joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f7f6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push dword [ebp + 0x10]
xor edi, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
cmp ebx, edi
je 0x40f878
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, 1
mov esi, dword [ebp + 0x14]
mov dword [esi], eax
jbe 0x40f877
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov eax, dword [esi]
add eax, 0x10
push eax
call fcn.00402ab0
pop ecx
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [esi]
push ebx
push edi
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi]
add esp, 0xc
push ebx
mov byte [edi + eax], 0
call dword [sym.imp.KERNEL32.dll_FreeResource]
test edi, edi
je 0x40f877
cmp dword [esi], 4
jbe 0x40f877
push dword [ebp + 0x18]
push esi
push edi
call fcn.0040f77e
add esp, 0xc
mov edi, eax
pop esi
mov eax, edi
pop edi
pop ebx
pop ebp
ret

Function at 0x40fa1e
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
push ebx
push esi
push edi
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x206]
push ebx
push eax
mov word [ebp - 0x208], bx
call sub.MSVCRT.dll_memset
push dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x208]
push 0x4027a8
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40fa81
xor eax, eax
jmp 0x40fb05
lea eax, [ebp - 0x42c]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push 0x401a18
push eax
call esi
push dword [ebp + 0x10]
lea eax, [ebp - 0x208]
push dword [ebp + 0xc]
push eax
call fcn.00407866
add esp, 0x1c
test eax, eax
jne 0x40faea
cmp dword [ebp + 0x10], 0
lea eax, [ebp - 0x208]
push eax
je 0x40fadd
call fcn.0040f974
test eax, eax
pop ecx
je 0x40faea
push 3
lea ecx, [ebp - 0x208]
push ecx
push eax
call fcn.00407811
add esp, 0xc
jmp 0x40fae3
call fcn.004077c1
pop ecx
test eax, eax
je 0x40faea
xor ebx, ebx
inc ebx
lea eax, [ebp - 0x458]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40fa81
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40fde1
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x660
push esi
push edi
mov esi, 0x206
xor edi, edi
push esi
lea eax, [ebp - 0x40e]
push edi
push eax
mov word [ebp - 0x410], di
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x206]
push edi
push eax
mov word [ebp - 0x208], di
call sub.MSVCRT.dll_memset
add esp, 0x18
push dword [ebp + 8]
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x410]
push eax
call fcn.00402c6d
pop ecx
lea eax, [ebp - 0x660]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40fee7
cmp esi, edi
jbe 0x40fee7
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x208]
push 0x401a18
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
test byte [ebp - 0x660], 0x10
je 0x40feb4
lea eax, [ebp - 0x634]
push eax
call fcn.00404b60
test eax, eax
pop ecx
jne 0x40fece
push dword [ebp + 0x14]
lea eax, [ebp - 0x208]
push dword [ebp + 0xc]
push eax
call fcn.0040fa1e
add esp, 0xc
jmp 0x40fecc
push dword [ebp + 0x14]
lea eax, [ebp - 0x208]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.0040fce7
add esp, 0x10
mov edi, eax
lea eax, [ebp - 0x660]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40fe60
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x40feed
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
push esi
xor esi, esi
inc esi
mov dword [ebp - 4], esi
call fcn.00405308
test eax, eax
mov dword [ebp - 0xc], eax
je 0x40ff2d
push 0x10
call fcn.00402ab0
mov dword [0x41528c], eax
mov dword [esp], 0x402878
call fcn.004078a8
test eax, eax
pop ecx
mov dword [ebp - 4], eax
je 0x4100b7
and dword [ebp - 8], 0
and dword [ebp - 0x10], 0
push ebx
mov ebx, dword [ebp + 8]
movzx eax, word [ebx]
cmp ax, 0x24
jne 0x40ff47
mov dword [ebp - 8], esi
jmp 0x40ff50
cmp ax, 0x5c
jne 0x40ff54
mov dword [ebp - 0x10], esi
inc ebx
inc ebx
jmp 0x40ff39
push edi
push 0x2c
push ebx
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edi, eax
test edi, edi
je 0x40ff6a
and word [edi], 0
inc edi
inc edi
and word [ebp - 0x420], 0
mov esi, 0x206
push esi
lea eax, [ebp - 0x41e]
push 0
push eax
call sub.MSVCRT.dll_memset
and word [ebp - 0x218], 0
push esi
lea eax, [ebp - 0x216]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
push ebx
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [ebp - 0x10], 0
je 0x410052
lea eax, [ebp - 0x628]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [ebp - 0x628], 0
lea esi, [ebp - 0x628]
je 0x4100b5
lea eax, [ebp - 0x420]
push eax
push esi
lea eax, [ebp - 0x218]
push 0x401ce0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
xor ebx, ebx
inc ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00407a6e
add esp, 0x18
test eax, eax
jne 0x410022
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00407a6e
test eax, eax
pop ecx
pop ecx
je 0x41003f
push dword [ebp - 0xc]
lea eax, [ebp - 0x218]
push dword [ebp - 8]
push edi
push eax
call fcn.0040fde1
add esp, 0x10
test eax, eax
je 0x41003f
mov dword [ebp - 4], ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp word [esi], 0
jne 0x40ffde
jmp 0x4100b5
cmp word [ebp - 0x41e], 0x3a
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x41008c
cmp word [ebp - 0x41c], 0x5c
je 0x41008c
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x402874
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push eax
call esi
push dword [ebp - 0xc]
lea eax, [ebp - 0x218]
push dword [ebp - 8]
push edi
push eax
call fcn.0040fde1
add esp, 0x10
mov dword [ebp - 4], eax
pop edi
pop ebx
call fcn.00407bdb
xor eax, eax
cmp dword [ebp - 4], eax
pop esi
sete al
leave
ret
Function at 0x4100ea
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
lea eax, [ebp - 0x58]
push ebx
push eax
call sub.MSVCRT.dll_memset
xor eax, eax
mov dword [ebp - 0x18], ebx
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
inc edi
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x5c], 0x44
mov dword [ebp - 0x54], 0x402788
mov dword [ebp - 0x30], edi
mov word [ebp - 0x2c], di
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
xor ecx, ecx
mov eax, dword [ebp + 8]
movzx eax, word [eax]
cmp ax, 0x21
jne 0x410142
mov dword [ebp - 4], edi
jmp 0x41016e
cmp ax, 0x40
jne 0x410151
mov dword [ebp - 0x54], 0x4028a0
jmp 0x41016e
cmp ax, 0x3d
jne 0x41015c
mov dword [ebp - 8], edi
jmp 0x41016e
cmp ax, 0x24
jne 0x410166
mov edx, edi
jmp 0x41016e
cmp ax, 0x23
jne 0x410174
mov ecx, edi
add dword [ebp + 8], 2
jmp 0x410131
cmp ecx, ebx
je 0x4101cd
push 0x20
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
cmp esi, ebx
je 0x41018e
mov word [esi], bx
inc esi
inc esi
push dword [ebp + 8]
call fcn.00402b60
lea ecx, [ebp + 8]
push ecx
push eax
mov dword [ebp + 8], ebx
call fcn.004100c7
add esp, 0xc
cmp eax, ebx
je 0x4101c6
xor ecx, ecx
cmp dword [ebp - 4], ebx
push esi
sete cl
push edi
push ecx
push dword [ebp + 8]
push eax
call fcn.0040907a
add esp, 0x14
jmp 0x410281
mov eax, edi
jmp 0x410281
cmp edx, ebx
jne 0x410236
cmp dword [ebp - 4], ebx
je 0x4101da
mov word [ebp - 0x2c], bx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
cmp esi, ebx
je 0x41022b
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [0x4152d4]
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
cmp dword [ebp - 8], ebx
je 0x410218
push 0xffffffffffffffff
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x18]
call edi
xor edi, edi
inc edi
xor eax, eax
cmp esi, ebx
sete al
cmp eax, ebx
je 0x41026a
push ebx
push dword [ebp + 8]
mov esi, edi
call fcn.00408fed
cmp dword [ebp - 4], ebx
pop ecx
pop ecx
je 0x41024a
xor esi, esi
push esi
push ebx
push eax
push dword [ebp + 8]
push 0x402894
push dword [0x4152c8]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x1f
pop ecx
cmp ecx, eax
sbb esi, esi
neg esi
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [0x4152d4]
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
xor eax, eax
cmp esi, ebx
sete al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411994
Capabilities:
Get common file path
Query environment variable
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
push ebx
push esi
push edi
mov esi, 0x206
xor edi, edi
push esi
lea eax, [ebp - 0x40e]
push edi
push eax
mov word [ebp - 0x410], di
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebp + 8]
lea eax, [ebp - 0x618]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
lea eax, [ebp - 0x618]
push edi
push eax
call fcn.0040f8cf
mov ebx, eax
add esp, 0xc
cmp ebx, edi
jne 0x4119ee
xor eax, eax
inc eax
jmp 0x411a9c
push esi
lea eax, [ebp - 0x206]
push edi
push eax
mov word [ebp - 0x208], di
call sub.MSVCRT.dll_memset
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x208]
push eax
push 0x402600
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x410]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x618]
push eax
call fcn.0040c86d
push ebx
call fcn.0040c7ac
push ebx
mov esi, eax
call sub.MSVCRT.dll_free
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x411a6e
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x402874
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x208]
push eax
call fcn.0040c86d
pop ecx
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x411aa1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
and word [ebp - 0x800], 0
push ebx
mov ebx, dword [0x4152d8]
push edi
push 0x7fe
lea eax, [ebp - 0x7fe]
push 0
push eax
call sub.MSVCRT.dll_memset
mov edi, dword [ebp + 8]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jle 0x411b31
cmp word [edi], 0x5c
je 0x411aec
cmp word [edi + 2], 0x3a
jne 0x411b3b
push edi
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x800]
push eax
call fcn.00407ae2
lea eax, [ebp - 0x800]
push eax
call fcn.00402c8c
test eax, eax
pop ecx
pop ecx
je 0x411b25
lea eax, [ebp - 0x800]
push eax
call fcn.00411994
pop ecx
pop edi
mov dword [0x4152d8], ebx
xor eax, eax
pop ebx
leave
ret
test eax, eax
jle 0x411b3b
cmp word [edi], 0x5c
je 0x411aec
push esi
lea eax, [ebp - 0x800]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x402874
lea eax, [ebp - 0x800]
push eax
call esi
push edi
lea eax, [ebp - 0x800]
push eax
call esi
pop esi
jmp 0x411afa
Function at 0x412397
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x2c
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
cmp esi, ebx
je 0x4123bd
mov word [esi], bx
inc esi
inc esi
cmp word [edi], 0x24
jne 0x4123ce
add edi, 2
push edi
call fcn.00412351
jmp 0x4123d4
push edi
call fcn.0041202a
pop ecx
push 0x206
mov edi, eax
lea eax, [ebp - 0x206]
push ebx
push eax
mov word [ebp - 0x208], bx
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp esi, ebx
push edi
je 0x412406
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
jmp 0x41244f
call fcn.00404941
pop ecx
mov esi, eax
cmp esi, ebx
push 0x50
lea eax, [ebp - 0x208]
push eax
je 0x412422
push 0x2721
jmp 0x412427
push 0x2722
push dword [0x4152cc]
call dword [sym.imp.USER32.dll_LoadStringW]
push ebx
lea eax, [ebp - 0x208]
push eax
push edi
push dword [0x4152c8]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
cmp esi, ebx
sete al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403c02
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
xor eax, eax
lea edi, [ebp - 0x1c]
mov ebx, 4
mov esi, ecx
dec eax
mov dword [edi], esp
mov dword [edi + 0xc], eax
mov dword [edi + 8], 0x404870
mov eax, dword fs:[0]
mov dword [edi + 4], eax
lea eax, [edi + ebx]
mov dword fs:[0], eax
call fcn.00402d9e
mov eax, dword [ebp + 8]
mov dword [esi], vtable.std::__1::__stdinbuf_char_.0
lea ecx, [ebp - 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x28], eax
xor eax, eax
add ebx, esi
dec eax
mov dword [esi + 0x30], eax
mov byte [esi + 0x34], 0
push ebx
call fcn.00413130
mov eax, dword [esi]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x24], esi
mov ecx, esi
mov eax, dword [eax + 4]
mov dword [edi + 0xc], 0
push edx
call eax
lea ecx, [ebp - 0x20]
call fcn.00404d10
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x24]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x403cb2
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
lea edi, [ebp - 0x1c]
mov ebx, 4
mov esi, ecx
mov dword [edi], esp
mov dword [edi + 0xc], 0xffffffff
mov dword [edi + 8], 0x404880
mov eax, dword fs:[0]
mov dword [edi + 4], eax
lea eax, [edi + ebx]
mov dword fs:[0], eax
call fcn.00402f56
mov eax, dword [ebp + 8]
mov dword [esi], vtable.std::__1::__stdinbuf_wchar_t_.0
add ebx, esi
lea ecx, [ebp - 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x28], eax
mov word [esi + 0x30], 0xffff
mov byte [esi + 0x32], 0
push ebx
call fcn.00413130
mov eax, dword [esi]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x24], esi
mov ecx, esi
mov eax, dword [eax + 4]
mov dword [edi + 0xc], 0
push edx
call eax
lea ecx, [ebp - 0x20]
call fcn.00404d10
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x24]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x4044ee
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x20], ecx
mov eax, dword [0x46510c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, dword [ebp - 0x20]
mov ecx, dword [edi + 0x24]
lea edx, [ebp - 0x1c]
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
push dword [edi + 0x28]
call dword [eax + 0x10]
mov esi, dword [ebp - 0x1c]
mov ebx, eax
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.0044297d
add esp, 0x10
cmp eax, esi
jne 0x40455e
cmp ebx, 1
je 0x404507
cmp ebx, 2
mov esi, 0xffffffff
je 0x404561
mov eax, dword [ebp - 0x20]
push dword [eax + 0x20]
call fcn.0044252e
add esp, 4
neg eax
sbb esi, esi
jmp 0x404561
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042fd3a
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404576
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x40459a
push dword [ecx + 0x20]
push esi
push 1
push eax
call fcn.0044297d
add esp, 0x14
jmp 0x4045c9
test esi, esi
jle 0x4045c2
xor edi, edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov ebx, eax
movzx eax, byte [eax + edi]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp eax, 0xffffffff
je 0x4045c4
inc edi
mov eax, ebx
cmp esi, edi
jne 0x4045a3
mov edi, esi
jmp 0x4045c4
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x4045d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x46510c]
mov ebx, dword [ebp + 8]
xor eax, ebp
cmp ebx, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x404690
mov byte [ebp - 0x19], bl
mov esi, ecx
cmp byte [ecx + 0x2c], 0
je 0x404617
xor edi, edi
lea eax, [ebp - 0x19]
inc edi
push dword [esi + 0x20]
push edi
push edi
push eax
call fcn.0044297d
add esp, 0x10
cmp eax, edi
je 0x404690
jmp 0x40469a
lea ebx, [ebp - 0x19]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
mov ecx, dword [esi + 0x24]
lea edx, [ebp - 0x20]
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push ebx
push dword [esi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], ebx
je 0x40469a
mov edi, eax
cmp eax, 3
je 0x404678
cmp edi, 1
ja 0x40469a
mov ebx, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub ebx, eax
push dword [esi + 0x20]
push ebx
push 1
push eax
call fcn.0044297d
add esp, 0x10
cmp eax, ebx
jne 0x40469a
mov ebx, dword [ebp - 0x24]
cmp edi, 1
je 0x404622
jmp 0x40468d
xor edi, edi
inc edi
push dword [esi + 0x20]
push edi
push edi
push ebx
call fcn.0044297d
add esp, 0x10
cmp eax, edi
jne 0x40469a
mov ebx, dword [ebp + 8]
xor esi, esi
cmp ebx, 0xffffffff
cmovne esi, ebx
jmp 0x40469d
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042fd3a
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x4046e2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x404706
push dword [ecx + 0x20]
push esi
push 2
push eax
call fcn.0044297d
add esp, 0x14
jmp 0x404736
test esi, esi
jle 0x40472f
xor edi, edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov ebx, eax
movzx eax, word [eax + edi*2]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp ax, 0xffff
je 0x404731
inc edi
mov eax, ebx
cmp esi, edi
jne 0x40470f
mov edi, esi
jmp 0x404731
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x40473e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x46510c]
movzx ebx, word [ebp + 8]
xor eax, ebp
cmp bx, 0xffff
mov dword [ebp - 0x10], eax
je 0x404803
mov word [ebp - 0x1a], bx
mov edi, ecx
cmp byte [ecx + 0x2c], 0
je 0x404789
xor esi, esi
lea eax, [ebp - 0x1a]
inc esi
push dword [edi + 0x20]
push esi
push 2
push eax
call fcn.0044297d
add esp, 0x10
cmp eax, esi
je 0x404803
jmp 0x40480e
lea esi, [ebp - 0x1a]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
mov ecx, dword [edi + 0x24]
lea edx, [ebp - 0x20]
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x40480e
mov ebx, eax
cmp eax, 3
je 0x4047ea
cmp ebx, 1
ja 0x40480e
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.0044297d
add esp, 0x10
cmp eax, esi
jne 0x40480e
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x404794
jmp 0x4047ff
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.0044297d
add esp, 0x10
cmp eax, ebx
jne 0x40480e
movzx ebx, word [ebp + 8]
xor eax, eax
cmp bx, 0xffff
cmove ebx, eax
jmp 0x404811
xor ebx, ebx
dec ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042fd3a
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x404978
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x4049a7
movsx esi, byte [edx]
shl eax, 4
inc edx
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
cmp ecx, edx
jne 0x404989
pop esi
pop edi
pop ebp
ret 8

Function at 0x404a96
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x404ac7
movzx esi, word [edx]
shl eax, 4
add edx, 2
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
cmp ecx, edx
jne 0x404aa7
pop esi
pop edi
pop ebp
ret 8
Function at 0x409b4e
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
lea ecx, [esi + 0x38]
mov dword [ecx - 4], esp
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x417560
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor eax, eax
lea ecx, [esi + 0x20]
xor edi, edi
mov dword [ecx + 4], eax
mov dword [ecx], 0x25
mov eax, ecx
mov ecx, dword [ebp + 0x10]
inc edi
or eax, edi
push dword [ecx + 4]
mov ebx, ecx
push edi
push 0x455fc2
push eax
call fcn.00409670
add esp, 0x10
mov ebx, dword [ebx + 4]
mov dword [esi + 0x14], esp
shr ebx, 9
and ebx, edi
lea eax, [ebx + 0x17]
mov dword [esi + 4], eax
sub esp, 0x18
mov edi, esp
lea eax, [esi + 0x28]
mov dword [esi + 0xc], edi
push eax
call fcn.00406762
add esp, 4
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
lea eax, [esi + 0x20]
push eax
lea eax, [esi + 0x28]
push dword [eax + 4]
push dword [eax]
push dword [esi + 4]
push edi
call fcn.00418c09
add esp, 0x1c
mov edi, eax
mov eax, dword [esi + 0xc]
add edi, eax
push dword [ebp + 0x10]
push edi
push eax
call fcn.004096da
add esp, 0xc
mov dword [esi + 4], eax
lea eax, [ebx + ebx + 0x2e]
and eax, 0xfffffffc
call fcn.00430010
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 8]
mov ebx, esp
push eax
call fcn.004031be
lea edx, [esi + 8]
lea eax, [esi + 0x38]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0x18]
lea ecx, [esi + 0x1c]
push edx
push eax
push ecx
mov dword [esi + 0x10], ebx
push ebx
push edi
push dword [esi + 4]
push dword [esi + 0xc]
call fcn.00409726
add esp, 0x1c
mov ecx, dword [esi + 8]
xor eax, eax
mov edi, dword [ebp + 8]
mov dl, byte [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x409c69
mov eax, dword [ecx]
call dword [eax + 4]
mov dl, byte [ebp + 0x14]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
movsx edx, dl
mov dword [esi + 0x40], 0xffffffff
push edx
push dword [ebp + 0x10]
push eax
push ecx
push dword [esi + 0x10]
push ebx
push edi
call fcn.004099a1
add esp, 0x1c
mov esp, dword [esi + 0x14]
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18