joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10027c60
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x24
movzx ecx, word [edi + 0x12]
mov edx, dword [edi + 0x34]
movzx eax, byte [edi + 6]
push ebx
mov ebx, dword [edx + 0x24]
push ebp
movzx ebp, word [edi + 0xe]
push esi
mov esi, dword [edi + 0x38]
lea edx, [ebp + ecx*2]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], 0
test ecx, ecx
jle 0x10027da0
lea eax, [esi + ebp]
mov dword [esp + 0x10], eax
jmp 0x10027cb8
mov eax, dword [esp + 0x10]
movzx ebp, byte [eax]
movzx eax, byte [eax + 1]
shl ebp, 8
or ebp, eax
cmp ebp, dword [esp + 0x18]
jl 0x10027dfc
mov eax, dword [esp + 0x1c]
add eax, 0xfffffffc
cmp ebp, eax
jg 0x10027dfc
mov ecx, dword [esp + 0x14]
mov eax, dword [edi + 0x4c]
lea edx, [ecx + ebp]
push edx
push edi
call eax
movzx ecx, ax
sub ebx, ecx
add esp, 8
cmp ebx, dword [esp + 0x18]
mov dword [esp + 0x28], ecx
jl 0x10027de8
lea edx, [ecx + ebp]
cmp edx, dword [esp + 0x1c]
jg 0x10027de8
mov eax, dword [esp + 0x10]
mov edx, ebx
sar edx, 8
cmp dword [esp + 0xc], 0
mov byte [eax], dl
mov byte [eax + 1], bl
jne 0x10027d6c
cmp ebx, ebp
je 0x10027d80
mov eax, dword [edi + 0x34]
mov eax, dword [eax]
call fcn.10005740
mov edx, dword [esp + 0x24]
mov dword [esp + 0xc], eax
movzx eax, byte [edx + esi + 5]
movzx edx, byte [edx + esi + 6]
shl eax, 8
or eax, edx
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, ebx
push ecx
lea ecx, [eax + esi]
push ecx
add eax, edx
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x34]
add esp, 0xc
mov dword [esp + 0x14], eax
push ecx
mov ecx, dword [esp + 0x18]
add ebp, ecx
lea edx, [ebx + esi]
push ebp
push edx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x20]
add dword [esp + 0x10], 2
inc eax
cmp eax, dword [esp + 0x2c]
mov dword [esp + 0x20], eax
jl 0x10027cb4
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
mov ecx, ebx
mov byte [eax + esi + 6], bl
sub ebx, edx
push ebx
add edx, esi
sar ecx, 8
push 0
push edx
mov byte [eax + esi + 5], cl
mov byte [eax + esi + 1], 0
mov byte [eax + esi + 2], 0
mov byte [eax + esi + 7], 0
call sub.msvcrt.dll_memset
movzx edx, word [edi + 0x10]
add esp, 0xc
cmp ebx, edx
je 0x10027e10
push 0xd773
call fcn.10026140
add esp, 4
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
push 0xd75b
call fcn.10026140
add esp, 4
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
push 0xd755
call fcn.10026140
add esp, 4
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
Function at 0x10027f30
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, eax
movzx ecx, word [edi + 0x12]
movzx edx, word [edi + 0xe]
movzx eax, byte [edi + 6]
mov esi, dword [edi + 0x38]
movzx ebx, byte [esi + eax + 5]
lea ebp, [edx + ecx*2]
lea ecx, [esi + eax + 5]
lea edx, [esi + eax + 6]
mov dword [esp + 0x14], ecx
movzx ecx, byte [edx]
shl ebx, 8
or ebx, ecx
cmp ebp, ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], edx
jle 0x10027f9a
test ebx, ebx
jne 0x10027f85
mov edx, dword [edi + 0x34]
mov ebx, 0x10000
cmp dword [edx + 0x24], ebx
je 0x10027f9a
push 0xd7e2
call fcn.10026140
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
cmp byte [esi + eax + 2], 0
jne 0x10027fa8
cmp byte [esi + eax + 1], 0
je 0x10027fe0
lea eax, [ebp + 2]
cmp eax, ebx
jg 0x10027fe0
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push ecx
push edx
push edi
call fcn.10027e20
add esp, 0xc
test eax, eax
je 0x10027fd8
mov ecx, dword [esp + 0x24]
pop edi
sub eax, esi
pop esi
pop ebp
mov dword [ecx], eax
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x1002802b
mov esi, dword [esp + 0x20]
lea edx, [esi + ebp + 2]
cmp edx, ebx
jle 0x10028010
call fcn.10027c60
test eax, eax
jne 0x1002802b
mov eax, dword [esp + 0x14]
movzx ebx, byte [eax]
mov ecx, dword [esp + 0x18]
movzx edx, byte [ecx]
shl ebx, 8
or ebx, edx
dec ebx
and ebx, 0xffff
inc ebx
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
sub ebx, esi
mov eax, ebx
sar eax, 8
mov byte [ecx], al
mov eax, dword [esp + 0x24]
mov byte [edx], bl
mov dword [eax], ebx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x1003ee00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
xor ebx, ebx
test edi, edi
je 0x1003ee5a
push esi
mov eax, edi
call fcn.10010b80
mov eax, dword [edi + 4]
mov esi, dword [eax + 8]
test esi, esi
je 0x1003ee52
push ebp
nop
cmp dword [esp + 0x1c], 0
je 0x1003ee5f
test byte [esi + 0x40], 1
jne 0x1003ee5f
mov al, byte [esi + 0x42]
cmp al, 1
je 0x1003ee38
cmp al, 2
jne 0x1003ee6f
mov eax, esi
call fcn.1003eac0
mov ebx, eax
test ebx, ebx
je 0x1003ee6f
push 0
push ebx
push edi
call fcn.1003ee00
add esp, 0xc
pop ebp
mov eax, edi
call fcn.10006720
pop esi
pop edi
mov eax, ebx
pop ebx
ret
call fcn.10006950
mov ecx, dword [esp + 0x18]
mov byte [esi + 0x42], 4
mov dword [esi + 0x3c], ecx
xor ebp, ebp
cmp byte [esi + 0x44], 0
jl 0x1003ee9d
lea edi, [esi + 0x78]
lea ebx, [ebx]
mov eax, dword [edi]
call fcn.1003a8b0
mov dword [edi], 0
movsx edx, byte [esi + 0x44]
inc ebp
add edi, 4
cmp ebp, edx
jle 0x1003ee80
mov edi, dword [esp + 0x14]
mov esi, dword [esi + 8]
test esi, esi
jne 0x1003ee20
pop ebp
mov eax, edi
call fcn.10006720
pop esi
pop edi
mov eax, ebx
pop ebx
ret
Function at 0x10041090
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add al, 0
add byte [eax], al
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.100407d4
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10040789
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
push ds
cld
invalid
call [ebx - 0x3e07a3a]
invalid
inc dword [edx - 0x3df7a3a]
invalid
dec dword [ebx - 0x3de7a3a]
invalid
jmp dword [esi - 0x3dd7a3a]
invalid
dec dword [edi - 0x3dc7a3a]
invalid
inc dword [eax - 0x3db7a3a]
invalid
dec dword [edx - 0x3da7a3a]
invalid
inc dword [edx - 0x3d97a3a]
invalid
dec dword [ebx - 0x3d87a3a]
invalid
jmp [edi - 0x3d77a3a]
invalid
invalid
out dx, al
lea eax, [ebp - 0x3ec]
push eax
call fcn.100407d4
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10040789
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.100407c4
or byte [ebp + ecx - 0x335a7f18], dh
cli
invalid
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x43b63b
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x43b3c1
add esi, 0x5bb7f6be
call fcn.0043b675
and eax, eax
mov eax, 0xad2c5c47
sub eax, 0xdcfe2581
xor dword [ebx], edx
or esi, eax
sub eax, 0x45d9b53
inc ebx
inc esi
cmp ebx, ecx
jne fcn.0043b63b
mov eax, esi
dec esi
ret
Function at 0x401060
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x528cc2
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x588790]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [esi + 8], eax
xor edi, edi
mov dword [esi], vtable.DuiLib::CWindowWnd.0
mov dword [esi + 4], edi
mov byte [esi + 0xc], 0
xor ecx, ecx
mov dword [esi + 0x10], vtable.DuiLib::CNotifyPump.0
mov eax, 0x53
mov dword [esi + 0x18], eax
mov edx, 4
mul edx
seto cl
mov dword [esi + 0x1c], edi
neg ecx
or ecx, eax
push ecx
call fcn.004ef56e
add esp, 4
push 0x14c
push edi
push eax
mov dword [esi + 0x14], eax
call fcn.00509940
add esp, 0xc
mov dword [ebp - 4], edi
mov dword [esi + 0x20], vtable.DuiLib::INotifyUI.0
mov dword [esi + 0x24], vtable.DuiLib::IMessageFilterUI.0
mov dword [esi + 0x28], vtable.DuiLib::IDialogBuilderCallback.0
mov dword [esi + 0x2c], vtable.DuiLib::IQueryControlText.0
lea eax, [esi + 0x34]
mov dword [esi], vtable.DuiLib::WindowImplBase.0
mov dword [esi + 0x10], vtable.DuiLib::WindowImplBase.1.0
mov dword [esi + 0x20], vtable.DuiLib::WindowImplBase.2.0
mov dword [esi + 0x24], vtable.DuiLib::WindowImplBase.3.0
mov dword [esi + 0x28], vtable.DuiLib::WindowImplBase.4.0
mov dword [esi + 0x2c], vtable.DuiLib::WindowImplBase.5.0
xor ecx, ecx
mov dword [esi + 0x30], eax
mov word [eax], cx
lea eax, [esi + 0xb8]
xor edx, edx
mov dword [esi + 0xb4], eax
mov word [eax], dx
lea eax, [esi + 0x13c]
mov dword [esi + 0x138], eax
mov word [eax], cx
lea ecx, [esi + 0x1d0]
mov byte [ebp - 4], 3
call sym.zSignInstall.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::constructor_void_
push 0xffffffffffffffff
push 0x53629c
lea ecx, [esi + 0x30]
mov dword [esi + 0x1bc], 1
call sym.zSignInstall.exe_public:_void___thiscall_DuiLib::CDuiString::Assign_wchar_t_const___int_
push 0xffffffffffffffff
push str.none.xml
lea ecx, [esi + 0xb4]
call sym.zSignInstall.exe_public:_void___thiscall_DuiLib::CDuiString::Assign_wchar_t_const___int_
push 0xffffffffffffffff
push str.WindowImplBase
lea ecx, [esi + 0x138]
call sym.zSignInstall.exe_public:_void___thiscall_DuiLib::CDuiString::Assign_wchar_t_const___int_
xor eax, eax
mov dword [esi + 0x1c0], eax
mov dword [esi + 0x1c4], eax
mov dword [esi + 0x1c8], eax
mov dword [esi + 0x1cc], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4036c0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52a646
mov eax, dword fs:[0]
push eax
sub esp, 0x864
mov eax, dword [0x588790]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov edi, str._Install::GetSpecialFolderDir_start
mov dword [ebp - 0x86c], ebx
call fcn.00408b90
mov dword [ebp - 0x838], 0xf
mov dword [ebp - 0x83c], ebx
mov byte [ebp - 0x84c], bl
lea eax, [ebp - 0x86c]
push eax
push 0x26
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x403824
push 0x410
lea ecx, [ebp - 0x830]
push ebx
push ecx
call fcn.00509940
mov eax, dword [ebp - 0x86c]
add esp, 0xc
lea edx, [ebp - 0x830]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
sub esp, 0x1c
mov ecx, esp
xor edx, edx
lea eax, [ebp - 0x830]
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], ebx
mov dword [ebp - 0x870], esp
mov word [ecx], dx
lea edi, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x403780
sub eax, edi
sar eax, 1
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.00404a10
lea ecx, [ebp - 0x868]
push ecx
call fcn.00420800
add esp, 0x20
push eax
lea ecx, [ebp - 0x84c]
mov byte [ebp - 4], 1
call fcn.00404500
mov byte [ebp - 4], bl
cmp dword [ebp - 0x854], 0x10
jb 0x4037d6
mov edx, dword [ebp - 0x868]
push edx
call fcn.004ad85d
add esp, 4
mov eax, dword [ebp - 0x86c]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea edi, [ebp - 0x84c]
call fcn.00419530
mov edi, str._Install::GetSpecialFolderDir_end
call fcn.00408b90
lea ecx, [ebp - 0x84c]
push ecx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov ecx, esi
mov byte [esi], bl
call fcn.00404500
cmp dword [ebp - 0x838], 0x10
jb 0x403860
mov edx, dword [ebp - 0x84c]
push edx
jmp 0x403858
mov edi, str._Install::GetSpecialFolderDir_end
call fcn.00408b90
lea eax, [ebp - 0x84c]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
push eax
mov ecx, esi
mov byte [esi], bl
call fcn.00404500
cmp dword [ebp - 0x838], 0x10
jb 0x403860
mov ecx, dword [ebp - 0x84c]
push ecx
call fcn.004ad85d
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00503edf
mov esp, ebp
pop ebp
ret
Function at 0x408b90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52d0f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x588790]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x58f478], 1
jne 0x408c70
cmp dword [0x58f2d0], 0
je 0x408c70
mov byte [ebp - 0x2d], 0xa
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
lea esi, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.00408f30
mov eax, dword [ebp - 0x2c]
mov esi, 0x10
cmp dword [ebp - 0x18], esi
jae 0x408c08
lea eax, [ebp - 0x2c]
mov ecx, dword [0x58f2d0]
mov edx, dword [ebp - 0x1c]
push ecx
push edx
push 1
push eax
call fcn.00504f22
mov eax, edi
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408c23
mov ecx, dword [0x58f2d0]
push ecx
sub eax, edx
push eax
push 1
push edi
call fcn.00504f22
mov edx, dword [0x58f2d0]
push edx
push 1
lea eax, [ebp - 0x2d]
push 1
push eax
call fcn.00504f22
mov ecx, dword [0x58f2d0]
push ecx
call fcn.00504c55
add esp, 0x24
cmp dword [ebp - 0x18], esi
jb 0x408c70
mov edx, dword [ebp - 0x2c]
push edx
call fcn.004ad85d
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00503edf
mov esp, ebp
pop ebp
ret
Function at 0x408c90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5295db
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x588790]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x58f478], 1
jne 0x408df0
xor ebx, ebx
cmp dword [0x58f2d0], ebx
je 0x408df0
push 0xff
lea eax, [ebp - 0x10f]
push ebx
push eax
mov byte [ebp - 0x12d], 0xa
mov byte [ebp - 0x110], bl
call fcn.00509940
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x110]
push 0x537348
push edx
call fcn.00504a29
add esp, 0x18
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], ebx
mov byte [ebp - 0x12c], bl
lea esi, [ebp - 0x12c]
mov dword [ebp - 4], ebx
call fcn.00408f30
mov eax, dword [ebp - 0x12c]
mov esi, 0x10
cmp dword [ebp - 0x118], esi
jae 0x408d4c
lea eax, [ebp - 0x12c]
mov ecx, dword [0x58f2d0]
mov edx, dword [ebp - 0x11c]
push ecx
push edx
push 1
push eax
call fcn.00504f22
mov eax, edi
add esp, 0x10
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x408d70
mov ecx, dword [0x58f2d0]
push ecx
sub eax, edx
push 1
push eax
push edi
call fcn.00504f22
lea eax, [ebp - 0x110]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x408d95
sub eax, edx
mov edx, dword [0x58f2d0]
push edx
push 1
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00504f22
mov ecx, dword [0x58f2d0]
push ecx
push 1
lea edx, [ebp - 0x12d]
push 1
push edx
call fcn.00504f22
mov eax, dword [0x58f2d0]
push eax
call fcn.00504c55
add esp, 0x24
cmp dword [ebp - 0x118], esi
jb 0x408df0
mov ecx, dword [ebp - 0x12c]
push ecx
call fcn.004ad85d
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00503edf
mov esp, ebp
pop ebp
ret
Function at 0x408e10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5295a8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x588790]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x58f478], 1
mov ebx, dword [ebp + 8]
jne 0x408f0d
xor eax, eax
cmp dword [0x58f2d0], eax
je 0x408f0d
mov byte [ebp - 0x2d], 0xa
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x2c], al
lea esi, [ebp - 0x2c]
mov dword [ebp - 4], eax
call fcn.00408f30
mov eax, dword [ebp - 0x2c]
mov esi, 0x10
cmp dword [ebp - 0x18], esi
jae 0x408e84
lea eax, [ebp - 0x2c]
mov ecx, dword [0x58f2d0]
mov edx, dword [ebp - 0x1c]
push ecx
push edx
push 1
push eax
call fcn.00504f22
mov eax, edi
add esp, 0x10
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408ea0
mov ecx, dword [0x58f2d0]
push ecx
sub eax, edx
push 1
push eax
push edi
call fcn.00504f22
mov eax, ebx
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408ec1
sub eax, edx
mov edx, dword [0x58f2d0]
push edx
push 1
push eax
push ebx
call fcn.00504f22
mov eax, dword [0x58f2d0]
push eax
push 1
lea ecx, [ebp - 0x2d]
push 1
push ecx
call fcn.00504f22
mov edx, dword [0x58f2d0]
push edx
call fcn.00504c55
add esp, 0x24
cmp dword [ebp - 0x18], esi
jb 0x408f0d
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004ad85d
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00503edf
mov esp, ebp
pop ebp
ret
Function at 0x410ed0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52a368
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x588790]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, str._Xml2Install::WriteUnCfgIndexFile_Start
mov dword [ebp - 4], 2
call fcn.00408b90
push 0x537a48
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x48]
push ecx
call fcn.00404cc0
add esp, 0xc
mov ecx, eax
lea eax, [ebp + 0x24]
lea esi, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.00408270
mov edi, 0x10
mov byte [ebp - 4], 5
cmp dword [ebp - 0x34], edi
jb 0x410f4c
mov edx, dword [ebp - 0x48]
push edx
call fcn.004ad85d
add esp, 4
lea eax, [ebp - 0x4c]
xor ebx, ebx
push eax
push str.qEh_y14i4TNr7g1cot6w
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], bl
mov dword [ebp - 0x4c], ebx
call fcn.00421e80
mov ecx, dword [ebp - 0x2c]
add esp, 8
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x18], edi
jae 0x410f7d
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
push edx
mov edx, dword [ebp - 0x4c]
push edx
push eax
lea edx, [ebp - 0x4c]
call fcn.004226d0
add esp, 0xc
mov esi, eax
mov eax, dword [ebp + 0x40]
cmp dword [ebp + 0x54], edi
jae 0x410f9e
lea eax, [ebp + 0x40]
push 0x537a68
push eax
call fcn.00504d6d
mov edi, eax
add esp, 8
cmp edi, ebx
jne 0x410fbe
mov edi, str._fopen_Fail
call fcn.00408b90
jmp 0x410fea
mov ecx, dword [ebp - 0x4c]
push edi
push 1
push ecx
push esi
call fcn.00504f22
push edi
call fcn.005055b7
mov edx, dword [ebp - 0x50]
push edx
call fcn.0050567c
add esp, 0x18
cmp esi, ebx
je 0x410fea
push esi
call fcn.0050567c
add esp, 4
mov edi, str._Xml2Install::WriteUnCfgIndexFile_End
call fcn.00408b90
mov esi, 0x10
cmp dword [ebp - 0x18], esi
jb 0x41100a
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004ad85d
add esp, 4
mov edi, 0xf
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
cmp dword [ebp + 0x1c], esi
jb 0x411029
mov ecx, dword [ebp + 8]
push ecx
call fcn.004ad85d
add esp, 4
mov byte [ebp + 8], bl
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x1c], edi
cmp dword [ebp + 0x38], esi
jb 0x411043
mov edx, dword [ebp + 0x24]
push edx
call fcn.004ad85d
add esp, 4
mov byte [ebp + 0x24], bl
mov dword [ebp + 0x34], ebx
mov dword [ebp + 0x38], edi
cmp dword [ebp + 0x54], esi
jb 0x41105d
mov eax, dword [ebp + 0x40]
push eax
call fcn.004ad85d
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00503edf
mov esp, ebp
pop ebp
ret 0x54
Function at 0x414a40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x529473
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x588790]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
or ecx, 0xffffffff
mov dword [ebx + 8], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x20], 0x58f4cc
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x28], eax
mov dword [ebp - 4], eax
lea edi, [ebx + 0x34]
mov dword [ebx], vtable.TiXmlDocument.0
mov dword [edi], 0x58f4cc
mov byte [ebp - 4], 1
mov dword [ebx + 0x40], ecx
mov dword [ebx + 0x3c], ecx
push 0x536a2f
xor esi, esi
mov dword [ebx + 0x38], 4
mov byte [ebx + 0x44], al
mov byte [ebx + 0x2c], al
mov dword [ebx + 0x30], eax
call fcn.00413900
xor eax, eax
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x3c], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x414c10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x414c66
cmp byte [ebx + 0x2c], 0
jne 0x414c5d
mov byte [ebx + 0x2c], 1
mov dword [ebx + 0x30], 2
mov edx, dword [str.Failed_to_open_file]
mov eax, edx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414c40
sub eax, esi
push edx
lea edi, [ebx + 0x34]
mov esi, eax
call fcn.00413900
or eax, 0xffffffff
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x3c], eax
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x414c81
lea ecx, [ecx]
mov ecx, esi
mov eax, dword [ecx]
mov edx, dword [eax]
mov esi, dword [esi + 0x28]
push 1
call edx
test esi, esi
jne 0x414c70
xor ecx, ecx
push 2
or eax, 0xffffffff
push ecx
mov dword [ebx + 0x18], ecx
mov dword [ebx + 0x1c], ecx
push edi
mov dword [ebx + 8], eax
mov dword [ebx + 4], eax
call fcn.005054ce
push edi
call fcn.00505130
push 0
mov esi, eax
push 0
push edi
mov dword [ebp + 8], esi
call fcn.005054ce
add esp, 0x1c
test esi, esi
jg 0x414cdf
cmp byte [ebx + 0x2c], 0
jne 0x414c5d
mov byte [ebx + 0x2c], 1
mov dword [ebx + 0x30], 0xc
mov edx, dword [str.Error_document_empty.]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414cd3
jmp 0x414c47
lea eax, [esi + 1]
push eax
call fcn.004a47f3
mov ecx, dword [ebp + 0xc]
push ecx
push 1
mov edi, eax
push esi
push edi
mov byte [edi], 0
call fcn.00505cac
add esp, 0x14
cmp eax, 1
je 0x414d3c
push edi
call fcn.004ad85d
add esp, 4
cmp byte [ebx + 0x2c], 0
jne 0x414c5d
mov byte [ebx + 0x2c], 1
mov dword [ebx + 0x30], 2
mov edx, dword [str.Failed_to_open_file]
mov eax, edx
lea esi, [eax + 1]
jmp 0x414d30
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414d30
jmp 0x414c47
mov edx, dword [ebp + 8]
mov byte [edi + edx], 0
cmp byte [edi], 0
mov eax, edi
mov esi, edi
je 0x414d6c
lea esp, [esp]
mov cl, byte [eax]
cmp cl, 0xd
jne 0x414d63
mov byte [esi], 0xa
inc eax
inc esi
cmp byte [eax], 0xa
jne 0x414d67
jmp 0x414d66
mov byte [esi], cl
inc esi
inc eax
cmp byte [eax], 0
jne 0x414d50
push 0
mov byte [esi], 0
mov eax, dword [ebx]
mov edx, dword [eax + 8]
push 0
push edi
mov ecx, ebx
call edx
push edi
call fcn.004ad85d
add esp, 4
xor eax, eax
cmp byte [ebx + 0x2c], al
pop edi
pop esi
sete al
pop ebx
pop ebp
ret 8