joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40323c
Capabilities:
Accept command line arguments
Get common file path
Get file system object information

Disassembly:
sub esp, 0x180
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
xor esi, esi
mov byte [esp + 0x14], 0x20
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push RegEnumValueA
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
push 8
mov dword [0x423f58], eax
call fcn.00405e88
mov dword [0x423ea4], eax
push ebx
lea eax, [esp + 0x34]
push 0x160
push eax
push ebx
push 0x41f458
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push str.NSIS_Error
push 0x4236a0
call fcn.00405b66
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, 0x429000
push eax
push edi
call fcn.00405b66
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp byte [0x429000], 0x22
mov dword [0x423ea0], eax
mov eax, edi
jne 0x4032dd
mov byte [esp + 0x14], 0x22
mov eax, 0x429001
push dword [esp + 0x14]
push eax
call fcn.00405684
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [esp + 0x1c], eax
jmp 0x403357
cmp cl, 0x20
jne 0x4032ff
inc eax
cmp byte [eax], 0x20
je 0x4032f9
cmp byte [eax], 0x22
mov byte [esp + 0x14], 0x20
jne 0x40330f
inc eax
mov byte [esp + 0x14], 0x22
cmp byte [eax], 0x2f
jne 0x403347
inc eax
cmp byte [eax], 0x53
jne 0x403328
mov cl, byte [eax + 1]
or cl, 0x20
cmp cl, 0x20
jne 0x403328
or esi, 2
cmp dword [eax], 0x4352434e
jne 0x40333e
mov cl, byte [eax + 4]
or cl, 0x20
cmp cl, 0x20
jne 0x40333e
or esi, 4
cmp dword [eax - 2], 0x3d442f20
je 0x40335f
push dword [esp + 0x14]
push eax
call fcn.00405684
cmp byte [eax], 0x22
jne 0x403357
inc eax
mov cl, byte [eax]
cmp cl, bl
jne 0x4032f4
jmp 0x403370
mov dword [eax - 2], ebx
add eax, 2
push eax
push 0x429400
call fcn.00405b66
mov ebp, 0x42a400
push ebp
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call fcn.00403208
test eax, eax
jne 0x4033aa
push 0x3fb
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.Temp
add byte [eax], al
add byte [eax], al
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
je 0x4033d0
adc bh, bh
je 0x4033d4
adc bh, bh
je 0x4033d8
adc bh, bh
je 0x4033dc
adc byte [eax - 0x74], ch
cmp dword [eax], eax
push 0x4083a4
call fcn.0040373c
add esp, 0x18
ret
mov eax, dword [eax]
cmp dword [eax], 0xe06d7363
arpl word [ebx + 0x6d], si
loopne 0x40344e
jne 0x403404
sub al, byte [ebx + 0x75031078]
and al, 0x8b
inc eax
adc al, 0x3d
and byte [0x15741993], al
cmp dword [eax + 0x10], 3
adc byte [ebx], al
jne 0x403404
mov eax, dword [eax + 0x14]
cmp eax, 0x19930520
je 0x4033ff
cmp eax, 0x19930521
je 0x4033ff
cmp eax, 0x19930522
je 0x4033ff
cmp eax, 0x1994000
jne 0x403404
call 0x40334a
xor eax, eax
ret 0x658d
call fcn.004035bd
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp dword [esp + 0x10], ebx
invalid
Function at 0x40334a
Capabilities:
Get common file path

Disassembly:
sub esp, 0x180
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
xor esi, esi
mov byte [esp + 0x14], 0x20
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push RegEnumValueA
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
push 8
mov dword [0x423f58], eax
call fcn.00405e88
mov dword [0x423ea4], eax
push ebx
lea eax, [esp + 0x34]
push 0x160
push eax
push ebx
push 0x41f458
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push str.NSIS_Error
push 0x4236a0
call fcn.00405b66
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, 0x429000
push eax
push edi
call fcn.00405b66
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp byte [0x429000], 0x22
mov dword [0x423ea0], eax
mov eax, edi
jne 0x4032dd
mov byte [esp + 0x14], 0x22
mov eax, 0x429001
push dword [esp + 0x14]
push eax
call fcn.00405684
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [esp + 0x1c], eax
jmp 0x403357
cmp cl, 0x20
jne 0x4032ff
inc eax
cmp byte [eax], 0x20
je 0x4032f9
cmp byte [eax], 0x22
mov byte [esp + 0x14], 0x20
jne 0x40330f
inc eax
mov byte [esp + 0x14], 0x22
cmp byte [eax], 0x2f
jne 0x403347
inc eax
cmp byte [eax], 0x53
jne 0x403328
mov cl, byte [eax + 1]
or cl, 0x20
cmp cl, 0x20
jne 0x403328
or esi, 2
cmp dword [eax], 0x4352434e
jne 0x40333e
mov cl, byte [eax + 4]
or cl, 0x20
cmp cl, 0x20
jne 0x40333e
or esi, 4
cmp dword [eax - 2], 0x3d442f20
je 0x40335f
push dword [esp + 0x14]
push eax
call fcn.00405684
cmp byte [eax], 0x22
jne 0x403357
inc eax
mov cl, byte [eax]
cmp cl, bl
jne 0x4032f4
jmp 0x403370
mov dword [eax - 2], ebx
add eax, 2
push eax
push 0x429400
call fcn.00405b66
mov ebp, 0x42a400
push ebp
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call fcn.00403208
test eax, eax
jne 0x4033aa
push 0x3fb
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.Temp
add byte [eax], al
add byte [eax], al
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
je 0x4033d0
adc bh, bh
je 0x4033d4
adc bh, bh
je 0x4033d8
adc bh, bh
je 0x4033dc
adc byte [eax - 0x74], ch
cmp dword [eax], eax
push 0x4083a4
call fcn.0040373c
add esp, 0x18
ret
mov eax, dword [eax]
cmp dword [eax], 0xe06d7363
arpl word [ebx + 0x6d], si
loopne 0x40344e
jne 0x403404
sub al, byte [ebx + 0x75031078]
and al, 0x8b
inc eax
adc al, 0x3d
and byte [0x15741993], al
cmp dword [eax + 0x10], 3
adc byte [ebx], al
jne 0x403404
mov eax, dword [eax + 0x14]
cmp eax, 0x19930520
je 0x4033ff
cmp eax, 0x19930521
je 0x4033ff
cmp eax, 0x19930522
je 0x4033ff
cmp eax, 0x1994000
jne 0x403404
call 0x40334a
xor eax, eax
ret 0x658d
call fcn.004035bd
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp dword [esp + 0x10], ebx
invalid
Function at 0x403438
Capabilities:
Copy file
Create directory
Delete file
Set current directory
Shutdown system
Terminate process

Disassembly:
test ch, ah
add byte [eax], al
add byte [eax + 0x10], ch
add byte [eax], ah
add bh, bh
je 0x403469
adc al, 0xe8
fcomp qword [edi]
add byte [eax], al
inc eax
add byte [ebp + 0x53b974c0], al
Function at 0x40373c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
add bh, al
add eax, 0x423f3c
add byte [eax], al
add dword [eax], eax
call fcn.0040573a
test eax, eax
jne 0x4037d5
mov ecx, dword [esi + 0x48]
cmp ecx, ebx
je 0x4037d5
mov edx, dword [esi + 0x4c]
mov eax, dword [0x423ed8]
mov edi, 0x422e40
push ebx
add edx, eax
push edi
add ecx, eax
push edx
push ecx
push dword [esi + 0x44]
call fcn.00405a4d
mov al, byte [0x422e40]
cmp al, bl
je 0x4037d5
cmp al, 0x22
jne 0x403794
mov edi, 0x422e41
push 0x22
push edi
call fcn.00405684
mov byte [eax], bl
push edi
call sub.KERNEL32.dll_lstrlenA
lea eax, [eax + edi - 4]
cmp eax, edi
jbe 0x4037c8
push str..exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4037c8
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4037c2
test al, 0x10
jne 0x4037c8
push edi
call fcn.004056a0
push edi
call fcn.00405659
push eax
push ebp
call fcn.00405b66
push ebp
call fcn.0040573a
test eax, eax
jne 0x4037eb
push dword [esi + 0x118]
push ebp
call fcn.00405b88
push 0x8040
push ebx
push ebx
push 1
push 0x67
push dword [0x423ea0]
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [0x423688], eax
cmp dword [esi + 0x50], 0xffffffff
mov edi, 0x423640
je 0x40389f
mov ecx, dword [0x423ea0]
mov dword [0x423654], eax
lea eax, [esp + 0x10]
push edi
mov dword [esp + 0x14], 0x624e5f
mov dword [0x423644], 0x401000
mov dword [0x423650], ecx
mov dword [0x423664], eax
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
je 0x40396e
lea eax, [esp + 0x14]
push ebx
push eax
push ebx
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push ebx
push dword [0x423ea0]
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x20]
push ebx
push ebx
push eax
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x28]
push dword [esp + 0x30]
push dword [esp + 0x30]
push 0x80000000
push ebx
push eax
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x420478], eax
push ebx
call fcn.0040140b
test eax, eax
je 0x4038b1
push 2
pop eax
jmp 0x403970
call fcn.00403978
cmp dword [0x423f40], ebx
jne 0x403945
push 5
push dword [0x420478]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.RichEd20
call esi
test eax, eax
jne 0x4038e8
push str.RichEd32
call esi
mov esi, dword [sym.imp.USER32.dll_GetClassInfoA]
mov ebp, str.RichEdit20A
push edi
push ebp
push ebx
call esi
test eax, eax
jne 0x403912
push edi
push str.RichEdit
push ebx
call esi
push edi
mov dword [0x423664], ebp
call dword [sym.imp.USER32.dll_RegisterClassA]
mov eax, dword [0x423680]
push ebx
add eax, 0x69
push 0x403a45
movzx eax, ax
push ebx
push eax
push dword [0x423ea0]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 5
mov esi, eax
call fcn.0040140b
push 1
call fcn.004035ff
mov eax, esi
jmp 0x403970
push ebx
call fcn.00404fd6
test eax, eax
je 0x403967
cmp dword [0x42366c], ebx
jne 0x4038a9
push 2
call fcn.0040140b
jmp 0x4038a9
push 1
call fcn.0040140b
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x6988686d
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x73fd417e
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x40ce09
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422234]
jne 0x40ce13
repz ret
jmp fcn.00413639

Function at 0x413b7e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004104e0
and dword [ebp - 4], 0
cmp dword [0x423e1c], 0
mov ebx, eax
jne 0x413c2f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x413ce0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x413ce0
push eax
call fcn.0041046e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x423e1c], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x423e20], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x423e24], eax
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e2c], eax
test eax, eax
je 0x413c2f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e28], eax
mov eax, dword [0x423e28]
cmp eax, ebx
je 0x413c87
cmp dword [0x423e2c], ebx
je 0x413c87
push eax
call fcn.004104e9
push dword [0x423e2c]
mov esi, eax
call fcn.004104e9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413c87
test edi, edi
je 0x413c87
call esi
test eax, eax
je 0x413c7e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413c7e
test byte [ebp - 0xc], 1
jne 0x413c87
or dword [ebp + 0x10], 0x200000
jmp 0x413cc0
mov eax, dword [0x423e20]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x413cc0
mov eax, dword [0x423e24]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x423e1c]
call fcn.004104e9
pop ecx
test eax, eax
je 0x413ce0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413ce2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4105bc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43189c], 0
push esi
jne 0x4105f3
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4105cd
mov dword [ecx*4 + 0x431898], eax
inc ecx
cmp ecx, 0x100
jl 0x4105c8
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x410624
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431898]
xor eax, esi
inc ecx
dec edx
jne 0x410606
pop edi
not eax
pop esi
ret 0xc
Function at 0x4032d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x1c
cmp dword [0x43ed3c], 0
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov edi, eax
jge 0x4032eb
call fcn.00401b30
mov eax, dword [0x43ed3c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x403310
mov ecx, dword [0x43ed3c]
mov esi, 0x442358
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edi
mov eax, esi
call fcn.004022b0
mov ebx, eax
test ebx, ebx
je 0x403344
push 0x1c
lea edx, [esp + 0x14]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov eax, dword [esp + 0x10]
sub eax, ebp
add eax, dword [esp + 0x1c]
mov ecx, ebp
cmp edi, eax
cmovae edi, eax
mov eax, edi
call fcn.00406fb0
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x1c
ret

Function at 0x406800
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42cfdf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
mov esi, dword [esp + 0x44]
xor ebx, ebx
mov dword [esp + 8], ebx
mov eax, dword [esp + 0x40]
push eax
lea ecx, [esp + 0x10]
push ecx
call fcn.004061f0
mov dword [esp + 0x38], 1
lea ecx, [esp + 0xc]
call fcn.00406990
push eax
push esi
call fcn.004061f0
mov dword [esp + 8], 1
mov byte [esp + 0x38], bl
mov dword [esp + 0xc], vtable.TFileName.0
mov dword [esp + 0x38], 2
mov dword [esp + 0xc], vtable.TObject.0
mov byte [esp + 0x38], bl
lea edx, [esp + 0x1c]
mov dword [esp + 0x40], edx
mov dword [esp + 0x38], ebx
mov eax, edx
call fcn.004050a0
mov ecx, dword [esp + 0x30]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x34
ret 8

Function at 0x4079f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0x20019
push 0
push 0
push 0
push edx
push 0x80000001
mov byte [esi], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x407a6c
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 4]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push str.StartupScreen
push eax
mov dword [esp + 0x24], 4
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x407a6c
cmp dword [esp + 8], 4
jne 0x407a6c
mov byte [esi], 1
mov eax, dword [esp]
test eax, eax
je 0x407a7a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 4]
add esp, 0x14
ret

Function at 0x407b40
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 4]
mov dword [0x44020c], eax
neg eax
mov dword [0x440208], ecx
mov dword [0x440200], eax
add esp, 0x24
ret
Function at 0x407d00
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42c6fa
push eax
mov dword fs:[0], esp
push esi
mov esi, dword [esp + 0x14]
push esi
call fcn.0040a090
mov dword [esp + 0xc], 0
mov dword [esi + 0x30], 1
mov dword [esp + 0xc], 0xffffffff
mov ecx, dword [esp + 4]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4

Function at 0x407d50
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42c6fa
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
push esi
mov esi, dword [esp + 0x14]
push eax
push esi
call fcn.0040a030
mov dword [esp + 0xc], 0
mov dword [esi + 0x30], 1
mov dword [esp + 0xc], 0xffffffff
mov ecx, dword [esp + 4]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 8

Function at 0x408010
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x42cd46
mov eax, dword fs:[0]
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x400
push ebp
mov ebp, dword [esp + 0x41c]
push esi
push edi
mov esi, ecx
test eax, eax
jne 0x40804f
test ebp, ebp
je 0x408180
mov dword [ebp], eax
jmp 0x408180
test ebp, ebp
je 0x40805a
mov dword [ebp], 0xffffffff
test eax, eax
jge 0x4080d6
cmp byte [esp + 0x420], 0
je 0x4080cf
mov edx, dword [esi + 0x18]
lea eax, [esp + 0x10]
push eax
call fcn.00401056
add esp, 4
mov dword [esp + 0x414], 0
mov eax, dword [eax]
push eax
mov eax, 0x4652
call fcn.00403850
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.004105c0
add esp, 0xc
mov dword [esp + 0x414], 0xffffffff
lea eax, [esp + 0x10]
call fcn.004050a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
lea eax, [esp + 0x18]
call fcn.0040ce60
lea edi, [esp + 0x20]
mov esi, eax
call fcn.0040d1a0
xor al, al
jmp 0x408182
mov ecx, dword [esi + 0x2c]
mov dword [esp + 0x18], 0
test ecx, 0x20000
je 0x4080fb
mov edx, dword [ebx]
push eax
mov eax, dword [esi + 0x30]
push edx
push eax
call dword [sym.imp.WINMM.dll_mmioRead]
mov ecx, eax
jmp 0x408179
test ecx, 0x1000000
je 0x408117
mov edi, dword [0x442610]
lea ecx, [edi + eax - 1]
mov eax, ecx
xor edx, edx
div edi
sub ecx, edx
mov eax, ecx
mov edx, dword [ebx]
push 0
lea ecx, [esp + 0x1c]
push ecx
push eax
mov eax, dword [esi + 0x30]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40816c
cmp byte [esp + 0x420], al
je 0x4080cf
mov edx, dword [esi + 0x18]
lea ecx, [esp + 0x10]
push ecx
call fcn.00401056
add esp, 4
mov dword [esp + 0x414], 1
mov eax, dword [eax]
push eax
mov eax, 0x4652
call fcn.00403850
push eax
lea edx, [esp + 0x24]
push edx
jmp 0x408096
mov ecx, dword [esp + 0x18]
mov eax, ecx
cdq
add dword [esi + 0x38], eax
adc dword [esi + 0x3c], edx
test ebp, ebp
je 0x408180
mov dword [ebp], ecx
mov al, 1
mov ecx, dword [esp + 0x40c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x40c
ret 0xc
Function at 0x4081a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push esi
test ebx, ebx
jbe 0x4082eb
mov eax, dword [edi + 0x2c]
mov ecx, eax
and ecx, 0x1000000
jne 0x4081c1
xor dl, dl
mov dword [esp + 4], 0
test eax, 0x20000
je 0x40821d
mov eax, dword [ebp + 8]
mov ecx, dword [edi + 0x30]
push ebx
push eax
push ecx
call dword [sym.imp.WINMM.dll_mmioWrite]
mov dword [esp + 4], eax
cmp eax, ebx
je 0x4082eb
test eax, eax
jl 0x4081fc
lea ecx, [edi + 8]
mov edx, 0x70
call fcn.00407f00
mov eax, 0x4653
push eax
push 0
lea eax, [esp + 0x10]
call fcn.0040ce60
mov esi, eax
xor eax, eax
call fcn.0040d2b0
pop esi
mov esp, ebp
pop ebp
ret 4
test dl, dl
je 0x408234
mov edx, dword [ebp + 8]
push ebx
push edx
mov ecx, edi
call fcn.00408300
pop esi
mov esp, ebp
pop ebp
ret 4
mov esi, ebx
test ecx, ecx
je 0x408268
mov ecx, dword [0x442610]
xor edx, edx
mov eax, ebx
div ecx
test edx, edx
je 0x408268
lea ecx, [ecx + ebx - 1]
mov eax, ecx
xor edx, edx
div dword [0x442610]
mov eax, dword [ebp + 8]
add eax, ebx
sub ecx, edx
mov esi, ecx
sub ecx, ebx
call fcn.004073a0
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x30]
push 0
lea ecx, [esp + 8]
push ecx
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4082b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [edi + 8]
mov edx, eax
mov dword [esp + 8], eax
call fcn.00407f00
mov eax, 0x4653
push eax
push 0
lea eax, [esp + 0x18]
call fcn.0040ce60
mov esi, eax
mov eax, dword [esp + 0xc]
call fcn.0040d2b0
test dword [edi + 0x2c], 0x80000
mov esi, dword [esp + 4]
je 0x4082e2
mov eax, ebx
cmp ebx, esi
jb 0x4082c7
mov eax, esi
mov ecx, dword [edi + 0x3c]
cdq
add eax, dword [edi + 0x38]
adc ecx, edx
cmp ecx, dword [edi + 0x5c]
jl 0x4082e2
jg 0x4082dc
cmp eax, dword [edi + 0x58]
jbe 0x4082e2
mov dword [edi + 0x58], eax
mov dword [edi + 0x5c], ecx
mov eax, esi
cdq
add dword [edi + 0x38], eax
adc dword [edi + 0x3c], edx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40bf80
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42cdea
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push edi
mov edi, ecx
mov eax, dword [edi + 0x18]
cmp eax, 2
jne 0x40bfc8
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push eax
push ecx
mov ebx, edi
call fcn.0040bec0
pop edi
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
cmp eax, 1
jne 0x40c101
mov ebx, dword [esp + 0x34]
push esi
push 0x2f
push ebx
call fcn.0040f5b4
add esp, 8
test eax, eax
je 0x40c085
cmp byte [ebx], 0x2f
jne 0x40c012
mov edx, dword [edi + 4]
mov eax, ebx
mov dword [edi + 8], edx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c000
sub eax, edx
cmp eax, 1
je 0x40c100
lea eax, [esp + 0xc]
push eax
call fcn.00405cf0
mov dword [esp + 0x30], 0
lea ecx, [esp + 0xc]
push ebx
push ecx
call fcn.00403ba0
mov eax, dword [esp + 0x28]
add esp, 8
test eax, eax
je 0x40c05f
mov ebx, dword [esp + 0x3c]
mov edi, edi
mov esi, dword [eax + 4]
mov eax, dword [eax + 0xc]
mov edx, esi
neg edx
sbb edx, edx
not edx
and edx, ebx
push edx
push eax
mov ecx, edi
call fcn.0040bf80
mov eax, esi
test esi, esi
jne 0x40c040
mov dword [esp + 0x30], 0xffffffff
lea eax, [esp + 0xc]
push eax
call fcn.00405cb0
pop esi
pop edi
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov eax, dword [esp + 0x3c]
push 0
push ebx
push edi
call fcn.0040c6b0
mov esi, eax
test esi, esi
jne 0x40c0fd
push ebp
lea ebp, [edi + 0x20]
lea eax, [esi + 4]
mov ecx, ebp
call fcn.0040b7e0
mov edx, dword [ebp]
push 0x14
mov esi, eax
mov eax, dword [edx + 0xc]
push 0
mov ecx, ebp
call eax
mov eax, dword [esp + 0x40]
push 0
push edi
mov ecx, ebx
call fcn.0040c2d0
mov eax, edi
call fcn.0040bea0
mov eax, dword [edi + 0x28]
mov edx, dword [edi + 8]
xor ecx, ecx
xor ebp, ebp
xor ebx, ebx
add eax, esi
mov dword [eax], ecx
mov byte [esp + 0x14], cl
mov byte [esp + 0x15], cl
mov byte [esp + 0x17], cl
mov byte [esp + 0x16], 0x14
mov ecx, dword [esp + 0x14]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebp
pop ebp
mov dword [edi + 8], esi
pop esi
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8