joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4017f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xe8
mov esi, esp
mov dword [esi + 0xc], ebp
mov eax, dword [ebp + 8]
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dl, byte [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
mov al, byte [ebp + 0x14]
vmovsd xmm0, qword [ebp + 0xc]
mov edi, esp
mov dword [esi + 0xd4], edi
mov dword [esi + 0xe0], 0xffffffff
lea edi, [esi + 0xd8]
mov dword [esi + 0xdc], 0x4058b0
mov ebx, dword fs:[0]
mov dword [esi + 0xd8], ebx
mov dword fs:[0], edi
and dl, 1
mov byte [esi + 0xd3], dl
and al, 1
mov byte [esi + 0xd2], al
vmovsd qword [esi + 0xc8], xmm0
mov dword [esi + 0xc4], ecx
mov dword [esi + 0xbc], 0x40f1e760
mov dword [esi + 0xb8], 0
mov eax, esp
mov dword [eax], str.chwdgqgibskldwjscvtzujbvdpnvntitzupanjcqoqddfryzxibqeuvccubsnbzizqikuqvpetgrusxklr
lea ecx, [esi + 0xa0]
call fcn.00405970
sub esp, 4
mov byte [esi + 0x9f], 0
mov dword [esi + 0xe0], 0
mov eax, esp
mov dword [eax], str.xtnhuvfqhkcdasrpxycwsgyxdzqrulaogpyenozwimv
lea ecx, [esi + 0x84]
call fcn.00405970
sub esp, 4
jmp 0x4018c6
mov dword [esi + 0x7c], 0x40f231b0
mov dword [esi + 0x78], 0
mov byte [esi + 0x77], 0
mov dword [esi + 0x6c], 0x40c9b200
mov dword [esi + 0x68], 0
mov byte [esi + 0x67], 1
mov dword [esi + 0x5c], 0x40a74800
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0x200
mov dword [esi + 0xe0], 1
mov eax, esp
mov dword [eax], str.chwdgqgibskldwjscvtzujbvdpnvntitzupanjcqoqddfryzxibqeuvccubsnbzizqikuqvpetgrusxklr
lea ecx, [esi + 0x3c]
call fcn.00405970
sub esp, 4
jmp 0x401921
mov dword [esi + 0xe0], 2
mov eax, esp
mov dword [eax], str.chwdgqgibskldwjscvtzujbvdpnvntitzupanjcqoqddfryzxibqeuvccubsnbzizqikuqvpetgrusxklr
lea ecx, [esi + 0x24]
call fcn.00405970
sub esp, 4
jmp 0x401943
lea ecx, [esi + 0x24]
lea eax, [esi + 0x3c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00405a90
mov byte [esi + 0x13], al
lea ecx, [esi + 0x24]
call fcn.00405a60
lea ecx, [esi + 0x3c]
call fcn.00405a60
mov al, byte [esi + 0x13]
test al, 1
jne 0x401978
jmp 0x40199c
mov dword [esi + 0x20], 0x10
cmp dword [esi + 0x20], 0
jle 0x401997
mov eax, dword [esi + 0x20]
add eax, 0xffffffff
mov dword [esi + 0x20], eax
jmp 0x40197f
jmp 0x40199c
mov dword [esi + 0x1c], 0x30
cmp dword [esi + 0x1c], 0
jle 0x4019bb
mov eax, dword [esi + 0x1c]
add eax, 0xffffffff
mov dword [esi + 0x1c], eax
jmp 0x4019a3
mov ecx, dword [esi + 0x14]
mov dword [esi + 0xe0], 1
mov eax, esp
mov dword [eax], str.aimyspgesqdavhnmxfs
call fcn.00405970
sub esp, 4
jmp 0x4019dd
lea ecx, [esi + 0x84]
call fcn.00405a60
lea ecx, [esi + 0xa0]
call fcn.00405a60
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0xd8]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x402ba0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
not eax
mov ebx, 0x9b
mov eax, 0x56
sbb edx, 0x7c
not esi
rol edx, 0xa3
rcr esi, 0x89
bswap edx
rol esi, 0x6f
not edx
inc eax
rcr ebx, 0x70
rcr ebx, 0xbd
not esi
sub esi, 0x6c
not edx
rcr edx, 0x7c
or eax, 0xf1
dec edi
dec edx
dec eax
bswap edx
dec edi
imul esi
mov esi, 0xa5
sub eax, 0x9d
add eax, 0x39
sub eax, 0x13
mov edi, 0xe0
rcl esi, 0x9a
imul ebx
dec eax
ror edx, 0xff
sbb eax, 0x5a
sub edi, 0xe4
inc eax
or ebx, 0x8b
sbb eax, 0xa5
mov ebx, 0xec
imul edi
rcl ebx, 0xd9
inc esi
ror edx, 0x8f
neg edi
bswap esi
imul edx
mov edi, 0xd1
mov edx, 0xb1
bswap edi
sbb eax, 0x27
xor ecx, ecx
xor edi, edi
not esi
add ebx, 0xc1
rol ebx, 0xe9
neg ebx
dec ebx
neg edi
rol esi, 0xfb
rcl edi, 0x52
imul edx
and esi, 0xe8
dec esi
sbb ebx, 0x1f
or edx, 0xee
neg ebx
imul eax
inc edx
bswap ebx
dec eax
sub ebx, 5
rcl edi, 0xf
rol eax, 0xe
bswap ebx
rcl esi, 0x8f
inc edx
rol edx, 0x31
rcl esi, 0x76
not esi
neg edi
mov ebx, 0x78
not eax
inc edx
or eax, 0xf1
neg ebx
bswap eax
bswap esi
rol edi, 0x15
imul eax
dec eax
bswap esi
bswap eax
and edx, 0xa3
not eax
not eax
neg ebx
imul edi
or edi, 0x4e
or edx, 0x4f
or edi, 0xa6
inc esi
neg esi
mov ecx, dword [ebp + 0xc]
add eax, 0x68
dec edi
neg eax
bswap edx
not eax
not eax
mov edx, 0x28
neg edi
dec eax
inc edi
add esi, 0xc2
rcl edx, 3
not edi
ror esi, 0xbe
inc ebx
mov ebx, 0xb5
bswap ebx
dec edi
rcr ebx, 0xe8
neg eax
rcl edi, 0x38
neg edi
bswap ebx
ror esi, 0x87
mov edx, 0xb4
neg ebx
inc esi
rcl esi, 0x19
add ebx, 0x14
neg edx
or ebx, 0xd9
dec edi
imul edx
neg ebx
add edi, 0x1b
or esi, 0x8f
imul esi
rol esi, 0x1a
dec eax
or esi, 0xa4
sub edx, 0x49
bswap edi
rcr ebx, 0x8e
rcr edi, 0xe9
not ebx
bswap eax
mov esi, 6
neg edx
imul esi
neg eax
mov edi, dword [ebp + 8]
mov ebx, ebx
xor eax, esi
xor ebx, esi
xor esi, esi
mov eax, eax
xor esi, esi
xor esi, eax
xor ebx, eax
xor esi, eax
xor esi, ebx
mov esi, esi
mov eax, ebx
not byte [edi]
xor ebx, eax
xor eax, eax
xor ebx, esi
mov eax, eax
xor esi, ebx
xor eax, eax
mov esi, ebx
mov eax, esi
xor eax, eax
sub byte [edi], 0x89
mov esi, eax
xor ebx, eax
mov eax, eax
xor ebx, eax
mov ebx, eax
mov esi, esi
xor esi, esi
mov ebx, eax
mov ebx, eax
add byte [edi], 0x57
mov esi, ebx
mov esi, esi
xor eax, ebx
mov eax, ebx
mov eax, esi
mov ebx, esi
xor eax, eax
mov eax, ebx
xor eax, eax
imul byte [edi]
inc edi
loop 0x402d56
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x407210
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40724f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40724f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40724f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40724f
cmp dword [ecx + 0x74], 0xe
jbe 0x40724f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40e648
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40e6e5
push ebx
push esi
call fcn.0040e611
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040e5a5
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40e692
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40e6e4
push edi
push eax
call fcn.0040cfab
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40e6b2
call fcn.0040cff9
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40e6e3
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040e5a5
add esp, 0x20
test eax, eax
jne 0x40e6d1
push edi
call fcn.0040cff9
jmp 0x40e6d9
push ebx
call fcn.0040cff9
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40f8f4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x418a70
push 0x418a68
push str.FlsAlloc
push 0x1f
call fcn.0040f7b3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40f928
push dword [ebp + 8]
mov ecx, esi
call dword [0x416130]
call esi
jmp 0x40f92e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40f972
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x418a80
push 0x418a78
push str.FlsGetValue
push 0x21
call fcn.0040f7b3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40f9a9
push dword [ebp + 8]
mov ecx, esi
call dword [0x416130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40f9b1
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x418a88
push 0x418a80
push str.FlsSetValue
push 0x22
call fcn.0040f7b3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40f9eb
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x416130]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x414db0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x414ddd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x414ddd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401e7d
Capabilities:
Delete registry key

Disassembly:
push ebx
mov edx, 7
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x401e83
mov edx, dword [esp + 0x24]
lea ecx, [esp]
call fcn.00403000
mov edx, dword [esp + 0x28]
lea ecx, [esp + 4]
call fcn.00403000
push dword [esp]
call fcn.00402377
push dword [esp + 4]
mov edx, 0x40806e
pop ecx
call fcn.004030b0
je 0x401f4d
cmp dword [0x4090c0], 0
je 0x401f33
mov eax, str.Advapi32.dll
push eax
push 0xffffffff
call fcn.00404ad5
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x401f31
mov eax, str.RegDeleteKeyExA
push eax
push dword [esp + 0xc]
call fcn.00404b2f
mov dword [esp + 0xc], eax
push 0
mov ebx, dword [0x4090c4]
or ebx, 0xf003f
push ebx
mov eax, dword [0x4090b0]
push eax
push dword [0x4090bc]
push dword [esp + 0x1c]
call fcn.00404b9a
mov dword [esp + 0x10], eax
push dword [esp + 8]
call fcn.00404a15
jmp 0x401f48
mov eax, dword [0x4090b0]
push eax
push dword [0x4090bc]
call sub.ADVAPI32.dll_RegDeleteKeyW
mov dword [esp + 0x10], eax
jmp 0x401fd6
lea eax, [esp + 0x18]
push eax
push dword [0x4090bc]
push dword [esp + 0xc]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x14], eax
cmp dword [0x4090c0], 0
je 0x401fc3
mov eax, str.Advapi32.dll
push eax
push 0xffffffff
call fcn.00404ad5
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x401fc1
push 0
mov ebx, dword [0x4090c4]
or ebx, 0xf003f
push ebx
mov eax, dword [0x4090b0]
push eax
push dword [esp + 0x24]
mov eax, str.RegDeleteKeyExA
push eax
push dword [esp + 0x1c]
call fcn.00404bb0
mov dword [esp + 0x10], eax
push dword [esp + 8]
call fcn.00404a15
jmp 0x401fd6
mov eax, dword [0x4090b0]
push eax
push dword [esp + 0x1c]
call sub.ADVAPI32.dll_RegDeleteKeyW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x401fe5
mov eax, 1
jmp 0x401fe7
xor eax, eax
push dword [esp + 4]
call fcn.00406060
push dword [esp]
call fcn.00406060
add esp, 0x1c
pop ebx
ret 8
Function at 0x402703
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
mov edx, 0xb
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x402709
mov edx, dword [esp + 0x34]
lea ecx, [esp]
call fcn.00403000
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 4]
call fcn.00403000
push dword [esp]
call fcn.00402377
lea eax, [esp + 0xc]
push dword [esp + 4]
mov edx, 0x40806e
pop ecx
call fcn.004030b0
je 0x40279f
cmp dword [0x4090c0], 0
je 0x402783
lea eax, [esp + 0x18]
push eax
mov ebx, dword [0x4090c4]
or ebx, 0xf003f
push ebx
push 0
push dword [0x4090b0]
push dword [0x4090bc]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0x14], eax
jmp 0x40279d
lea eax, [esp + 0x18]
push eax
push dword [0x4090b0]
push dword [0x4090bc]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0x14], eax
jmp 0x402804
lea eax, [esp + 0x20]
push eax
push dword [0x4090bc]
push dword [esp + 0xc]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x1c], eax
cmp dword [0x4090c0], 0
je 0x4027ec
lea eax, [esp + 0x18]
push eax
mov ebx, dword [0x4090c4]
or ebx, 0xf003f
push ebx
push 0
push dword [0x4090b0]
push dword [esp + 0x30]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0x14], eax
jmp 0x402804
lea eax, [esp + 0x18]
push eax
push dword [0x4090b0]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x14]
and ebx, ebx
jne 0x4028a2
mov dword [esp + 0x24], 0xff
push dword [0x4090e4]
push dword [0x4090e4]
push 0xff
call fcn.00403200
lea eax, [esp + 0xc]
push eax
call fcn.00405f80
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
lea eax, [esp + 0x34]
push eax
mov eax, dword [esp + 0x1c]
push eax
push dword [esp + 0x50]
push dword [esp + 0x34]
call sub.ADVAPI32.dll_RegEnumKeyExW
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x14]
and ebx, ebx
jne 0x402894
push dword [0x4090e4]
push dword [0x4090e4]
push dword [esp + 0x2c]
push dword [esp + 0x14]
call fcn.00403250
lea eax, [esp + 0x2c]
push eax
call fcn.00405f80
jmp 0x4028a2
mov edx, 0x408028
lea ecx, [esp + 0x28]
call fcn.00403008
push dword [esp + 0x18]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [esp + 0x28]
push dword [0x4090e4]
push edx
call fcn.00406000
pop eax
add eax, dword [0x408754]
jmp 0x4028d4
push dword [esp + 4]
call fcn.00406060
push dword [esp + 8]
call fcn.00406060
push dword [esp + 0x28]
call fcn.00406060
push dword [esp]
call fcn.00406060
add esp, 0x2c
pop ebx
ret 0xc
Function at 0x4040d5
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x40412a
push dword [esp + 0x10]
push 0x404054
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [0x4090c8]
test esi, esi
je 0x404183
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x404122
cmp byte [esi + 0x10], 0
je 0x404122
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x4040fe
jmp 0x404183
mov esi, dword [0x4090c8]
test esi, esi
je 0x404183
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x40417c
cmp byte [esi + 0x11], 0
je 0x404158
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x40416f
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebp
push 0x4090c8
call fcn.00405eb1
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x404137
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x4042a8
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x4090f4]
call fcn.00405ca5
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x4043a8
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x4042fe
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x4042f6
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x40433e
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x404380
push 0x22
pop edx
cmp cx, dx
je 0x404330
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x404320
xor ecx, ecx
cmp word [eax], cx
je 0x404380
mov ecx, eax
add eax, 2
jmp 0x404382
test dx, dx
je 0x404388
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x404330
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x404376
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x404380
cmp cx, dx
je 0x404373
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x404363
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x404348
jmp 0x404330
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x40438a
xor edx, edx
cmp dword [ebp], ebx
jne 0x404393
test edi, edi
jne 0x4043b0
test edx, edx
je 0x404398
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x4042ec
test edi, edi
jne 0x4043c1
mov eax, ebx
jmp 0x4043c5
test esi, esi
je 0x4043c1
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x4043c5
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x405150
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push dword [esp + 0x10]
mov dword [esp + 8], 0
push dword [0x409118]
call fcn.00405d0e
mov esi, eax
test esi, esi
je 0x4051cf
cmp dword [esi + 4], 0
je 0x4051a0
push 1
lea eax, [esp + 8]
push eax
push esi
call fcn.00405340
test eax, eax
je 0x405194
inc dword [esi + 0xc]
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, 1
pop esi
add esp, 8
ret 4
push 0
lea eax, [esp + 0xc]
push eax
push 1
lea eax, [esp + 0x1c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4051da
cmp dword [esp + 8], 0
je 0x4051da
push 1
push 0
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 4
or eax, 0xffffffff
pop esi
add esp, 8
ret 4

Function at 0x405340
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0
jne 0x405361
push esi
call fcn.00404ea0
mov dword [esi + 0x14], 1
mov dword [esi + 0xc], 0
mov ebx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x10]
cmp ebx, edi
jl 0x4053d5
add eax, dword [esi + 4]
mov ecx, edi
sub eax, ebx
dec ecx
je 0x4053c2
dec ecx
je 0x4053ad
sub ecx, 2
je 0x40539a
push edi
push eax
push dword [esp + 0x1c]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [eax]
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov cx, word [eax]
mov eax, dword [esp + 0x14]
mov word [eax], cx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [esp + 0x14]
mov dl, byte [eax]
mov eax, edi
mov byte [ecx], dl
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
push ebp
mov ebp, dword [esp + 0x18]
sub eax, ebx
add eax, dword [esi + 4]
push ebx
push eax
push ebp
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
sub edi, ebx
add ebp, ebx
push 0
cmp edi, eax
jl 0x40541a
lea eax, [esp + 0x18]
push eax
push edi
push ebp
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi + 0xc], 0
add eax, ebx
pop esi
pop ebx
ret 0xc
lea ecx, [esp + 0x18]
push ecx
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp edi, eax
jle 0x40543b
mov edi, eax
push edi
push dword [esi + 4]
push ebp
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0xc], edi
lea eax, [ebx + edi]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x405460
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0x40909c]
mov dword [esp + 0x14], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x4055e4
mov cl, byte [esp + 3]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov esi, edx
mov edi, edi
cmp ebp, 0xffffffff
je 0x4054ae
test ebp, ebp
je 0x405550
dec ebp
cmp dword [ebx + 4], 0
je 0x4054c7
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.00405340
mov dword [esp + 0x14], eax
jmp 0x4054e1
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov cl, byte [esp + 0x13]
cmp eax, 1
jne 0x405550
test cl, cl
je 0x4054f5
mov byte [esi], cl
inc esi
mov cl, byte [esp + 0x13]
mov eax, dword [esp + 0x18]
mov edi, esi
mov edx, dword [esp + 0x20]
dec eax
sub edi, edx
cmp edi, eax
jle 0x405530
mov eax, dword [esp + 0x18]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x40909c]
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x20], edx
lea esi, [edi + edx]
test cl, cl
je 0x405550
cmp dword [esp + 0x2c], 0
jne 0x4054a0
cmp cl, 0xd
je 0x405557
cmp cl, 0xa
jne 0x4054a0
dec esi
jmp 0x4055c7
cmp dword [esp + 0x2c], 0
jne 0x4055c7
cmp cl, 0xa
jne 0x40555f
dec esi
jmp 0x4055c7
cmp cl, 0xd
jne 0x4055c7
dec esi
cmp dword [ebx + 4], 0
je 0x40557e
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.00405340
mov dword [esp + 0x14], eax
jmp 0x405594
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x4055c7
cmp dword [ebx + 4], 0
je 0x4055a6
inc dword [ebx + 0xc]
jmp 0x4055c7
push 1
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebx]
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x20]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x1c]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x4055f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push 0x1000
push 0
push dword [0x40909c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [esp + 8], ecx
test ecx, ecx
je 0x40579d
mov ax, word [esp]
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
push edi
mov edi, ecx
mov dword [esp + 0x20], 0x1000
mov dword [esp + 0x1c], 0x7ff
cmp ebp, 0xffffffff
je 0x405644
test ebp, ebp
je 0x4056fd
dec ebp
cmp dword [ebx + 4], 0
je 0x40565d
push 2
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.00405340
mov dword [esp + 0x14], eax
jmp 0x405677
push 0
lea eax, [esp + 0x18]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
cmp eax, 2
mov ax, word [esp + 0x10]
jne 0x4056fd
test ax, ax
je 0x405691
mov word [edi], ax
add edi, 2
mov ax, word [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov esi, edi
mov edx, dword [esp + 0x1c]
sub esi, ecx
sar esi, 1
cmp esi, edx
jle 0x4056d8
mov eax, dword [esp + 0x20]
add edx, 0x800
add eax, 0x1000
mov dword [esp + 0x1c], edx
push eax
push ecx
push 8
push dword [0x40909c]
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
mov ax, word [esp + 0x10]
mov dword [esp + 0x18], ecx
lea edi, [ecx + esi*2]
test ax, ax
je 0x4056fd
cmp dword [esp + 0x30], 0
jne 0x405636
cmp ax, 0xd
je 0x405704
cmp ax, 0xa
jne 0x405636
sub edi, 2
jmp 0x40577c
cmp dword [esp + 0x30], 0
jne 0x40577c
cmp ax, 0xa
jne 0x40570f
sub edi, 2
jmp 0x40577c
cmp ax, 0xd
jne 0x40577c
sub edi, 2
cmp dword [ebx + 4], 0
je 0x405731
push 2
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.00405340
mov dword [esp + 0x14], eax
jmp 0x405747
push 0
lea eax, [esp + 0x18]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp word [esp + 0x10], 0xa
je 0x40577c
cmp dword [ebx + 4], 0
je 0x40575b
add dword [ebx + 0xc], 2
jmp 0x40577c
push 1
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 0xfffffffe
push eax
push 0xfffffffffffffffe
push dword [ebx]
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x38]
mov ecx, edi
sub ecx, dword [esp + 0x18]
sar ecx, 1
mov dword [eax], ecx
xor eax, eax
mov word [edi], ax
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
xor eax, eax
add esp, 0x18
ret 0x10