joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007630
Capabilities:
Extract resource via kernel32 functions
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x214
mov edi, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov ebx, eax
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
xor eax, eax
test ebx, ebx
je 0x100077b8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp + 0x14]
cmp dword [ebx], 0
jne 0x100076e5
mov eax, dword [0x100141a0]
test eax, eax
je 0x10007782
push ebx
call eax
mov dword [ebx + 8], eax
test eax, eax
js 0x100076d7
lea ebx, [ebp - 0x220]
push 0x104
push ebx
push edi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov ecx, dword [eax]
push ebx
push str.MODULE
push eax
call dword [ecx + 0xc]
push 0x104
push ebx
push str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov ecx, dword [eax]
push ebx
mov ebx, dword [ebp + 0x14]
push str.SystemRoot
push eax
call dword [ecx + 0xc]
cmp dword [ebx], 0
mov eax, 0
je 0x100077b8
push 0
push 0
push esi
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 0x18]
push esi
push 0
push 0xfde9
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov edi, eax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [eax + 0x30]
lea ecx, [edi*2 + 2]
push ecx
push 0
push dword [eax + 0x18]
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x10007776
mov ebx, eax
mov eax, edi
inc eax
push eax
push ebx
push dword [ebp - 0x10]
push esi
push 0
push 0xfde9
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov word [ebx + edi*2], 0
xor eax, eax
mov esi, dword [ebp + 0x14]
cmp dword [esi + 4], 0
sete al
mov ecx, dword [esi]
mov edx, dword [ecx]
push ebx
push ecx
call dword [edx + eax*4 + 0x24]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x30]
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 8]
not eax
shr eax, 0x1f
jmp 0x100077b8
mov eax, dword [ebp + 0x14]
mov dword [eax + 8], 0x8007000e
jmp 0x100077b6
push str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov dword [0x100141a4], eax
test eax, eax
je 0x100077af
push str.AtlCreateRegistrar
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x100141a0], eax
test eax, eax
jne 0x10007684
mov dword [ebx + 8], 0x80004002
xor eax, eax
add esp, 0x214
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x4011c0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str.zulu_crash_dump.txt
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
pop esi
je 0x4011f4
test al, 0x10
jne 0x4011f4
mov eax, 1
ret
xor eax, eax
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x248417d2
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
mov eax, section..rsrc
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x5e243dae
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x439830
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x402ae6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
mov dword [ebp - 8], 0x402498
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaInStr]
push 1
xor ebx, ebx
mov eax, dword [esi]
mov dword [ebp - 0x18], ebx
push eax
push 0x40cddc
push ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x40], ebx
call edi
mov ecx, dword [esi]
xor edx, edx
test eax, eax
push 1
push ecx
setle dl
push 0x40c584
push ebx
mov dword [ebp - 0x4c], edx
call edi
mov edx, dword [ebp - 0x4c]
neg eax
sbb eax, eax
neg eax
or edx, eax
jne 0x4398c3
mov eax, dword [esi]
push ebx
push 0xffffffffffffffff
push 1
push 0x40c584
push 0x40cddc
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcReplace]
mov edx, eax
mov ecx, esi
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov ecx, dword [esi]
push 1
push ecx
push 0x40c584
push 0
call edi
sub eax, 1
lea edx, [ebp - 0x40]
jo 0x43995d
push eax
lea eax, [ebp - 0x30]
push edx
push eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x40], 0x4008
call dword [sym.imp.MSVBVM60.DLL_rtcLeftCharVar]
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrVarMove]
mov edx, eax
lea ecx, [ebp - 0x18]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x20]
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
push 0x439947
jmp 0x43993d
lea ecx, [ebp - 0x18]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
ret
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x40a708
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
lea eax, [esp + 4]
push ebx
push esi
push edi
push 0x30
xor esi, esi
push esi
push eax
call fcn.0041d24f
pop ecx
pop ecx
lea ecx, [esp + 0x14]
call fcn.00411e25
test eax, eax
je 0x40a73a
push 0x27
pop eax
jmp 0x40a7f2
mov ebx, dword [ebp + 8]
mov edi, esi
jmp 0x40a7d9
cmp edi, eax
jge 0x40a783
cmp dword [esp + 0x14], esi
jne 0x40a783
push dword [0x42f420]
mov ecx, dword [0x43053c]
mov edx, ebx
push dword [0x430520]
push edi
call fcn.00411d8e
add esp, 0xc
test eax, eax
jle 0x40a7fb
mov ecx, dword [0x430520]
add edi, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
mov eax, dword [0x430524]
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], eax
mov eax, dword [0x42f424]
mov dword [esp + 0x24], eax
call fcn.00412936
mov dword [esp + 0xc], eax
test eax, eax
je 0x40a7ab
cmp eax, 4
jne 0x40a802
mov ecx, dword [0x42f424]
sub ecx, dword [esp + 0x24]
je 0x40a7d4
push dword [ebp + 0xc]
push 1
push ecx
push dword [0x430524]
call fcn.004159c5
add esp, 0x10
cmp eax, 1
jne 0x40a806
mov eax, dword [esp + 0xc]
cmp eax, 4
je 0x40a7e7
mov eax, dword [ebx + 8]
test eax, eax
jne 0x40a744
push 0x28
pop esi
lea ecx, [esp + 0x10]
call fcn.00412a85
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 6
jmp 0x40a734
push 0x27
jmp 0x40a7e6
push 0x46
jmp 0x40a7e6

Function at 0x40a80a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x42e440]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
push ebx
push 0x20
push 1
push edi
call fcn.004160dd
add esp, 0x10
cmp eax, 0x20
je 0x40a838
push 6
jmp 0x40a8b2
push dword [edi + 8]
mov esi, dword [0x42f540]
call esi
push dword [edi + 0xc]
mov dword [edi + 8], eax
call esi
push dword [edi + 0x10]
mov dword [edi + 0xc], eax
call esi
push dword [edi + 0x14]
mov dword [edi + 0x10], eax
call esi
push dword [edi + 0x18]
mov dword [edi + 0x14], eax
call esi
push dword [edi + 0x1c]
mov dword [edi + 0x18], eax
call esi
push ebx
mov dword [edi + 0x1c], eax
call fcn.0041bd12
lea ecx, [ebp - 0x38]
push ecx
push eax
call fcn.00415ba2
add esp, 0xc
test eax, eax
jne 0x40a834
cmp dword [edi], 0x4944424d
jne 0x40a8b0
cmp dword [edi + 4], 0x30314646
jne 0x40a8b0
mov ecx, dword [edi + 0x14]
add ecx, dword [edi + 0x18]
mov eax, dword [edi + 0x1c]
add eax, 0x20
add eax, ecx
sub eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
and eax, 0x29
jmp 0x40a8b3
push 0x29
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00414f81
mov esp, ebp
pop ebp
ret
Function at 0x40a8c4
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x18
push ebx
mov ebx, ecx
mov dword [esp + 0x10], edx
push edi
mov edi, dword [ebx + 0x14]
add edi, dword [ebx + 0x18]
mov ecx, dword [ebx + 8]
add ecx, dword [esp + 0x24]
add edi, dword [ebx + 0x1c]
push edi
mov dword [esp + 0x10], ecx
call fcn.00415076
mov dword [esp + 0x14], eax
pop ecx
test eax, eax
jne 0x40a8fa
push 0xc
pop eax
jmp 0x40aa38
push ebp
push esi
xor esi, esi
mov ecx, eax
mov dword [esp + 0x10], ecx
test edi, edi
je 0x40a941
mov ebp, 0x7fffffff
cmp edi, 0x7fffffff
ja 0x40a917
mov ebp, edi
push dword [esp + 0x1c]
push ebp
push 1
push ecx
call fcn.004160dd
add esp, 0x10
cmp eax, ebp
jne 0x40aa1f
mov ecx, dword [esp + 0x10]
add ecx, eax
mov dword [esp + 0x10], ecx
sub edi, eax
jne 0x40a908
mov eax, dword [esp + 0x18]
mov ebp, dword [ebx + 0x14]
mov edi, eax
mov ecx, dword [ebx + 0x1c]
add ebp, eax
mov eax, dword [ebx + 0x18]
mov ebx, dword [esp + 0x2c]
add eax, ebp
add ecx, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
push dword [edi]
call dword [0x42f540]
push dword [edi + 4]
mov dword [edi], eax
call dword [0x42f540]
push dword [edi + 8]
mov dword [edi + 4], eax
call dword [0x42f540]
mov ecx, dword [edi]
mov dword [edi + 8], eax
lea eax, [ecx + ebx]
cmp eax, dword [esp + 0x14]
ja 0x40aa27
lea eax, [ecx + ebp]
cmp eax, dword [esp + 0x1c]
ja 0x40aa27
mov edx, esi
test ecx, ecx
je 0x40a9b9
mov ecx, ebp
sub ebx, ebp
mov al, byte [ebx + ecx]
add byte [ecx], al
inc edx
inc ecx
cmp edx, dword [edi]
jb 0x40a9ae
push dword [esp + 0x30]
mov ebx, dword [edi]
push ebx
push 1
push ebp
call fcn.004159c5
add esp, 0x10
cmp eax, ebx
jne 0x40aa23
mov eax, dword [edi + 4]
add ebp, ebx
mov ecx, dword [esp + 0x10]
add eax, ecx
add dword [esp + 0x2c], ebx
cmp eax, dword [esp + 0x20]
ja 0x40aa27
push dword [esp + 0x30]
mov ebx, dword [edi + 4]
push ebx
push 1
push ecx
call fcn.004159c5
add esp, 0x10
cmp eax, ebx
jne 0x40aa23
add dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x2c]
add ebx, dword [edi + 8]
mov dword [esp + 0x2c], ebx
cmp ebx, dword [esp + 0x14]
ja 0x40aa27
add edi, 0xc
cmp edi, dword [esp + 0x24]
jb 0x40a966
jmp 0x40aa2a
push 6
jmp 0x40aa29
push 0x40
jmp 0x40aa29
push 0x29
pop esi
push dword [esp + 0x18]
call fcn.0041503e
pop ecx
mov eax, esi
pop esi
pop ebp
pop edi
pop ebx
add esp, 0x18
ret

Function at 0x40b237
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
xor ecx, ecx
mov dword [esi + 4], eax
lea eax, [ebp + 8]
push eax
push ecx
push esi
push 0x40206f
push ecx
push ecx
mov dword [esi + 8], ecx
call fcn.004171e8
xor ecx, ecx
mov dword [esi], eax
add esp, 0x18
test eax, eax
setne cl
pop esi
lea eax, [ecx - 1]
pop ebp
ret 8
Function at 0x40b80f
Capabilities:
Create directory

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x2f
pop eax
mov edi, ecx
xor ebp, ebp
push eax
push edi
mov esi, ebp
call fcn.004163dd
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x40b87f
xor eax, eax
mov ecx, edi
mov word [ebx], ax
call fcn.0040b80f
mov esi, eax
test esi, esi
jne 0x40b879
cmp word [edi], bp
je 0x40b879
push edi
call fcn.00416961
pop ecx
test eax, eax
jns 0x40b877
call fcn.00416f77
cmp dword [eax], 0x11
je 0x40b877
call fcn.00416f77
push dword [eax]
push edi
push 0x4293b4
call fcn.0040b20e
push eax
call fcn.00411705
add esp, 0x10
push 7
pop esi
jmp 0x40b879
mov esi, ebp
push 0x2f
pop eax
mov word [ebx], ax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x40b886
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x42e440]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
mov esi, edx
mov edi, ecx
mov ecx, esi
call fcn.0040b80f
test eax, eax
jne 0x40b997
lea eax, [ebp - 0x3c]
push eax
push edi
call fcn.00416ac9
pop ecx
pop ecx
test eax, eax
je 0x40b8de
call fcn.00416f77
push dword [eax]
push edi
push 0x429430
call fcn.0040b20e
push eax
call fcn.00411705
add esp, 0x10
push 6
pop eax
jmp 0x40b997
mov eax, dword [ebp - 0x36]
mov ecx, 0x8000
and eax, 0xf000
cmp ax, cx
je 0x40b931
cmp byte [ebp + 8], 0
je 0x40b91f
mov ecx, 0x4000
cmp ax, cx
je 0x40b91f
call fcn.00416f77
push dword [eax]
push edi
push 0x42946c
call fcn.0040b20e
push eax
call fcn.00411705
add esp, 0x10
push 0x30
jmp 0x40b8d8
push 0x4294a4
call fcn.0040b20e
push eax
call fcn.00411705
pop ecx
pop ecx
push 0
push esi
call fcn.00416483
pop ecx
pop ecx
test eax, eax
jne 0x40b965
mov ecx, esi
call fcn.0040b567
test eax, eax
je 0x40b965
push esi
push 0x4294d8
call fcn.0040b20e
push eax
call fcn.00411705
add esp, 0xc
push 0x3e
jmp 0x40b8d8
push esi
push edi
call fcn.00417acb
pop ecx
pop ecx
test eax, eax
je 0x40b995
call fcn.00416f77
push dword [eax]
push esi
push edi
push 0x42951c
call fcn.0040b20e
push eax
call fcn.00411705
add esp, 0x14
push 7
jmp 0x40b8d8
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.00414f81
mov esp, ebp
pop ebp
ret
Function at 0x40c2a6
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
sub esp, 0x40
mov eax, dword [0x42e440]
xor eax, esp
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x44]
push ebx
push ebp
push esi
push edi
push eax
mov edi, ecx
mov dword [esp + 0x18], eax
call fcn.0041bd12
lea ecx, [esp + 0x1c]
push ecx
push eax
call fcn.00415ba2
add esp, 0xc
test eax, eax
je 0x40c2ff
call fcn.00416f77
push dword [eax]
push dword [edi + 0x10]
push 0x429a70
call fcn.0040b20e
push eax
call fcn.00411705
add esp, 0x10
push 6
pop eax
jmp 0x40c3db
mov esi, dword [edi + 0x20]
push esi
cmp dword [esp + 0x30], esi
je 0x40c324
push dword [esp + 0x30]
push 0x429ab0
call fcn.0040b20e
push eax
call fcn.00411705
add esp, 0x10
push 2
jmp 0x40c2f9
call fcn.00415076
mov ebx, eax
mov dword [edi + 0x38], ebx
pop ecx
test ebx, ebx
jne 0x40c337
push 0xd
jmp 0x40c2f9
test esi, esi
je 0x40c364
mov ebp, esi
cmp esi, 0x7fffffff
jb 0x40c34a
mov ebp, 0x7fffffff
push dword [esp + 0x14]
push ebp
push 1
push ebx
call fcn.004160dd
add esp, 0x10
cmp eax, ebp
jne 0x40c3be
add ebx, eax
sub esi, eax
jne 0x40c33b
mov esi, dword [edi + 0x38]
or edx, 0xffffffff
mov ecx, dword [edi + 0x20]
xor ebp, ebp
add ecx, esi
mov eax, ecx
sub eax, esi
cmp ecx, esi
sbb ebx, ebx
not ebx
and ebx, eax
je 0x40c399
movzx eax, byte [esi]
mov ecx, edx
shr ecx, 0x18
xor ecx, eax
shl edx, 8
xor edx, dword [ecx*4 + 0x428390]
inc esi
inc ebp
cmp ebp, ebx
jne 0x40c37f
not edx
cmp edx, dword [edi + 0x24]
je 0x40c3d9
push dword [edi + 0x24]
push edx
push 0x429b30
call fcn.0040b20e
push eax
call fcn.00411705
add esp, 0x10
push 4
jmp 0x40c2f9
push dword [edi + 0x10]
push 0x429afc
call fcn.0040b20e
push eax
call fcn.00411705
add esp, 0xc
jmp 0x40c2f7
xor eax, eax
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00414f81
add esp, 0x40
ret 4

Function at 0x40cfbe
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x414
mov eax, dword [0x42e440]
xor eax, esp
mov dword [esp + 0x410], eax
push ebp
push edi
xor eax, eax
mov ebp, 0x206
push ebp
push eax
mov word [esp + 0x10], ax
mov edi, ecx
lea eax, [esp + 0x12]
push eax
call fcn.0041d24f
add esp, 0xc
lea eax, [esp + 8]
push eax
push 0
push 0x429de4
push dword [0x43074c]
call dword [0x423108]
lea ecx, [esp + 8]
call fcn.0040b80f
test eax, eax
je 0x40d01a
xor al, al
jmp 0x40d05c
push esi
lea eax, [esp + 0xc]
push 0x427d94
push eax
call fcn.0041523a
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x40d059
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d037
push esi
sub ecx, edx
push 1
push ecx
push edi
call fcn.004159c5
add esp, 0x10
push esi
cmp eax, 1
je 0x40d073
call fcn.00415b2b
pop ecx
xor al, al
pop esi
mov ecx, dword [esp + 0x418]
pop edi
pop ebp
xor ecx, esp
call fcn.00414f81
add esp, 0x414
ret
call fcn.00415b2b
xor eax, eax
push ebp
push eax
mov word [esp + 0x220], ax
lea eax, [esp + 0x222]
push eax
call fcn.0041d24f
push dword [0x43074c]
lea eax, [esp + 0x228]
push 0x429dec
push 0x104
push eax
call fcn.0040b1e4
add esp, 0x20
lea eax, [esp + 0x214]
push 1
push eax
lea eax, [esp + 0x14]
push eax
call dword [0x4230f4]
test eax, eax
setne al
jmp 0x40d05b
Function at 0x40d121
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x42e440]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push dword [0x43074c]
lea eax, [ebp - 0x24c]
push 0x429e34
push 0x104
push eax
call fcn.0040b1e4
lea eax, [ebp - 0x24c]
push 0x429bd4
push eax
call fcn.0041523a
mov edx, eax
add esp, 0x18
mov dword [ebp - 0x250], edx
test edx, edx
jne 0x40d175
xor bl, bl
jmp 0x40d1eb
push esi
push edi
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x23]
xor ebx, ebx
mov byte [ebp - 0x24], bl
rep stosd dword es:[edi], eax
push edx
push 1
push 0x20
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x24]
push eax
call fcn.004160dd
mov esi, 0x429e58
lea edi, [ebp - 0x44]
push 0xf
lea eax, [ebp - 0x44]
push eax
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x24]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x429e68
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0041653f
add esp, 0x1c
pop edi
pop esi
test eax, eax
je 0x40d1dd
push 0xf
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0041653f
add esp, 0xc
test eax, eax
jne 0x40d1df
mov bl, 1
push dword [ebp - 0x250]
call fcn.00415b2b
pop ecx
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00414f81
mov esp, ebp
pop ebp
ret

Function at 0x40d1fc
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x23c
mov eax, dword [0x42e440]
xor eax, esp
mov dword [esp + 0x238], eax
push ebx
push ebp
push dword [0x43074c]
mov ebp, ecx
lea eax, [esp + 0x3c]
push 0x429e34
push 0x104
xor ebx, ebx
push eax
mov byte [ebp], bl
call fcn.0040b1e4
lea eax, [esp + 0x48]
push 0x429bd4
push eax
call fcn.0041523a
mov edx, eax
add esp, 0x18
mov dword [esp + 8], edx
test edx, edx
je 0x40d2a9
push esi
push edi
push 7
pop ecx
xor eax, eax
mov byte [esp + 0x20], bl
lea edi, [esp + 0x21]
rep stosd dword es:[edi], eax
push edx
push 1
push 0x20
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x2c]
push eax
call fcn.004160dd
mov esi, 0x429e78
lea edi, [esp + 0x24]
push 9
lea eax, [esp + 0x28]
push eax
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x38]
push eax
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.0041653f
push dword [esp + 0x2c]
neg eax
mov bl, 1
sbb al, al
inc al
mov byte [ebp], al
call fcn.00415b2b
add esp, 0x20
pop edi
pop esi
mov ecx, dword [esp + 0x240]
mov al, bl
pop ebp
pop ebx
xor ecx, esp
call fcn.00414f81
add esp, 0x23c
ret
Function at 0x40d333
Capabilities:
Create directory

Disassembly:
sub esp, 0x830
mov eax, dword [0x42e440]
xor eax, esp
mov dword [esp + 0x828], eax
push ebp
push esi
push edi
mov ebp, 0x104
lea eax, [esp + 0x10]
push ebp
push eax
mov esi, 0x431230
push esi
call dword [0x4230c8]
test eax, eax
jne 0x40d36d
push 0x22
pop eax
jmp 0x40d57e
lea eax, [esp + 0x10]
push eax
push 0x429ee8
lea eax, [esp + 0x220]
push ebp
push eax
call fcn.0040b1e4
push esi
push 0x429ef8
lea eax, [esp + 0x640]
push ebp
push eax
call fcn.0040b1e4
add esp, 0x20
lea ecx, [esp + 0x218]
xor dl, dl
call fcn.0040b5a6
lea eax, [esp + 0x218]
push eax
lea eax, [esp + 0x14]
push eax
push 0x429f18
call fcn.0040b20e
push eax
call fcn.00411705
push 1
lea edx, [esp + 0x22c]
lea ecx, [esp + 0x24]
call fcn.0040b886
add esp, 0x14
xor edi, edi
jmp 0x40d424
mov eax, edi
inc edi
cmp eax, 0xa
jge 0x40d42b
push esi
call dword [fcn.004230d0]
push eax
lea eax, [esp + 0x18]
push eax
push edi
push 0x429f48
call fcn.0040b20e
push eax
call fcn.00411705
add esp, 0x18
push 0x64
call dword [fcn.00423118]
push 1
lea edx, [esp + 0x21c]
lea ecx, [esp + 0x14]
call fcn.0040b886
pop ecx
mov esi, eax
cmp esi, 7
je 0x40d3e0
test esi, esi
je 0x40d44a
push esi
push 0x429fa4
call fcn.0040b20e
push eax
call fcn.00411705
add esp, 0xc
mov eax, esi
jmp 0x40d57e
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x62c]
push eax
push 0x429fd0
call fcn.0040b20e
push eax
call fcn.00411705
push 1
lea edx, [esp + 0x24]
lea ecx, [esp + 0x63c]
call fcn.0040b886
mov esi, eax
add esp, 0x14
test esi, esi
je 0x40d4d9
push esi
push 0x429ffc
call fcn.0040b20e
push eax
call fcn.00411705
add esp, 0xc
push 0x42a028
call fcn.0040b20e
push eax
call fcn.00411705
xor dl, dl
lea ecx, [esp + 0x18]
call fcn.0040b5a6
push 1
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x224]
call fcn.0040b886
add esp, 0xc
test eax, eax
je 0x40d443
push eax
push 0x42a050
jmp 0x40d435
push 0x42a080
call fcn.0040b20e
push eax
call fcn.00411705
pop ecx
pop ecx
mov dl, 1
lea ecx, [esp + 0x218]
call fcn.0040b5a6
test eax, eax
je 0x40d575
push eax
push 0x42a098
call fcn.0040b20e
push eax
call fcn.00411705
add esp, 0xc
lea eax, [esp + 0x10]
push 0x429718
push eax
push 0x42a0b8
lea eax, [esp + 0x42c]
push ebp
push eax
call fcn.0040b1e4
add esp, 0x14
lea eax, [esp + 0x420]
push eax
call fcn.00416992
pop ecx
lea eax, [esp + 0x420]
push 0
push eax
call fcn.00416483
pop ecx
pop ecx
test eax, eax
je 0x40d562
lea eax, [esp + 0x420]
push eax
call fcn.00416961
pop ecx
lea edx, [esp + 0x420]
lea ecx, [esp + 0x218]
call fcn.0040b9a7
mov byte [0x430533], 1
xor eax, eax
mov ecx, dword [esp + 0x834]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00414f81
add esp, 0x830
ret
Function at 0x40ecca
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x44
mov eax, dword [0x42e440]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push 0x429bd4
push ebp
call fcn.0041523a
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x40ecfc
push ebp
push 0x42ab50
jmp 0x40ee06
push esi
call fcn.0041bd12
lea ecx, [esp + 0x1c]
push ecx
push eax
call fcn.00415ba2
add esp, 0xc
test eax, eax
je 0x40ed1f
push ebp
push 0x42ab88
jmp 0x40ee06
mov edi, dword [esp + 0x2c]
lea eax, [edi + 1]
push eax
call fcn.00415076
mov ebx, eax
pop ecx
test ebx, ebx
je 0x40edde
mov ecx, ebx
mov dword [esp + 0x10], ecx
test edi, edi
je 0x40ed83
cmp edi, 0x7fffffff
jae 0x40ed51
mov eax, edi
mov dword [esp + 0x14], edi
jmp 0x40ed5a
mov eax, 0x7fffffff
mov dword [esp + 0x14], eax
push esi
push eax
push 1
push ecx
call fcn.004160dd
add esp, 0x10
cmp eax, dword [esp + 0x14]
jne 0x40ee00
mov ecx, dword [esp + 0x10]
add ecx, eax
mov dword [esp + 0x10], ecx
sub edi, eax
jne 0x40ed41
mov edi, dword [esp + 0x2c]
mov byte [edi + ebx], 0
mov ebp, dword [esp + 0x2c]
lea eax, [ebp*2 + 2]
push eax
call fcn.00415076
mov edi, eax
pop ecx
test edi, edi
je 0x40edde
lea eax, [ebp + 1]
push eax
push edi
push 0xffffffffffffffff
push ebx
push 8
push 0xfde9
call dword [fcn.00423110]
test eax, eax
jne 0x40ee16
call dword [fcn.004230d0]
push eax
push 0x42abf8
call fcn.0040b20e
push eax
call fcn.00411705
push ebx
call fcn.0041503e
push edi
call fcn.0041503e
add esp, 0x14
xor edi, edi
test esi, esi
je 0x40edeb
push esi
call fcn.00415b2b
pop ecx
mov ecx, dword [esp + 0x4c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00414f81
add esp, 0x44
ret
push ebp
push 0x42abc0
call fcn.0040b20e
push eax
call fcn.00411705
add esp, 0xc
jmp 0x40edde
push ebx
call fcn.0041503e
pop ecx
jmp 0x40ede0