joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x51f54cef
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x2223592
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
mov ecx, 0x1fba3253
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x659b02d1
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x402bd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x58], 0
mov ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x3c]
je 0x402c12
mov ebx, dword [esi + 0x40]
cmp ecx, edx
jne 0x402bf2
mov edi, 1
jmp 0x402c16
lea eax, [ecx + ebx]
mov edi, ebx
cmp eax, edx
jle 0x402c07
mov edi, edx
mov eax, 1
sub edi, ecx
cmove edi, eax
mov eax, ecx
sub eax, ebx
jns 0x402c18
lea ebx, [ecx + 1]
jmp 0x402c18
mov edi, dword [esi + 0x40]
dec edx
mov ebx, edi
mov eax, dword [ebp + 8]
add eax, 0xfffffff3
cmp eax, 0x1b
ja case.0x402c2a.14
movzx eax, byte [eax + 0x402d34]
jmp dword [eax*4 + 0x402d18]
add ecx, edi
cmp ecx, edx
jle 0x402cee
xor ecx, ecx
jmp 0x402cf3
sub ecx, ebx
jmp case.0x402c2a.14
inc ecx
jmp case.0x402c2a.14
dec ecx
jmp case.0x402c2a.14
cmp dword [esi + 0x80], 0
mov eax, dword [esi + 0x74]
mov dword [esi + 0x78], eax
jne 0x402ce5
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x74]
push dword [esi + 0x38]
mov dword [esi + 0x78], eax
mov dword [esi + 0x80], 1
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push dword [esi + 0x78]
push 0x7ed
push dword [esi + 0x7c]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
cmp dword [esi + 0x80], 0
jne 0x402ce5
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x50]
cmp eax, dword [esi + 0x3c]
jne 0x402cbe
mov eax, dword [esi + 0x74]
mov edi, 0x7ee
mov dword [esi + 0x78], eax
jmp 0x402cc3
mov edi, 0x7ec
push dword [esi + 0x38]
mov dword [esi + 0x80], 1
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push dword [esi + 0x78]
push edi
push dword [esi + 0x7c]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
test ecx, ecx
cmovs ecx, edx
push ecx
mov ecx, esi
call fcn.00402650
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esi + 0x1c]
push dword [esi + 0x38]
push dword [esi + 0x34]
call dword [sym.imp.USER32.dll_CallWindowProcW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x40ff60
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x49f014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
push 0
push eax
mov ebx, ecx
call fcn.00461200
add esp, 0xc
mov edi, 0x486a14
test esi, esi
cmovne edi, esi
cmp dword [ebx + 0xe4], 0
je 0x40ffb4
push 0x4827b0
call dword [sym.imp.Sm2Lib.dll_sm2lib_83]
add esp, 4
mov edi, eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebx + 0x1a4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, edi
lea eax, [ebp - 0x20c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40fffa
test dx, dx
je 0x40fff6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40fffa
add eax, 4
add ecx, 4
test dx, dx
jne 0x40ffd4
xor eax, eax
jmp 0x40ffff
sbb eax, eax
or eax, 1
test eax, eax
je 0x410010
push edi
push dword [ebx + 0x1a4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045f9ee
mov esp, ebp
pop ebp
ret 4
Function at 0x412460
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x634
mov eax, dword [0x49f014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x62c], esi
mov eax, dword [esi + 0x19a4]
lea ebx, [esi + 0x179c]
mov dword [ebp - 0x634], eax
lea eax, [ebp - 0x218]
test ebx, ebx
je 0x4124c5
mov esi, ebx
mov edx, eax
mov ecx, 0x105
sub esi, edx
movzx edx, word [esi + eax]
test dx, dx
je 0x4124ba
mov word [eax], dx
dec ecx
add eax, 2
cmp ecx, 1
ja 0x4124a5
mov esi, dword [ebp - 0x62c]
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp + 8]
test eax, eax
jne 0x41252d
lea eax, [ebp - 0x420]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x412518
lea eax, [ebp - 0x628]
push eax
push 0
push 0x488920
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x412518
lea eax, [ebp - 0x628]
mov dword [ebp - 0x630], 2
mov ecx, 1
jmp 0x412539
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045f9ee
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 0x630], 0
xor ecx, ecx
mov dword [esi + 0x19a4], ecx
mov ecx, ebx
test ecx, ecx
je 0x4125bc
test eax, eax
je 0x4125bc
mov esi, 0x105
nop
movzx edx, word [eax]
test dx, dx
je 0x4125b1
mov word [ecx], dx
movzx edx, word [eax + 2]
test dx, dx
je 0x4125ae
mov word [ecx + 2], dx
movzx edx, word [eax + 4]
test dx, dx
je 0x4125a9
mov word [ecx + 4], dx
movzx edx, word [eax + 6]
test dx, dx
je 0x4125a4
mov word [ecx + 6], dx
movzx edx, word [eax + 8]
test dx, dx
je 0x41259f
mov word [ecx + 8], dx
sub esi, 5
add eax, 0xa
add ecx, 0xa
cmp esi, 1
ja 0x412550
jmp 0x4125b1
add ecx, 8
jmp 0x4125b1
add ecx, 6
jmp 0x4125b1
add ecx, 4
jmp 0x4125b1
add ecx, 2
mov esi, dword [ebp - 0x62c]
xor eax, eax
mov word [ecx], ax
lea edi, [esi + 0x50]
mov ecx, edi
call fcn.0041e500
push dword [ebp - 0x630]
mov ecx, edi
mov word [edi + 8], 0
push ebx
call fcn.0041e360
mov ebx, eax
test ebx, ebx
jns 0x412620
mov eax, dword [ebp - 0x634]
lea ecx, [esi + 0x179c]
mov dword [esi + 0x19a4], eax
lea edx, [ebp - 0x218]
mov esi, ecx
mov eax, edx
sub esi, eax
nop
movzx eax, word [edx]
lea edx, [edx + 2]
mov word [esi + edx - 2], ax
test ax, ax
jne 0x412600
push 0
push ecx
mov ecx, edi
mov word [edi + 8], ax
call fcn.0041e360
jmp 0x412646
cmp byte [ebp + 0xc], 0
je 0x412630
mov dword [esi + 0x19a4], 1
cmp dword [ebp - 0x634], 0
je 0x412646
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045f9ee
mov esp, ebp
pop ebp
ret 8
Function at 0x419230
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x49f014]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
cmp dword [edi], 0
je 0x41925b
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045f9ee
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
lea ebx, [edi + 4]
push 0
mov dword [edi + 0x30], eax
mov eax, dword [ebp + 0x10]
push 0
mov dword [edi + 0x1c], eax
mov eax, dword [ebp + 0x14]
push 0
mov dword [edi + 0x20], eax
mov eax, dword [ebp + 0x18]
push 0
mov dword [edi + 0x24], eax
call esi
push 0
push 0
push 1
push 0
mov dword [ebx], eax
call esi
push 0
push 0
push 0
push 0
mov dword [edi + 8], eax
call esi
push 0
push 0
push 0
push 0
mov dword [edi + 0xc], eax
call esi
push 0
push 0
push 0
push 0
mov dword [edi + 0x10], eax
call esi
push 0
push 0
push 0
mov dword [edi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi + 0x18], eax
mov dword [edi + 0x2c], 0
mov dword [edi + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x34], eax
lea eax, [ebp - 8]
push eax
push 0
push ebx
push 0x419050
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi], eax
test eax, eax
jne 0x41933e
push dword [ebx]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [edi + 8]
call esi
push dword [edi + 0xc]
call esi
push dword [edi + 0x10]
call esi
push dword [edi + 0x14]
call esi
push dword [edi + 0x18]
call esi
pop esi
pop ebx
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045f9ee
mov esp, ebp
pop ebp
ret 0x14
push 1
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [ebp - 4]
mov eax, 1
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.0045f9ee
mov esp, ebp
pop ebp
ret 0x14

Function at 0x41c6c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x49f014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 1
mov edi, ecx
push 0
push 0
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x41c6f5
call fcn.0041c500
mov ebx, eax
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [edi + 0x5c]
push esi
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41c71c
call fcn.0041c500
mov esi, eax
jmp 0x41c71f
mov esi, dword [ebp - 8]
test esi, esi
js 0x41c72b
cmp esi, dword [edi + 0x5c]
je 0x41c743
or esi, 0xffffffff
push 0
push 0
push ebx
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x41c743
call fcn.0041c500
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop edi
cmovs eax, esi
xor ecx, ebp
pop esi
pop ebx
call fcn.0045f9ee
mov esp, ebp
pop ebp
ret 4
Function at 0x41c760
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x49f014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 1
mov edi, ecx
mov dword [ebp - 0x10], eax
push 0
push 0
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
mov dword [ebp - 0xc], ebx
cmp ebx, 0xffffffff
jne 0x41c79f
call fcn.0041c500
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 9
push esi
push dword [edi + 0xc]

Function at 0x41c8a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x49f014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
mov esi, dword [ebp + 8]
push edi
push 1
mov edi, ecx
mov dword [ebp - 0x10], eax
push 0
push 0
push dword [edi + 0xc]
call ebx
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
jne 0x41c8df
call fcn.0041c500
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 9
push esi
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41c905
call fcn.0041c500
mov esi, eax
jmp 0x41c908
mov esi, dword [ebp - 8]
test esi, esi
js 0x41c9b0
cmp esi, 9
je 0x41c923
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
or esi, 0xffffffff
jmp 0x41c9ba
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x41c946
push 1
push 0
push eax
push dword [edi + 0xc]
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x41c942
call fcn.0041c500
mov esi, eax
test esi, esi
js 0x41c9b0
mov ebx, dword [ebp + 0x14]
lea eax, [ebp - 8]
push 0
push eax
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 8], 0
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41c970
call fcn.0041c500
mov esi, eax
jmp 0x41c973
mov esi, dword [ebp - 8]
test esi, esi
js 0x41c9b0
cmp esi, ebx
je 0x41c988
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, 0xfffffffe
jmp 0x41c9ba
mov eax, dword [edi + 0x60]
sub eax, dword [ebp + 0x10]
push 1
sub eax, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push eax
push dword [edi + 0xc]
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x41c9b6
call fcn.0041c500
mov esi, eax
jmp 0x41c9b6
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
test esi, esi
jns 0x41c9d0
push 0
push 0
push dword [ebp - 0xc]
push dword [edi + 0xc]
call ebx
cmp eax, 0xffffffff
jne 0x41c9d0
call fcn.0041c500
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop edi
cmovs eax, esi
xor ecx, ebp
pop esi
pop ebx
call fcn.0045f9ee
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41c9f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x49f014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 1
mov edi, ecx
push 0
push 0
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x41ca25
call fcn.0041c500
mov ebx, eax
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [edi + 0x5c]
push esi
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41ca4c
call fcn.0041c500
mov esi, eax
jmp 0x41ca4f
mov esi, dword [ebp - 8]
test esi, esi
js 0x41ca5d
cmp esi, dword [edi + 0x5c]
je 0x41ca75
mov esi, 0xfffffffe
push 0
push 0
push ebx
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x41ca75
call fcn.0041c500
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop edi
cmovs eax, esi
xor ecx, ebp
pop esi
pop ebx
call fcn.0045f9ee
mov esp, ebp
pop ebp
ret 4

Function at 0x41ca90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x49f014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 1
mov edi, ecx
push 0
push 0
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x41cac5
call fcn.0041c500
mov ebx, eax
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 9
push esi
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41caeb
call fcn.0041c500
mov esi, eax
jmp 0x41caee
mov esi, dword [ebp - 8]
test esi, esi
js 0x41cb20
cmp esi, 9
je 0x41cafe
mov esi, 0xfffffffe
jmp 0x41cb20
push 1
push 0
push dword [edi + 0x60]
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41cb1c
call fcn.0041c500
mov esi, eax
test esi, esi
jns 0x41cb38
push 0
push 0
push ebx
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x41cb38
call fcn.0041c500
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop edi
cmovs eax, esi
xor ecx, ebp
pop esi
pop ebx
call fcn.0045f9ee
mov esp, ebp
pop ebp
ret 4
Function at 0x41cb60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x49f014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 1
mov edi, ecx
push 0
push 0
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x41cb95
call fcn.0041c500
mov ebx, eax
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 9
push esi
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41cbbb
call fcn.0041c500
mov esi, eax
jmp 0x41cbbe
mov esi, dword [ebp - 8]
test esi, esi
js 0x41cbee
cmp esi, 9
je 0x41cbcc
or esi, 0xffffffff
jmp 0x41cbee
push 1
push 0
push dword [edi + 0x60]
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41cbea
call fcn.0041c500
mov esi, eax
test esi, esi
jns 0x41cc06
push 0
push 0
push ebx
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x41cc06
call fcn.0041c500
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop edi
cmovs eax, esi
xor ecx, ebp
pop esi
pop ebx
call fcn.0045f9ee
mov esp, ebp
pop ebp
ret 4
Function at 0x41d240
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x49f014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], eax
mov dword [eax], 0xffffffff
call fcn.0041ceb0
mov esi, eax
test esi, esi
js 0x41d3a2
push ebx
mov eax, dword [edi + 0x68]
push 1
push 0
push 0
push dword [edi + 0xc]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
mov dword [ebp - 0xc], ebx
cmp ebx, 0xffffffff
jne 0x41d29d
call fcn.0041c500
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [edi + 0x5c]
push dword [ebp - 0x10]
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41d2c6
call fcn.0041c500
mov ebx, eax
jmp 0x41d2c9
mov ebx, dword [ebp - 8]
test ebx, ebx
js 0x41d2d7
cmp ebx, dword [edi + 0x5c]
je 0x41d2f1
mov ebx, 0xfffffffe
push 0
push 0
push dword [ebp - 0xc]
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x41d2f1
call fcn.0041c500
xor eax, eax
test ebx, ebx
cmovs eax, ebx
test eax, eax
js 0x41d3a1
mov edx, dword [edi + 0x64]
xor ecx, ecx
test edx, edx
jle 0x41d31e
mov eax, dword [edi + 0x68]
mov ebx, dword [ebp + 8]
add eax, 9
cmp dword [eax], ebx
je 0x41d374
inc ecx
add eax, 0x14
cmp ecx, edx
jl 0x41d312
mov eax, dword [edi + 0x68]
mov ecx, dword [eax + 5]
cmp ecx, 0xffffffff
je 0x41d39a
mov eax, dword [edi + 0x5c]
imul eax, ecx
test eax, eax
js 0x41d393
push 0
push 0
add eax, 0x10
push eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41d352
call fcn.0041c500
mov esi, eax
test esi, esi
js 0x41d364
lea eax, [esi - 0x10]
xor edx, edx
div dword [edi + 0x5c]
mov esi, eax
test esi, esi
jns 0x41d369
cmp esi, 0xfffffffe
jne 0x41d39f
cmp esi, 0xfffffffe
jne 0x41d276
jmp 0x41d39f
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov dword [eax], ecx
lea ecx, [ecx + ecx*4]
mov eax, dword [edi + 0x68]
movups xmm0, xmmword [eax + ecx*4 + 9]
movups xmmword [edx], xmm0
mov eax, dword [eax + ecx*4 + 0x19]
mov dword [edx + 0x10], eax
jmp 0x41d39f
mov esi, 0xfffffff6
jmp 0x41d39f
mov esi, 0xfffffffe
mov eax, esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0045f9ee
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41df30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x49f014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0x14], eax
mov edi, 0xfffffffe
mov dword [ebp - 0xc], esi
mov eax, dword [esi + 4]
nop dword [eax]
inc eax
mov dword [esi + 4], eax
mov edx, dword [ebx + 0x64]
cmp eax, edx
jge 0x41df88
lea ecx, [eax + eax*4]
lea ecx, [ecx*4 + 0x11]
add ecx, esi
cmp dword [ecx], 0xffffffff
jne 0x41e070
inc eax
add ecx, 0x14
cmp eax, edx
jl 0x41df77
test edi, edi
jns 0x41e0bd
mov ecx, dword [esi + 0xd]
mov dword [ebp - 0x10], ecx
cmp ecx, 0xffffffff
je 0x41e0bd
mov eax, dword [ebx + 0x5c]
imul eax, ecx
test eax, eax
js 0x41e0a5
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
add eax, 0x10
push 0
push 0
push eax
push dword [ebx + 0xc]
call edi
cmp eax, 0xffffffff
jne 0x41dfca
call fcn.0041c500
test eax, eax
js 0x41e0bf
add eax, 0xfffffff0
xor edx, edx
div dword [ebx + 0x5c]
test eax, eax
js 0x41e0bf
push 1
push 0
push 0
push dword [ebx + 0xc]
call edi
mov edi, eax
cmp edi, 0xffffffff
jne 0x41dffb
call fcn.0041c500
mov edi, eax
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [ebx + 0x5c]
lea eax, [esi + 8]
push eax
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41e025
call fcn.0041c500
mov esi, eax
jmp 0x41e028
mov esi, dword [ebp - 8]
test esi, esi
js 0x41e036
cmp esi, dword [ebx + 0x5c]
je 0x41e04e
mov esi, 0xfffffffe
push 0
push 0
push edi
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x41e04e
call fcn.0041c500
xor edi, edi
test esi, esi
cmovs edi, esi
test edi, edi
js 0x41e0bd
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov dword [esi], eax
or eax, 0xffffffff
mov dword [esi + 4], 0xffffffff
jmp 0x41df60
mov edx, dword [ebp - 0x14]
mov dword [esi + 4], eax
test edx, edx
je 0x41e090
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 0x10]
mov dword [edx + 4], eax
mov eax, dword [ecx + 4]
mov ecx, dword [ecx + 8]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045f9ee
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov eax, 0xfffffff6
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045f9ee
mov esp, ebp
pop ebp
ret 8
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045f9ee
mov esp, ebp
pop ebp
ret 8
Function at 0x41e250
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x49f014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push edi
push 0
push eax
mov edi, ecx
mov dword [ebp - 8], 0
push 0x10
push esi
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41e28b
call fcn.0041c500
jmp 0x41e28e
mov eax, dword [ebp - 8]
test eax, eax
js 0x41e2ec
cmp eax, 9
jb 0x41e2f1
cmp dword [esi], 0x53464d53
jne 0x41e2d5
cmp word [esi + 4], 1
jbe 0x41e2bd
pop edi
mov eax, 0xfffffff4
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045f9ee
mov esp, ebp
pop ebp
ret 8
movzx ecx, word [esi + 6]
mov edx, 0x100
cmp cx, dx
jb 0x41e2d5
mov edx, 0xff4c
cmp cx, dx
jbe 0x41e345
pop edi
mov eax, 0xfffffff5
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045f9ee
mov esp, ebp
pop ebp
ret 8
cmp eax, 0xfffffff5
jne 0x41e345
cmp dword [ebp + 0xc], 0
je 0x41e2d5
push 0
lea eax, [ebp - 8]
mov dword [esi], 0x53464d53
push eax
push 0x10
push esi
mov dword [esi + 4], 0x4000001
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0xc], 0xffffffff
push dword [edi + 0xc]
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41e336
call fcn.0041c500
jmp 0x41e339
mov eax, dword [ebp - 8]
test eax, eax
js 0x41e345
cmp eax, 0x10
je 0x41e345
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0045f9ee
mov esp, ebp
pop ebp
ret 8