
push 0x103
lea eax, [ebp - 0x113]
mov byte [ebp - 0x114], 0
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x114]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp dword [esi + 0x14], 0x10
jb 0x100c38f0
mov ecx, dword [esi]
jmp 0x100c38f2
mov ecx, esi
cmp dword [ebp - 0x130], 0x10
lea eax, [ebp - 0x144]
push ecx
cmovae eax, dword [ebp - 0x144]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x12c]
push str.__d._d._s._s___s_n
push eax
call fcn.100c4510
add esp, 0x1c
lea eax, [ebp - 0x12c]
cmp dword [ebp - 0x118], 0x10
cmovae eax, dword [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [ebp - 0x118], 0x10
jb 0x100c396a
push dword [ebp - 0x12c]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x12c], 0
mov eax, dword [0x100ef908]
test eax, eax
jne 0x100c39b5
push 0x18
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [0x100ef908], eax
xorps xmm0, xmm0
movdqu xmmword [eax], xmm0
push eax
movq qword [eax + 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [0x100ef908]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.100c9a50
lea ecx, [ebp - 0x144]
push ecx
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x20]
call eax
test eax, eax
jne 0x100c39df
push eax
push eax
call fcn.100c34c0
add esp, 8
push dword [0x100ef908]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.100c9a50
cmp dword [esi + 0x10], 0
mov edi, eax
je case.default.0x100c3a0d
mov edx, dword [edi]
mov ecx, edi
mov edx, dword [edx + 0xc]
call edx
mov ecx, dword [ebp + 8]
cmp ecx, eax
jg case.default.0x100c3a0d
cmp ecx, 3
ja case.default.0x100c3a0d
jmp dword [ecx*4 + 0x100c3a6c]
push esi
mov ecx, edi
call fcn.100c9510
jmp case.default.0x100c3a0d
push esi
mov ecx, edi
call fcn.100c9b20
jmp case.default.0x100c3a0d
push esi
mov ecx, edi
call fcn.100c9ff0
jmp case.default.0x100c3a0d
push esi
mov ecx, edi
call fcn.100c9850
cmp dword [ebp - 0x130], 0x10
jb 0x100c3a51
push dword [ebp - 0x144]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ce73b
mov esp, ebp
pop ebp
ret
Function at 0x100c4300
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d1950
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x100e7034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
call fcn.100c4e80
add esp, 4
cmp dword [ebp + 0x18], 0
jle 0x100c44dc
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp + 8]
push eax
call fcn.10001870
call fcn.100c4740
add esp, 0x18
test al, al
je 0x100c437f
mov bl, 1
jmp 0x100c44de
call fcn.100c4ab0
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10008780
mov esi, eax
add esp, 0xc
lea eax, [ebp + 8]
cmp eax, esi
je 0x100c43cc
cmp dword [ebp + 0x1c], 8
jb 0x100c43af
push dword [ebp + 8]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
push esi
lea ecx, [ebp + 8]
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
call fcn.10004a00
cmp dword [ebp - 0x14], 8
jb 0x100c43dd
push dword [ebp - 0x28]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
lea eax, [ebp + 8]
push eax
call fcn.100c4950
mov ecx, dword [ebp + 0x18]
mov esi, 1
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add esp, 4
cmp ecx, esi
jbe 0x100c448d
cmp ecx, esi
jbe 0x100c44d1
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
cmp word [eax + esi*2], 0x5c
jne 0x100c4484
push esi
push 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp + 8]
call fcn.100081d0
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x28]
push eax
call fcn.10001870
call fcn.100c4740
add esp, 0x18
test al, al
jne 0x100c446c
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call edi
cmp dword [ebp - 0x14], 8
mov byte [ebp - 4], 0
jb 0x100c4481
push dword [ebp - 0x28]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp + 0x18]
inc esi
cmp ecx, esi
ja 0x100c4407
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 0
cmovae eax, dword [ebp + 8]
push eax
call edi
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp + 8]
push eax
call fcn.10001870
call fcn.100c4740
add esp, 0x18
test al, al
je 0x100c44dc
mov bl, 1
jmp 0x100c44de
push str.invalid_string_position
call dword [sym.imp.MSVCP120.dll_void___cdecl_std::_Xout_of_range_char_const__]
xor bl, bl
cmp dword [ebp + 0x1c], 8
jb 0x100c44ef
push dword [ebp + 8]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ce73b
mov esp, ebp
pop ebp
ret
Function at 0x100c4740
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d19e8
mov eax, dword fs:[0]
push eax
push ebx
mov eax, dword [0x100e7034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
call fcn.100c4950
add esp, 4
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne bl
cmp dword [ebp + 0x1c], 8
jb 0x100c479e
push dword [ebp + 8]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100cc020
Capabilities:
Get number of processors
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d2609
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100e7034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0xffffffffffffffff
push 0
push dword [ebp + 8]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
call fcn.100068d0
push 0xffffffffffffffff
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 0
mov dword [ecx + 0x14], 0xf
push 0
push dword [ebp + 0xc]
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.100068d0
push 0xffffffffffffffff
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
mov dword [ecx + 0x14], 0xf
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.100068d0
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x48], eax
lea eax, [esi + 0x4c]
push eax
mov byte [ebp - 4], 2
call fcn.100ce6c0
add esp, 4
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 3
call fcn.100ce440
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x100cdf20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push dword [0x100ef9fc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x100cdf74
push esi
push 0x10
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x100cdf4a
mov ecx, eax
call fcn.100cd6e0
mov esi, eax
jmp 0x100cdf4c
xor esi, esi
push dword [0x100ef9fc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100cdf64
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
push esi
push dword [0x100ef9fc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
pop esi
ret
Function at 0x403bf8
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x403c54
push ecx
push 0
mov eax, esp
push 0
push eax
mov eax, dword [ebx + 8]
mul ecx
push eax
push esi
push dword [ebx]
call sub.kernel32.dll_ReadFile
dec eax
pop eax
pop ecx
jne 0x403c46
xor edx, edx
div dword [ebx + 8]
mov edx, dword [esp + 0xc]
test edx, edx
je 0x403c3b
mov dword [edx], eax
pop esi
pop ebx
ret 4
cmp eax, ecx
je 0x403c36
mov eax, 0x64
jmp 0x403c4b
call sub.kernel32.dll_GetLastError
call fcn.0040266c
xor eax, eax
jmp 0x403c36
mov eax, 0x67
jmp 0x403c4b

Function at 0x403c5c
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov eax, dword [eax + 4]
sub eax, 0xd7b2
cmp eax, 1
ja 0x403cb7
push ecx
push 0
mov eax, esp
push 0
push eax
mov eax, dword [ebx + 8]
mul ecx
push eax
push esi
push dword [ebx]
call sub.kernel32.dll_WriteFile
dec eax
pop eax
pop ecx
jne 0x403ca9
xor edx, edx
div dword [ebx + 8]
mov edx, dword [esp + 0xc]
test edx, edx
je 0x403c9e
mov dword [edx], eax
pop esi
pop ebx
ret 4
cmp eax, ecx
je 0x403c99
mov eax, 0x65
jmp 0x403cae
call sub.kernel32.dll_GetLastError
call fcn.0040266c
xor eax, eax
jmp 0x403c99
mov eax, 0x67
jmp 0x403cae

Function at 0x403d40
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, eax
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x403d70
push 0
push dword [ebx]
call sub.kernel32.dll_GetFileSize
cmp eax, 0xffffffff
je 0x403d66
xor edx, edx
div dword [ebx + 8]
pop ebx
ret
call fcn.0040267c
or eax, 0xffffffff
jmp 0x403d64
mov eax, 0x67
call fcn.0040266c
or eax, 0xffffffff
jmp 0x403d64

Function at 0x405308
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405341
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403200
jmp 0x40534a
mov eax, ebx
mov edx, esi
call fcn.004031b4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405354
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405375
mov al, byte [esp]
jmp 0x405377
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x407118
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40f580
mov eax, esi
mov edx, 8
test al, 1
je 0x407134
shr eax, 1
xor eax, 0xedb88320
jmp 0x407136
shr eax, 1
dec edx
jne 0x407127
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x407120
pop esi
ret
Function at 0x40714c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp byte [0x40f57c], 0
jne 0x40716a
call fcn.00407118
mov byte [0x40f57c], 1
mov eax, edi
test esi, esi
je 0x407195
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40f580]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x407170
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40af80
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40b005
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x40afe8
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0040b28c
mov eax, dword [ebp - 0xc]
call fcn.004033a0
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40afef
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x40b090
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetCommandLineA_1
mov ebx, eax
xor eax, eax
mov dl, byte [ebx]
sub dl, 1
jb 0x40b0bc
sub dl, 0x1f
je 0x40b0b4
sub dl, 2
je 0x40b0b0
jmp 0x40b0b8
xor al, 1
jmp 0x40b0b8
test al, al
je 0x40b0bc
inc ebx
jmp 0x40b09d
inc ebx
cmp byte [ebx], 0x20
je 0x40b0bb
mov eax, esi
mov edx, ebx
call fcn.00403230
pop esi
pop ebx
ret

Function at 0x40b330
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00404e90
add esp, 0x104
pop ebx
ret

Function at 0x40ba60
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
cmp dword [0x40d07c], 2
jne 0x40bacd
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x40ba85
call fcn.0040ba40
jmp 0x40badf
lea eax, [esp + 8]
push eax
push 0x40bae4
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x40bacd
call fcn.0040ba40
jmp 0x40badf
push 0
push 2
call sub.user32.dll_ExitWindowsEx
test eax, eax
jne 0x40badf
call fcn.0040ba40
add esp, 0x14
ret
Function at 0x40baf8
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebx
push esi
push edi
mov edi, eax
mov ebx, edx
dec ebx
test ebx, ebx
jl 0x40bb3e
inc ebx
xor esi, esi
test esi, esi
je 0x40bb15
push 0xfa
call sub.kernel32.dll_Sleep
mov eax, edi
call fcn.004033a0
push eax
call sub.kernel32.dll_DeleteFileA
test eax, eax
jne 0x40bb3e
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x40bb3e
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x40bb3e
inc esi
dec ebx
jne 0x40bb07
pop edi
pop esi
pop ebx
ret

Function at 0x40bca4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
lea ebx, [ebp - 0x74]
xor eax, eax
push ebp
push 0x40bd96
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x78]
mov eax, esi
call fcn.0040b2d8
push dword [ebp - 0x78]
push 0x40bdac
push edi
lea eax, [ebp - 4]
mov edx, 3
call fcn.004032ac
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402738
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004033a0
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x40bd2f
mov al, 0x5d
call fcn.0040bb44
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x40bd46
push ebx
call sub.user32.dll_TranslateMessage
push ebx
call sub.user32.dll_DispatchMessageA
push 1
push 0
push 0
push 0
push ebx
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x40bd3a
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x40bd46
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bd9d
lea eax, [ebp - 0x78]
call fcn.00403120
lea eax, [ebp - 4]
call fcn.00403120
ret
Function at 0x401a30
Capabilities:
Read file on windows

Disassembly:
sub esp, 4
cmp dword [0x40932c], 0
jne 0x401a88
lea eax, [esp]
push 0
push eax
mov ecx, dword [0x409320]
push 0x1000
push 0x409330
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x401a67
mov eax, 0xffffffff
add esp, 4
ret
mov eax, dword [esp]
mov dword [0x40932c], eax
cmp eax, 1
jge 0x401a7e
mov eax, 0xffffffff
add esp, 4
ret
mov dword [0x409324], 0x409330
mov ecx, dword [0x409324]
xor eax, eax
inc dword [0x409328]
dec dword [0x40932c]
inc dword [0x409324]
mov al, byte [ecx]
add esp, 4
ret

Function at 0x401ab0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
xor eax, eax
mov dword [0x409328], eax
mov dword [0x40932c], eax
push esi
push edi
mov ecx, dword [esp + 0x14]
push eax
push pe_nt_image_headers32
push 3
push eax
push 3
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x409320], eax
cmp eax, 0xffffffff
jne 0x401aee
xor eax, eax
pop edi
pop esi
add esp, 8
ret
mov esi, dword [esp + 0x18]
test esi, esi
jne 0x401b12
push 0
mov eax, dword [0x409320]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 8
ret
call fcn.00401a30
test eax, eax
jl 0x401b8a
cmp eax, 0x2a
jne 0x401b12
lea edi, [esi + 3]
cmp byte [edi], 0
je 0x401b3f
call fcn.00401a30
movsx ecx, byte [edi]
cmp eax, ecx
jne 0x401b3a
inc edi
cmp byte [edi], 0
jne 0x401b28
cmp byte [edi], 0
jne 0x401b12
call fcn.00401a30
cmp eax, 0x3a
jne 0x401b12
push 0
mov eax, dword [0x409328]
push 0
mov ecx, dword [0x409320]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [esp + 0xc]
push 0
lea eax, [esp + 0xc]
push ecx
push 4
mov edx, dword [0x409320]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x401b92
mov eax, 0xffffffff
pop edi
pop esi
add esp, 8
ret
xor eax, eax
pop edi
pop esi
add esp, 8
ret
mov eax, dword [esp + 0xc]
mov dword [0x40932c], eax
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 8
ret

Function at 0x401bb0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 4
lea ecx, [esp]
push esi
mov esi, dword [eax + 4]
push 0
push ecx
mov eax, dword [eax]
push esi
mov edx, dword [0x409320]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x401bde
xor eax, eax
pop esi
add esp, 4
ret
mov eax, dword [esp + 4]
sub eax, esi
pop esi
cmp eax, 1
sbb eax, eax
add esp, 4
neg eax
ret
Function at 0x401bf0
Capabilities:
Get common file path
Query environment variable
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x401d1f
push eax
mov dword fs:[0], esp
mov eax, dword [ebp + 0xc]
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
push eax
push ecx
call fcn.00401ab0
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x401c5d
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 4], esi
call fcn.00401bb0
add esp, 4
test eax, eax
jne 0x401c6d
mov dword [ebp - 4], 0xffffffff
call fcn.00401d29
mov eax, dword [ebp - 0xc]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x100
push 0x409218
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x401c8d
mov byte [0x409218], 0
cmp byte [0x409218], 0
jne 0x401ca6
push 0x100
push 0x409218
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str.gifplay.mid
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
mov edi, 0x409218
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0
and ecx, 3
push pe_nt_image_headers32
rep movsb byte es:[edi], byte [esi]
push 2
push 0
push 0
push 0x40000000
push 0x409218
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov esi, eax
je 0x401c51
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x18]
push ebx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401c51
Function at 0x401d70
Capabilities:
Get common file path
Query environment variable
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x401e9f
push eax
mov dword fs:[0], esp
mov eax, dword [ebp + 0xc]
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
push eax
push ecx
call fcn.00401ab0
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x401ddd
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 4], esi
call fcn.00401bb0
add esp, 4
test eax, eax
jne 0x401ded
mov dword [ebp - 4], 0xffffffff
call fcn.00401ea9
mov eax, dword [ebp - 0xc]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x100
push 0x409118
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x401e0d
mov byte [0x409118], 0
cmp byte [0x409118], 0
jne 0x401e26
push 0x100
push 0x409118
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str.gifplay.wav
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
mov edi, 0x409118
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0
and ecx, 3
push pe_nt_image_headers32
rep movsb byte es:[edi], byte [esi]
push 2
push 0
push 0
push 0x40000000
push 0x409118
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov esi, eax
je 0x401dd1
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x18]
push ebx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401dd1