joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45cbac
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x404
lea eax, [esp + 4]
mov edx, str.SOFTWAREMetaQuotes_SoftwareSettings
push ebx
push ebp
push 0x100
push 0x3fe
push eax
mov ebp, str.Email
mov ebx, closesocket
push ebp
mov ecx, ebx
call fcn.00403dd1
add esp, 0x10
test al, al
je 0x45cbed
cmp word [esp + 0xc], 0
jne 0x45cc84
push esi
push edi
lea eax, [esp + 0x10]
xor esi, esi
push eax
push 0x20119
push esi
push str.SOFTWAREMicrosoftIdentityCRLUserExtendedProperties
push ebx
mov dword [esp + 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [esp + 0x10]
xor ecx, ecx
test eax, eax
cmovne edi, ecx
mov dword [esp + 0x10], edi
test edi, edi
je 0x45cc82
xor eax, eax
push 0x1ff
mov word [esp + 0x18], ax
lea eax, [esp + 0x18]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x45cc7b
lea eax, [esp + 0x14]
push 0x200
push eax
call fcn.0042ad83
pop ecx
pop ecx
lea eax, [esp + 0x14]
push eax
call fcn.0045cb29
cmp eax, 6
ja 0x45cc64
inc esi
cmp esi, 0xa
jb 0x45cc1f
jmp 0x45cc7b
push ecx
lea eax, [esp + 0x18]
mov edx, str.SOFTWAREMetaQuotes_SoftwareSettings
push eax
push ecx
push ebp
mov ecx, ebx
call fcn.00403d10
add esp, 0x10
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x404
ret

Function at 0x45d657
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
lea eax, [ebp - 0x210]
push esi
push edi
push eax
xor eax, eax
mov edi, ecx
push eax
push eax
push 0x1a
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x45d6e1
lea eax, [ebp - 4]
mov esi, 0x104
push eax
mov edx, esi
lea ecx, [ebp - 0x210]
call fcn.0043c8dd
test eax, eax
js 0x45d6b2
mov eax, dword [ebp - 4]
sub esi, eax
push ecx
push str.MetaQuotesWebInstall
push ecx
lea ecx, [ebp - 0x210]
mov edx, esi
lea ecx, [ecx + eax*2]
call fcn.0043c81b
push ecx
xor edx, edx
lea ecx, [ebp - 0x210]
call fcn.0045c164
pop ecx
mov ecx, dword [edi + 0x3d7c]
test ecx, ecx
je 0x45d6e1
mov ecx, dword [ecx + 0x3d70]
test ecx, ecx
je 0x45d6e1
push ecx
add ecx, 0x20
xor edx, edx
call fcn.0045c164
pop ecx
pop edi
pop esi
leave
ret
Function at 0x45d79f
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esp + 0xc]
sub esp, 0xf4
mov eax, 0x5a4d
push ebx
push ebp
push esi
push edi
cmp word [edx], ax
jne 0x45d895
mov eax, dword [esp + 0x114]
mov ebx, dword [edx + 0x3c]
mov ebp, dword [eax]
cmp ebx, ebp
jge 0x45d895
cmp dword [ebx + edx], 0x4550
jne 0x45d895
movzx eax, word [ebx + edx + 4]
mov ecx, 0x14c
cmp ax, cx
je 0x45d825
mov ecx, 0x8664
cmp ax, cx
jne 0x45d895
lea esi, [edx + 0x18]
push 0x3c
add esi, ebx
lea edi, [esp + 0x14]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x108]
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0xa4]
mov dword [esi], eax
mov eax, 0xa8
jmp 0x45d84f
lea esi, [edx + 0x18]
push 0x38
add esi, ebx
lea edi, [esp + 0x14]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x108]
mov eax, dword [esp + 0x90]
mov ecx, dword [esp + 0x94]
mov dword [esi], eax
mov eax, 0x98
mov dword [esi + 4], ecx
lea edi, [ebx + eax]
mov ecx, dword [esp + 0x10c]
test ecx, ecx
je 0x45d891
test edi, edi
je 0x45d891
cmp dword [esi], 0
je 0x45d891
mov eax, dword [esi + 4]
test eax, eax
je 0x45d891
cmp edi, ebp
jae 0x45d895
add eax, ecx
mov dword [esi + 4], eax
lea eax, [ecx + ebp]
mov ecx, dword [esp + 0x114]
mov dword [ecx], eax
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [edi + edx], eax
mov dword [edi + edx + 4], ecx
mov al, 1
jmp 0x45d897
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret 0x10
Function at 0x45d8a4
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x22c
push ebx
push ebp
push esi
push edi
xor eax, eax
lea edi, [esp + 0x14]
stosd dword es:[edi], eax
xor ebx, ebx
push 0x40
mov esi, ecx
mov dword [esp + 0x14], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push eax
call fcn.004014fb
cmp eax, 0x40
jne 0x45da08
mov eax, 0x5a4d
cmp word [esp + 0x28], ax
jne 0x45da08
mov eax, dword [esp + 0x64]
mov ecx, esi
push ebx
cdq
push edx
push eax
call fcn.004014af
mov ecx, eax
mov edi, edx
mov eax, dword [esp + 0x64]
cdq
cmp ecx, eax
jne 0x45da08
cmp edi, edx
jne 0x45da08
push 4
lea eax, [esp + 0x14]
mov ecx, esi
push eax
call fcn.004014fb
cmp eax, 4
jne 0x45da08
cmp dword [esp + 0x10], 0x4550
jne 0x45da08
push 0x14
lea eax, [esp + 0x18]
mov ecx, esi
push eax
call fcn.004014fb
cmp eax, 0x14
jne 0x45da08
mov eax, 0x14c
cmp word [esp + 0x14], ax
je 0x45d966
mov eax, 0x8664
cmp word [esp + 0x14], ax
jne 0x45da08
mov edi, 0xe0
lea eax, [esp + 0x68]
push edi
push ebx
push eax
call fcn.0041cce0
add esp, 0xc
lea ebp, [edi + 0x10]
lea eax, [esp + 0x148]
push ebp
push ebx
push eax
call fcn.0041cce0
add esp, 0xc
lea eax, [edi + 0x6c]
mov ecx, esi
push 1
push ebx
push ebx
cmp word [esp + 0x20], ax
jne 0x45d9d1
call fcn.004014af
push edi
lea eax, [esp + 0x6c]
mov ecx, esi
push eax
call fcn.004014fb
cmp eax, edi
jne 0x45da08
mov eax, dword [esp + 0x240]
mov ecx, dword [esp + 0xe8]
mov edx, dword [esp + 0xec]
mov dword [eax], ecx
mov dword [eax + 4], edx
jmp 0x45da04
call fcn.004014af
push ebp
lea eax, [esp + 0x14c]
mov ecx, esi
push eax
call fcn.004014fb
cmp eax, ebp
jne 0x45da08
mov ecx, dword [esp + 0x240]
mov edx, dword [esp + 0x1d8]
mov esi, dword [esp + 0x1dc]
mov dword [ecx], edx
mov dword [ecx + 4], esi
mov al, 1
jmp 0x45da0a
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x22c
ret 8
Function at 0x45ddd8
Capabilities:
Query service status
Stop service

Disassembly:
sub esp, 0x1c
push ebx
xor ebx, ebx
push ebp
push edi
cmp dword [esp + 0x2c], ebx
je 0x45de16
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x45de16
push 0xf01ff
push dword [esp + 0x30]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebp, eax
test ebp, ebp
jne 0x45de21
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
pop edi
pop ebp
pop ebx
add esp, 0x1c
ret 4
push esi
mov esi, ebx
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x45de98
cmp dword [esp + 0x14], 1
je 0x45de96
cmp dword [esp + 0x14], 4
je 0x45de5c
cmp dword [esp + 0x14], 7
je 0x45de5c
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x3c
jb 0x45de24
jmp 0x45de98
lea eax, [esp + 0x10]
push eax
push 1
push ebp
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x45de8f
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x45de98
cmp dword [esp + 0x14], 1
je 0x45de96
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x3c
jb 0x45de6c
jmp 0x45de98
mov bl, 1
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call esi
push edi
call esi
mov al, bl
pop esi
jmp 0x45de18
Function at 0x45deac
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
cmp dword [ebp + 8], esi
je 0x45dffb
push 4
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x45dffb
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push 3
push 0x30
push ebx
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
test eax, eax
jne 0x45df11
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x45dff4
mov eax, dword [ebp - 8]
xor edx, edx
push 0x45f8cc
push 0x24
pop edi
div edi
xor ecx, ecx
inc eax
mul edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041ae2d
mov edi, eax
mov dword [ebp - 0x18], edi
pop ecx
pop ecx
test edi, edi
je 0x45dff4
mov eax, dword [ebp - 8]
xor edx, edx
push 0x24
pop ecx
div ecx
inc eax
imul eax, eax, 0x24
push eax
push esi
push edi
call fcn.0041cce0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push 3
push 0x30
push ebx
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
test eax, eax
je 0x45dfed
cmp dword [ebp - 0xc], esi
jbe 0x45dfed
push 0x24
pop ebx
lea ecx, [ebp - 0x234]
call fcn.00403638
cmp dword [edi], 0
je 0x45dfdf
mov eax, ecx
push eax
push dword [edi]
call fcn.0045dc79
test al, al
je 0x45dfdf
mov ecx, dword [ebp + 8]
call fcn.004095cd
cmp dword [ebp - 0x230], 0
je 0x45dfc4
push eax
push dword [ebp + 8]
push dword [ebp - 0x230]
call fcn.0042c380
add esp, 0xc
jmp 0x45dfce
cmp dword [ebp - 0x22c], 1
sbb eax, eax
inc eax
test eax, eax
jne 0x45dfdf
cmp dword [edi + 0xc], 1
je 0x45dfdf
push dword [edi]
call fcn.0045ddd8
inc esi
add edi, ebx
cmp esi, dword [ebp - 0xc]
jb 0x45df81
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
push edi
call fcn.0041ae36
pop ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x45e002
Capabilities:
Enumerate processes
Get process image filename

Disassembly:
sub esp, 0x438
lea eax, [esp + 8]
push 0x228
push 0
push eax
call fcn.0041cce0
add esp, 0xc
cmp dword [esp + 0x43c], 0
je 0x45e121
push esi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x45e120
lea eax, [esp + 8]
mov dword [esp + 8], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x45e119
push ebp
push edi
push dword [esp + 0x18]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebp, eax
test ebp, ebp
je 0x45e103
push 0x104
lea eax, [esp + 0x240]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x45e0fc
lea eax, [esp + 0x23c]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
push dword [esp + 0x448]
lea eax, [esp + 0x240]
push eax
call fcn.0041bfde
pop ecx
pop ecx
test eax, eax
je 0x45e0fc
push 0
call dword [sym.imp.USER32.dll_GetTopWindow]
jmp 0x45e0e7
and dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0xc]
cmp eax, dword [esp + 0x18]
je 0x45e0ef
push 2
push edi
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
test edi, edi
jne 0x45e0c3
jmp 0x45e0fc
push 0
push 0
push 0x12
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x45e05e
pop edi
pop ebp
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
add esp, 0x438
ret 4
Function at 0x45e130
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x88c
lea ecx, [esp + 4]
push ebx
push esi
push edi
call fcn.00403638
lea ecx, [esp + 0x680]
call fcn.00403638
push 0x208
xor ebx, ebx
lea eax, [esp + 0x22c]
push ebx
push eax
call fcn.0041cce0
add esp, 0xc
lea eax, [esp + 0x228]
push 0x103
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
mov esi, dword [ebp + 8]
test esi, esi
je 0x45e298
cmp word [esi], bx
je 0x45e298
push esi
lea eax, [esp + 0x684]
push 0x47810c
push eax
call fcn.004011fb
add esp, 0xc
lea eax, [esp + 0x430]
push eax
push dword [esp + 0x688]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x45e298
test byte [esp + 0x430], 0x10
jne 0x45e27a
lea eax, [esp + 0x45c]
push eax
push esi
lea eax, [esp + 0x18]
push 0x470fa8
push eax
call fcn.004011fb
mov ecx, dword [esp + 0x24]
add esp, 0x10
test ecx, ecx
je 0x45e255
mov eax, dword [esp + 0x18]
inc eax
push eax
push ecx
call fcn.0042ad83
pop ecx
pop ecx
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x45e255
lea edx, [esp + 0x228]
mov eax, ecx
mov bx, word [eax]
cmp bx, word [edx]
jne 0x45e24e
test bx, bx
je 0x45e24a
mov bx, word [eax + 2]
cmp bx, word [edx + 2]
jne 0x45e24e
add eax, 4
add edx, 4
test bx, bx
jne 0x45e228
xor eax, eax
jmp 0x45e25d
sbb eax, eax
or eax, 1
jmp 0x45e25d
cmp dword [esp + 0x18], 1
sbb eax, eax
inc eax
test eax, eax
je 0x45e27a
push 0x46cfbc
push ecx
call fcn.0041bfde
pop ecx
pop ecx
push eax
call fcn.0045e002
push esi
call fcn.0045deac
lea eax, [esp + 0x430]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x45e1d8
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x432001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x40229b
Capabilities:
Delete file
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
push edi
xor esi, esi
mov dword [ebp - 8], ecx
push eax
inc esi
mov dword [ebx], eax
push eax
mov dword [ebp - 4], esi
call fcn.00439702
pop ecx
pop ecx
push 0
push 0x80000080
push 2
push 0
push esi
push 0xc0000000
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
push 0xfffffffffffffff5
call esi
push 0xfffffffffffffff4
mov dword [ebp - 0xc], eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_SetStdHandle]
push edi
push 0xfffffffffffffff5
mov dword [ebp - 0x10], eax
call esi
push edi
push 0xfffffffffffffff4
call esi
call fcn.00401e5a
mov dword [ebp + 0xc], eax
test eax, eax
je 0x402328
push dword [ebp + 8]
mov edx, dword [ebp - 8]
push ecx
mov ecx, eax
call fcn.00402095
pop ecx
pop ecx
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x40233d
push str._Could_not_load_Python_
push 2
call fcn.00410048
pop ecx
push eax
call fcn.004015ea
pop ecx
pop ecx
push dword [ebp - 0xc]
push 0xfffffffffffffff5
call esi
push dword [ebp - 0x10]
push 0xfffffffffffffff4
call esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, 0x1000
cmp eax, esi
jae 0x402368
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea eax, [esi + 1]
push eax
call fcn.004350fa
mov dword [ebx], eax
pop ecx
test eax, eax
je 0x4023a0
xor eax, eax
push eax
push eax
push eax
push edi
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp + 0xc]
push eax
push esi
push dword [ebx]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebx]
mov eax, dword [ebp + 0xc]
mov byte [eax + ecx], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4027f7
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push 0x46eb00
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x402826
xor eax, eax
jmp 0x40286f
push edi
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
push ebx
push ebx
push 2
push ebx
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
push esi
call ebx
xor eax, eax
test edi, edi
je 0x40286e
push eax
push eax
push eax
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push edi
mov esi, eax
call ebx
mov eax, dword [ebp - 4]
mov dword [0x46e9d4], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406820
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x406906
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x4068f5
jg 0x406860
test edx, edx
je 0x4068f5
nop dword [eax]
call fcn.00407b30
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x4068b4
jg 0x406877
test esi, esi
je 0x4068b4
cmp ebx, eax
jg 0x406887
jl 0x406881
cmp edi, esi
jae 0x406887
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.0040d050
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x4068d9
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x4068ef
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x406860
jl 0x4068ef
test edi, edi
jne 0x406860
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov edx, dword [eax]
lea eax, [ecx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
test edx, edx
je 0x40692e
mov eax, dword [eax]
mov edx, dword [eax]
jmp 0x406934
xor edx, edx
mov dword [esp + 0x18], eax
mov eax, edx
cdq
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
test edi, edi
jl 0x40699c
jg 0x406949
test esi, esi
je 0x40699c
test edx, edx
jl 0x406997
jg 0x406953
test eax, eax
je 0x406997
cmp edi, edx
jg 0x406967
jl 0x40695d
cmp esi, eax
jae 0x406967
mov eax, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov ebx, dword [ebp + 8]
push eax
push ebx
push dword [esp + 0x24]
call fcn.0040d050
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x14]
add ebx, edx
mov ecx, dword [esp + 0xc]
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x10]
sub dword [eax], edx
mov eax, dword [ecx + 0x20]
add dword [eax], edx
jmp 0x40699f
mov ebx, dword [ebp + 8]
jmp 0x4069a9
mov ebx, dword [ebp + 8]
test edi, edi
jl 0x4069c2
jg 0x4069a9
test esi, esi
je 0x4069c2
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x4069c2
push eax
push esi
push 1
push ebx
call fcn.00411c4b
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406f10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x437050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x406f40
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040bbbb
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x406f7c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x406f7c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040bbbb
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x407064
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x406fa4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x406fd7
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.004122a9
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040bbbb
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x407037
sub eax, 1
je 0x407037
sub eax, 2
jne 0x407064
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.004122a9
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040bbbb
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x407054
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00411c4b
add esp, 0x10
cmp edi, eax
jne 0x407064
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x406f67
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040bbbb
mov esp, ebp
pop ebp
ret 4
Function at 0x407730
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x437050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x4077ea
cmp byte [esi + 0x3d], 0
je 0x4077ea
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4077d8
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x4077a0
sub eax, 1
je 0x4077a4
sub eax, 2
jne 0x4077d8
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040bbbb
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4077c1
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00411c4b
add esp, 0x10
cmp edi, eax
jne 0x4077d8
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040bbbb
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040bbbb
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0040bbbb
mov esp, ebp
pop ebp
ret