joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10028be1
Capabilities:
Print debug messages

Disassembly:
push esi
push 8
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x10028bfe
push 8
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp byte [0x1003cdfb], 0
jne 0x10028c14
cmp byte [0x1003cdfa], 0
je 0x10028d53
push edi
push 0x64
push str.sizeof__t_ASMBlock____d
mov edi, 0x1003e5f8
push edi
call fcn.1001a040
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028c3a
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028c53
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028c5c
cmp byte [0x1003cdfa], 0
je 0x10028c7c
push 4
push str.sizeof_Uns32____d
push edi
call fcn.1001a040
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028c7c
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028c95
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028c9e
cmp byte [0x1003cdfa], 0
je 0x10028cbe
push 4
push str.sizeof_HANDLE____d
push edi
call fcn.1001a040
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028cbe
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028cd7
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028ce0
cmp byte [0x1003cdfa], 0
je 0x10028d00
push 4
push str.sizeof_Handle32____d
push edi
call fcn.1001a040
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028d00
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028d19
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028d22
cmp byte [0x1003cdfa], 0
je 0x10028d42
push 4
push str.sizeof_void____d
push edi
call fcn.1001a040
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028d42
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028d52
push edi
call fcn.10005eb0
pop ecx
pop edi
mov eax, esi
pop esi
ret

Function at 0x10028dec
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x1002e03a
call fcn.1002b09b
cmp byte [0x1003cdfb], 0
mov ebx, 0x1003e5f8
mov edi, dword [ebp + 8]
jne 0x10028e17
mov al, byte [0x1003cdfa]
test al, al
jne 0x10028e17
lea esi, [edi + 4]
jmp 0x10028e2e
lea esi, [edi + 4]
push esi
push str.ASM_Release__s
push ebx
call fcn.1001a040
mov al, byte [0x1003cdfa]
add esp, 0xc
test al, al
je 0x10028e39
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028e49
push ebx
call fcn.10005eb0
pop ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.1001a040
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028d9
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x10028e7c
mov ecx, dword [ebx]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x1002f5c0]
mov ecx, ebx
call esi
lea ecx, [ebp - 0x28]
call fcn.100031be
and dword [edi + 0x4c], 0
and dword [edi + 0x44], 0
call fcn.1002b045
ret
Function at 0x10028e92
Capabilities:
Print debug messages

Disassembly:
push 0x24
mov eax, 0x1002e067
call fcn.1002b09b
cmp byte [0x1003cdfb], 0
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
jne 0x10028ebf
cmp byte [0x1003cdfa], 0
je 0x10028f0e
call fcn.1001a040
test al, al
mov edx, 0x1002fb8c
mov ecx, str._in_AppContaner
cmove ecx, edx
push ecx
push str.ASM_Retrieve_retrieving_shared_memory_in_Plug_in_s
push 0x1003e5f8
call fcn.1001a040
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028efa
push 0x1003e5f8
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028f0e
push 0x1003e5f8
call fcn.10005eb0
pop ecx
and dword [esi], 0
lea eax, [edi + 4]
and dword [ebx], 0
lea ecx, [ebp - 0x28]
push eax
call fcn.1001a040
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028d9
or dword [ebp - 4], 0xffffffff
mov ebx, eax
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.100031be
test ebx, ebx
jne 0x10028f8c
cmp byte [0x1003cdfb], bl
jne 0x10028f58
cmp byte [0x1003cdfa], bl
je 0x10029000
push str.ASM_Retrieve_ERROR__finding_memory_mapped_file_
mov ebx, 0x1003e5f8
push ebx
call fcn.1001a040
cmp byte [0x1003cdfa], 0
pop ecx
pop ecx
je 0x10028f7a
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10029000
push ebx
call fcn.10005eb0
pop ecx
jmp 0x10029000
mov eax, dword [ebx]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x1002f5c0]
mov ecx, ebx
call esi
mov dword [edi + 0x44], eax
test eax, eax
jne 0x10028fbb
cmp byte [0x1003cdfb], al
jne 0x10028fb4
cmp byte [0x1003cdfa], al
je 0x10029000
push str.ASM_Retrieve_ERROR__getting_memory_mapped_file_handle_
jmp 0x10028f5d
mov eax, dword [ebx]
push dword [edi + 0x48]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1002f5c0]
mov ecx, ebx
call esi
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x10028ff0
cmp byte [0x1003cdfb], al
jne 0x10028fe6
cmp byte [0x1003cdfa], al
je 0x10029000
push str.ASM_Retrieve_ERROR__mapping_for_writing_
jmp 0x10028f5d
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edi + 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [edi + 0x4c]
mov dword [ecx], eax
call fcn.1002b045
ret
Function at 0x40129f
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
and dword [ebp - 0x14], 0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x14]
push edi
mov dword [ebp - 0x38], esi
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [ebp - 8], eax
mov eax, dword [0x41b5c0]
mov dword [ebp - 0x30], eax
mov eax, dword [0x41b5c4]
mov dword [ebp - 0x34], eax
call fcn.00401298
mov edi, dword [ebp - 0x14]
mov eax, dword [0x41b5c8]
add edi, 0x23f
mov dword [ebp - 0x28], eax
mov eax, dword [str.e_Dz]
push 0x20
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x2c], eax
pop esi
mov dword [ebp - 0x20], 2
add dword [ebp - 0x20], 3
mov edx, dword [ebp - 8]
mov eax, edx
mov ecx, dword [0xec69ac]
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x401328
push 0x418300
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [0xec69ac]
add eax, dword [ebp - 0x28]
cmp ecx, 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0xec69a8]
mov dword [ebp - 0x24], 0xedeb2e40
cmove eax, dword [ebp - 0x24]
and dword [ebp - 0x24], 0
cmp ecx, 0x3eb
mov dword [0xec69a8], eax
mov eax, dword [0xec6900]
cmove eax, dword [ebp - 0x24]
mov dword [0xec6900], eax
lea eax, [edi + edx]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
shr eax, 5
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
and dword [ebp - 0x18], 0
mov dword [0xec69a4], 0xf4ea3dee
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x1c]
sub ebx, eax
mov dword [ebp - 0x10], eax
mov eax, ebx
mov dword [ebp - 0x1c], ebx
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
nop
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
mov eax, ebx
shr eax, cl
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
xor eax, dword [ebp - 0x24]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 8], eax
add edi, 0x61c88647
mov dword [ebp - 0x14], edi
dec esi
jne 0x4012f0
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 8]
pop edi
mov dword [esi + 4], ebx
mov dword [esi], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d6b9
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a35c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004051e5
mov dword [ebp - 0x14], eax
cmp dword [0x822160], esi
jne 0x40d7ac
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d739
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d88c
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d88c
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d88c
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x822160], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x822164], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x822168], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x822170], eax
test eax, eax
je 0x40d7a9
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x82216c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d7d1
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d7c4
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d7e6
push 4
pop eax
jmp 0x40d88e
cmp dword [ebp - 0x14], esi
je 0x40d7e6
push dword [0x822160]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d7cb
mov eax, dword [0x82216c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d844
cmp dword [0x822170], edi
je 0x40d844
push eax
call ebx
push dword [0x822170]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d844
test eax, eax
je 0x40d844
call ecx
test eax, eax
je 0x40d839
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d839
test byte [ebp - 8], 1
jne 0x40d844
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d874
mov eax, dword [0x822164]
cmp eax, edi
je 0x40d871
push eax
call ebx
test eax, eax
je 0x40d871
call eax
mov esi, eax
test esi, esi
je 0x40d871
mov eax, dword [0x822168]
cmp eax, edi
je 0x40d871
push eax
call ebx
test eax, eax
je 0x40d871
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x822160]
call ebx
test eax, eax
je 0x40d88c
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d88e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004044f2
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x425004]
jne 0x40100a
repz ret
jmp fcn.004012f0

Function at 0x40322b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x425004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402225
and dword [ebp - 0x14], 0
cmp dword [0x42758c], 0
mov dword [ebp - 0x18], eax
jne 0x4032de
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x403386
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x403386
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42758c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x427590], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x427594], eax
call edi
push eax
call esi
mov dword [0x42759c], eax
test eax, eax
je 0x4032de
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x427598], eax
mov eax, dword [0x427598]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x403337
cmp dword [0x42759c], ecx
je 0x403337
push eax
call esi
push dword [0x42759c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x403337
test ebx, ebx
je 0x403337
call edi
test eax, eax
je 0x40332e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40332e
test byte [ebp - 8], 1
jne 0x403337
or dword [ebp + 0x10], 0x200000
jmp 0x40336a
mov eax, dword [0x427590]
cmp eax, dword [ebp - 0x18]
je 0x40336a
push eax
call esi
test eax, eax
je 0x40336a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40336a
mov eax, dword [0x427594]
cmp eax, dword [ebp - 0x18]
je 0x40336a
push eax
call esi
test eax, eax
je 0x40336a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42758c]
call esi
test eax, eax
je 0x403386
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x403388
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x407e20
Capabilities:
Terminate process

Disassembly:
call fcn.0040e1e0
call fcn.0040d730
mov dword [0x430a94], eax
mov eax, dword [0x430a90]
test eax, eax
jne 0x407e42
call fcn.00416fa0
mov dword [0x430a90], eax
mov eax, dword [0x430a94]
push esi
test eax, eax
je 0x407e86
push 0x430a64
push 0x429cb0
call fcn.00413b40
add esp, 8
mov dword [0x430a6c], eax
mov eax, dword [0x430a94]
test eax, eax
je 0x407fba
mov edx, dword [0x4311d0]
push edx
call fcn.004133e0
add esp, 4
mov dword [0x430a68], eax
pop esi
ret
call fcn.0040e1e0
mov eax, dword [0x42f5d0]
push eax
call fcn.004133e0
push eax
mov dword [0x430a64], eax
call fcn.004135d0
mov esi, eax
add esp, 8
test esi, esi
je 0x407ece
mov eax, dword [0x430a64]
call fcn.00407da0
test eax, eax
jne 0x407ece
mov ecx, dword [0x430a64]
push ecx
push str.__s__doesnt_look_like_a_tag_file__I_refuse_to_overwrite_it.
push 1
call fcn.00413260
add esp, 0xc
mov eax, dword [0x42f5b4]
test eax, eax
mov eax, dword [0x42f5ac]
je 0x407f1c
test eax, eax
je 0x407f02
test esi, esi
je 0x407f02
mov edx, dword [0x430a64]
push 0x429c6c
push edx
call fcn.0041d13d
add esp, 8
mov dword [0x430a6c], eax
jmp 0x407f97
mov eax, dword [0x430a64]
push 0x429c68
push eax
call fcn.0041d13d
add esp, 8
mov dword [0x430a6c], eax
jmp 0x407f97
test eax, eax
je 0x407f75
test esi, esi
je 0x407f75
mov ecx, dword [0x430a64]
push 0x429c64
push ecx
call fcn.0041d13d
add esp, 8
mov dword [0x430a6c], eax
test eax, eax
je 0x407fa4
push ebx
mov ebx, eax
call fcn.00407af0
mov edx, dword [0x430a6c]
mov dword [0x430a74], eax
push edx
call fcn.0041cf26
mov eax, dword [0x430a64]
push 0x429c60
push eax
call fcn.0041d13d
add esp, 0xc
mov dword [0x430a6c], eax
pop ebx
jmp 0x407f97
mov ecx, dword [0x430a64]
push 0x429cb0
push ecx
call fcn.0041d13d
add esp, 8
mov dword [0x430a6c], eax
test eax, eax
je 0x407fa4
call fcn.00407910
mov eax, dword [0x430a6c]
test eax, eax
jne 0x407e63
push str.cannot_open_tag_file
push 5
call fcn.00413260
add esp, 8
push 1
call fcn.0041d0d3
mov eax, dword [0x430a64]
push eax
call fcn.00413a10
add esp, 4
mov dword [0x430a68], eax
pop esi
ret

Function at 0x40c440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x40c465
add eax, eax
test ah, 1
je 0x40c455
and eax, 0xff
inc eax
and ecx, 0xff
xor eax, ecx
mov cl, byte [edx + 1]
inc edx
test cl, cl
jne 0x40c448
imul eax, eax, 0xffff9e37
shr eax, 9
and eax, 0x7f
ret
Function at 0x40ee00
Capabilities:
Terminate process

Disassembly:
push str.Darren_Hiebert
push str.5.5.4
push str.Exuberant_Ctags
push str._s__s__Copyright__C__1996_2003__s_n
call fcn.0041dbc6
push str.22:21:09
push str.Mar_29_2004
push str.__Compiled:__s___s_n
call fcn.0041dbc6
push str.http:__ctags.sourceforge.net
push str.dhiebert_users.sourceforge.net
push str.__Addresses:___s____s_n
call fcn.0041dbc6
add esp, 0x28
call fcn.0040ed60
mov eax, dword [0x42fe54]
dec eax
mov dword [0x42fe54], eax
js 0x40ee6b
mov eax, dword [0x42fe50]
mov byte [eax], 0xa
mov eax, dword [0x42fe50]
inc eax
mov dword [0x42fe50], eax
jmp 0x40ee7a
push 0x42fe50
push 0xa
call fcn.0041dab0
add esp, 8
call fcn.00413250
push eax
push str.Usage:__s__options___file_s___n
call fcn.0041dbc6
mov eax, dword [0x42fe54]
add esp, 8
dec eax
mov dword [0x42fe54], eax
js 0x40eeb0
mov ecx, dword [0x42fe50]
mov byte [ecx], 0xa
mov eax, dword [0x42fe50]
inc eax
mov dword [0x42fe50], eax
jmp 0x40eebf
push 0x42fe50
push 0xa
call fcn.0041dab0
add esp, 8
mov eax, 0x42f608
call fcn.0040ed20
push 0
call fcn.0041d0d3
int3

Function at 0x413260
Capabilities:
Terminate process

Disassembly:
push ebx
mov bl, byte [esp + 8]
test bl, 2
mov eax, str.Warning:
jne 0x413274
mov eax, 0x429ab8
push eax
mov eax, dword [0x430cb8]
push eax
push str._s:__s
push 0x42fe50
call fcn.0041cdc4
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
push ecx
push edx
push 0x42fe50
call fcn.0041e3f1
add esp, 0x1c
test bl, 4
je 0x4132c4
mov eax, dword [0x430fa8]
push eax
call fcn.0041e3c5
push eax
push str._:__s
push 0x42fe50
call fcn.0041cdc4
add esp, 0x10
push 0x42fe50
push 0x429e00
call fcn.0041da18
add esp, 8
test bl, 1
pop ebx
je 0x4132e3
push 1
call fcn.0041d0d3
ret
Function at 0x41d011
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x430ff4], esi
push edi
jne 0x41d031
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x430ff0], esi
mov byte [0x430fec], al
jne 0x41d097
mov ecx, dword [0x4325cc]
test ecx, ecx
je 0x41d078
mov eax, dword [0x4325c8]
sub eax, 4
cmp eax, ecx
jmp 0x41d071
mov eax, dword [eax]
test eax, eax
je 0x41d063
call eax
mov eax, dword [0x4325c8]
sub eax, 4
cmp eax, dword [0x4325cc]
mov dword [0x4325c8], eax
jae 0x41d05b
mov eax, 0x42f024
mov esi, 0x42f030
cmp eax, esi
mov edi, eax
jae 0x41d097
mov eax, dword [edi]
test eax, eax
je 0x41d090
call eax
add edi, 4
cmp edi, esi
jb 0x41d088
mov eax, 0x42f034
mov esi, 0x42f038
cmp eax, esi
mov edi, eax
jae 0x41d0b6
mov eax, dword [edi]
test eax, eax
je 0x41d0af
call eax
add edi, 4
cmp edi, esi
jb 0x41d0a7
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x41d0d1
push dword [ebp + 8]
mov dword [0x430ff4], 1
call fcn.0041cf7c
pop ecx
pop ebp
ret

Function at 0x41d3ee
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00422990
mov eax, dword [0x430370]
xor eax, dword [ebp + 4]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, dword [0x43124c]
mov dword [ebp - 4], eax
jae 0x41d52e
mov eax, ebx
sar eax, 5
mov eax, dword [eax*4 + 0x431260]
mov ecx, ebx
and ecx, 0x1f
test byte [eax + ecx*8 + 4], 1
je 0x41d52e
push 1
push esi
push ebx
call fcn.004228c0
add esp, 0xc
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x41d538
push 2
push esi
push ebx
call fcn.004228c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x41d538
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x41d4db
push 0x1000
lea eax, [ebp - 0x1008]
push esi
push eax
call fcn.00422860
push 0x8000
push ebx
call fcn.004227e9
add esp, 0x14
mov dword [ebp + 8], eax
mov eax, 0x1000
cmp edi, eax
jge 0x41d49a
mov eax, edi
push eax
lea eax, [ebp - 0x1008]
push eax
push ebx
call fcn.00421ce4
add esp, 0xc
cmp eax, 0xffffffff
je 0x41d4b8
sub edi, eax
test edi, edi
jg 0x41d48f
jmp 0x41d4ce
cmp dword [0x430fac], 5
jne 0x41d4cb
mov dword [0x430fa8], 0xd
or esi, 0xffffffff
push dword [ebp + 8]
push ebx
call fcn.004227e9
pop ecx
pop ecx
jmp 0x41d51b
jge 0x41d51b
push 0
push dword [ebp + 0xc]
push ebx
call fcn.004228c0
push ebx
call fcn.004227ad
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, 0xffffffff
jne 0x41d51b
mov dword [0x430fa8], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x430fac], eax
push 0
push dword [ebp - 8]
push ebx
call fcn.004228c0
add esp, 0xc
mov eax, esi
pop edi
jmp 0x41d53b
mov dword [0x430fa8], 9
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
pop ebx
call fcn.0042297d
leave
ret
Function at 0x41e75e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x430370]
xor eax, dword [ebp + 4]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
mov dword [ebp - 4], eax
je 0x41e7d7
push ebx
call fcn.0041e727
test eax, eax
pop ecx
jne 0x41e7a9
mov dword [0x430fac], 0xf
mov dword [0x430fa8], 0xd
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop ebx
call fcn.0042297d
leave
ret
and byte [ebp + 0xb], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0x104
lea eax, [ebp + 8]
add bl, 0x40
push eax
mov byte [ebp + 8], bl
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x2e
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x41e7e9
lea eax, [ebp - 0x10c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x41e799
inc eax
cmp eax, 0x104
ja 0x41e799
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x41e820
cmp eax, dword [ebp + 0x10]
jg 0x41e804
mov eax, dword [ebp + 0x10]
push eax
call fcn.0041e494
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x41e834
mov dword [0x430fa8], 0xc
jmp 0x41e799
cmp eax, dword [ebp + 0x10]
jle 0x41e834
mov dword [0x430fa8], 0x22
jmp 0x41e799
lea eax, [ebp - 0x10c]
push eax
push ecx
call fcn.00422fc0
pop ecx
pop ecx
jmp 0x41e79b