joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418b2b
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
push ebx
push ebx
push ebx
push ebx
push 0x473fe8
mov edi, ebx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebx, eax
test ebx, ebx
jne 0x418b64
or eax, 0xffffffff
jmp 0x418c1c
xor eax, eax
push eax
push 0x84000000
push eax
push eax
push esi
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
mov dword [ebp - 0xc], esi
test esi, esi
jne 0x418b88
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x418b5c
push 0x4e20
lea ecx, [ebp - 0x1c]
call fcn.004037fd
push 0
call fcn.0044da37
and dword [ebp - 4], 0
lea eax, [ebp - 4]
pop ecx
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov esi, dword [ebp - 4]
test esi, esi
je 0x418be7
lea eax, [edi + esi]
mov dword [ebp - 0x10], eax
cmp eax, dword [ebp + 8]
jae 0x418be2
mov eax, dword [ebp - 8]
push esi
push dword [ebp - 0x1c]
add eax, edi
push eax
call fcn.00449090
mov edi, dword [ebp - 0x10]
add esp, 0xc
test esi, esi
je 0x418be7
mov esi, dword [ebp - 0xc]
jmp 0x418b95
or edi, 0xffffffff
jmp 0x418c11
mov eax, dword [ebp + 8]
sub eax, edi
push eax
mov eax, dword [ebp - 8]
add eax, edi
push 0
push eax
call fcn.00447370
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
add esp, 0xc
push dword [ebp - 0xc]
call esi
push ebx
call esi
add dword [0x830a78], edi
push dword [ebp - 0x1c]
call fcn.0044dd3c
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x418eac
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x218
push 1
call fcn.00449f17
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x418f71
mov eax, dword [ebp + 8]
mov edi, 0x200
mov ebx, dword [ebp + 0x18]
mov dword [esi + 0x200], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x204], eax
mov eax, dword [ebp + 0x14]
push 0x7e6b60
mov dword [esi + 0x20c], eax
mov eax, dword [ebp + 0x10]
push str.http:__www.lfsworld.net_pubstat_get_stat2.php_version1.5idk_s
mov dword [esi + 0x208], eax
mov eax, dword [ebp + 0x1c]
push edi
push esi
mov dword [esi + 0x210], eax
mov dword [esi + 0x214], ebx
call fcn.00401599
mov ecx, esi
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x418f1f
sub ecx, edx
mov edx, esi
lea eax, [edx + 1]
mov dword [ebp - 4], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x418f30
sub edx, dword [ebp - 4]
lea eax, [ebp + 0x24]
push eax
push 0
push dword [ebp + 0x20]
sub edi, ecx
lea eax, [edx + esi]
push edi
push eax
call fcn.0040143a
push esi
push 0
push 0x418c21
call fcn.0044b34c
add esp, 0x20
test ebx, ebx
pop edi
pop esi
pop ebx
je 0x418f6f
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
leave
ret
push 0
push 0x46e060
push str.Cant_alloc_dwn_req_
push dword [0x6b845c]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.004498af
int3
Function at 0x41a0af
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x485008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x104
lea eax, [ebp - 0x20c]
push edi
xor esi, esi
mov ebx, ecx
push esi
push eax
call fcn.00447370
push edi
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.00447370
add esp, 0x18
lea eax, [ebp - 0x20c]
push edi
push eax
push esi
push dword [0x491210]
mov esi, dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
call esi
push edi
lea eax, [ebp - 0x108]
push eax
push 0
push dword [0x491210]
call esi
mov edx, 0x474338
lea ecx, [ebp - 0x20c]
call fcn.004019b8
test eax, eax
je 0x41a2b3
push 6
lea edi, [eax + 1]
mov esi, str.data_script_autoexec.lfs
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edx, 0x474374
lea ecx, [ebp - 0x108]
movsb byte es:[edi], byte [esi]
call fcn.004019b8
push 6
pop ecx
mov esi, str.data_script_autoexec.tmp
lea edi, [eax + 1]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x20c]
push 0x474378
push eax
movsb byte es:[edi], byte [esi]
call fcn.0044a0f7
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x41a18b
test ebx, ebx
je 0x41a2b3
push eax
push 0x46e060
push str.Cannot_open_autoexec.lfs
jmp 0x41a2a7
lea eax, [ebp - 0x108]
push 0x474398
push eax
call fcn.0044a0f7
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x41a1cb
test ebx, ebx
je 0x41a1bf
push eax
push 0x46e060
push str.Cannot_create_temporary_file
push dword [0x6b845c]
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.0044a2d1
pop ecx
jmp 0x41a2b3
and dword [ebp - 0x410], 0
jmp 0x41a20f
push 0x12
lea eax, [ebp - 0x40c]
push str._run_start_LFSLazy
push eax
call fcn.0044d630
add esp, 0xc
test eax, eax
je 0x41a205
lea eax, [ebp - 0x40c]
push eax
push 0x4743d0
push edi
call fcn.004013bc
add esp, 0xc
jmp 0x41a20f
mov dword [ebp - 0x410], 1
push esi
lea eax, [ebp - 0x40c]
push 0x200
push eax
call fcn.0044d56c
add esp, 0xc
test eax, eax
jne 0x41a1d4
push esi
call fcn.0044a2d1
push edi
call fcn.0044a2d1
cmp dword [ebp - 0x410], 0
pop ecx
pop ecx
je 0x41a28a
push 1
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41a278
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test ebx, ebx
je 0x41a2b3
push 0
push 0x46e060
push str.Cannot_replace_autoexec
jmp 0x41a2a7
test ebx, ebx
je 0x41a2b3
push 0
push 0x46e060
push str.Autostart_removed
jmp 0x41a2a7
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test ebx, ebx
je 0x41a2b3
push 0
push 0x46e060
push str.Autostart_wasnt_installed
push dword [0x6b845c]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00445b7e
leave
ret
Function at 0x41a2c2
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x485008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, 0x104
lea eax, [ebp - 0x108]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.00447370
add esp, 0xc
lea eax, [ebp - 0x108]
push esi
push eax
push ebx
push dword [0x491210]
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
mov edx, 0x47441c
lea ecx, [ebp - 0x108]
call fcn.004019b8
test eax, eax
je 0x41a3fe
push edi
push 7
lea edi, [eax + 1]
mov esi, str.data_script_start_LFSLazy.lfs
pop ecx
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x108]
push 0x474440
push eax
movsw word es:[edi], word [esi]
call fcn.0044a0f7
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x41a3fd
push esi
lea eax, [ebp - 0x40c]
push 0x200
push eax
call fcn.0044d56c
add esp, 0xc
test eax, eax
je 0x41a3f6
mov edi, 0x104
push 7
lea eax, [ebp - 0x40c]
push str._exec__
push eax
call fcn.0044d630
add esp, 0xc
test eax, eax
jne 0x41a3d9
push edi
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00447370
lea eax, [ebp - 0x405]
mov edx, edi
push eax
lea ecx, [ebp - 0x20c]
call fcn.004014cb
lea eax, [ebp - 0x20c]
push 0x47444c
push eax
call fcn.00446fd0
add esp, 0x18
test eax, eax
je 0x41a3d9
mov byte [eax], bl
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x41a3d9
xor ecx, ecx
call fcn.0041a0af
push esi
lea eax, [ebp - 0x40c]
push 0x200
push eax
call fcn.0044d56c
add esp, 0xc
test eax, eax
jne 0x41a36b
push esi
call fcn.0044a2d1
pop ecx
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00445b7e
leave
ret

Function at 0x41a43c
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
call fcn.00449fee
mov dword [esi + 0x24], eax
xor edi, edi
call fcn.00449fee
lea ecx, [edi + 1]
xor edi, edi
cmp eax, dword [esi + 0x24]
mov eax, dword [esi + 0x24]
cmove edi, ecx
mov dword [ebp - 4], eax
cmp edi, 0x46
jbe 0x41a4b2
mov ecx, dword [esi]
mov edx, 0x46e2d3
push str.connection_has_timedout
push 0x46e2cf
call fcn.0041bd3f
pop ecx
pop ecx
push 0
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push 0
push 0x41a428
call fcn.0044b34c
add esp, 0xc
mov dword [esi + 0x28], eax
call fcn.00449fee
mov dword [esi + 0x24], eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
jmp 0x41a453
Function at 0x41b752
Capabilities:
Terminate thread

Disassembly:
push edi
mov edi, ecx
push 0
push dword [edi + 0x28]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push dword [edi + 0x2c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0x30
push edi
call fcn.00446054
pop ecx
pop ecx
mov eax, edi
pop edi
ret 4

Function at 0x41c4c3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x8314c8]
sub esp, 0x50
push esi
push edi
test eax, eax
je 0x41c4e2
push 1
push eax
call dword [sym.imp.USER32.dll_SwitchToThisWindow]
jmp 0x41c5f6
push 0x30
pop esi
push esi
xor edi, edi
lea eax, [ebp - 0x4c]
push edi
push eax
call fcn.00447370
add esp, 0xc
mov dword [ebp - 0x4c], esi
add esi, 0x67
mov dword [ebp - 0x24], str.LazyGraphs
mov dword [ebp - 0x44], 0x41c5fa
mov dword [ebp - 0x48], 8
push esi
push edi
call dword [sym.imp.USER32.dll_LoadIconA]
push edi
push 0x10
push 0x10
push 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
mov dword [ebp - 0x34], eax
call esi
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push 0x7f00
push edi
mov dword [ebp - 0x20], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0xffffff
mov dword [ebp - 0x30], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push edi
mov dword [ebp - 0x2c], eax
call esi
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
push edi
push edi
call esi
push eax
push edi
push dword [0x8314c8]
mov eax, closesocket
push 0x2a8
push 0x168
push eax
push eax
push 0xe0000
push str.LFSLazy___Graphs
push dword [ebp - 0x24]
push edi
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x8314c8], eax
push edi
test eax, eax
jne 0x41c5b1
push 0x46e060
push str.Graphs___error_creating_window
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x41c5f6
push edi
push 0x41c124
call fcn.0044b34c
add esp, 0xc
push 1
push dword [0x8314c8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
jmp 0x41c5e9
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push edi
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
call esi
test eax, eax
jne 0x41c5d5
pop edi
pop esi
leave
ret
Function at 0x425fbb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1bc
mov eax, dword [0x485008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [0x4a17bc]
lea edx, [ebp - 0x110]
sub edi, dword [0x7e6b5c]
mov ecx, 0x475f3c
push 0x475f38
push 0x104
call fcn.00402de6
pop ecx
push eax
call fcn.0044a0f7
mov ebx, eax
push ebx
push 1
push 6
push 0x475f48
call fcn.0044d8c1
add esp, 0x18
test ebx, ebx
je 0x426083
xor esi, esi
test edi, edi
cmovns esi, edi
jmp 0x426074
push 0xa8
lea eax, [ebp - 0x1b8]
push 0
push eax
call fcn.00447370
mov edx, dword [esi*4 + 0x4a17c0]
add esp, 0xc
lea ecx, [edx + 0x27]
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x426042
sub ecx, edi
lea eax, [ecx + 0x29]
push eax
push edx
lea eax, [ebp - 0x1b8]
push eax
call fcn.00449090
push ebx
push 1
lea eax, [ebp - 0x1b8]
push 0xa8
push eax
call fcn.0044d8c1
add esp, 0x1c
inc esi
cmp esi, dword [0x4a17bc]
jl 0x42601f
push ebx
call fcn.0044a2d1
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00445b7e
leave
ret
Function at 0x426092
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d4
mov eax, dword [0x485008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x475f50
push 0x104
lea edx, [ebp - 0x120]
mov ecx, str.Chat.bin
call fcn.00402de6
pop ecx
push eax
call fcn.0044a0f7
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x4262c0
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
push ebx
push 1
push 6
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
call fcn.00451a9d
add esp, 0x10
lea edx, [ebp - 0x14]
mov esi, str.LZCHAT
xor ecx, ecx
movzx eax, byte [edx + ecx]
cmp al, byte [esi + ecx]
jne 0x4262c0
inc ecx
cmp ecx, 7
jne 0x4260f9
mov esi, 0xa8
lea eax, [ebp - 0x1c8]
push esi
push 0
push eax
call fcn.00447370
push ebx
push 1
lea eax, [ebp - 0x1c8]
push esi
push eax
call fcn.00451a9d
add esp, 0x1c
test eax, eax
je 0x42622e
mov esi, dword [sym.imp.USER32.dll_EnableMenuItem]
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [0x4a17bc]
cmp eax, 0x7a120
jae 0x426229
test eax, eax
jne 0x42618c
push eax
push 0xfab
push dword [0x7e6480]
call esi
push 0
push 0xfae
push dword [0x7e6480]
call esi
push 1
push dword [0x6b82c0]
call edi
push 1
push dword [0x6b82c4]
call edi
lea ecx, [ebp - 0x1a1]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x426195
sub ecx, edx
lea eax, [ecx + 0x29]
push eax
push 1
call fcn.00449f17
pop ecx
pop ecx
mov ecx, dword [0x4a17bc]
mov dword [ecx*4 + 0x4a17c0], eax
call fcn.00449fee
mov dword [ebp - 0x1c4], eax
mov eax, dword [0x4a17bc]
mov eax, dword [eax*4 + 0x4a17c0]
mov dword [ebp - 0x1cc], eax
test eax, eax
je 0x42620a
lea ecx, [ebp - 0x1a1]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4261e2
sub ecx, edx
lea eax, [ecx + 0x29]
push eax
lea eax, [ebp - 0x1c8]
push eax
push dword [ebp - 0x1cc]
call fcn.00449090
add esp, 0xc
inc dword [0x4a17bc]
push ebx
push 1
lea eax, [ebp - 0x1c8]
push 0xa8
push eax
call fcn.00451a9d
add esp, 0x10
test eax, eax
jne 0x426147
mov esi, 0xa8
push esi
push 1
call fcn.00449f17
mov edx, dword [0x4a17bc]
pop ecx
pop ecx
mov dword [edx*4 + 0x4a17c0], eax
test eax, eax
je 0x42628d
push str.LFSLazy_started_...
push 0x18
lea ecx, [eax + 8]
pop edx
call fcn.004014cb
push 0
call fcn.0044da37
pop ecx
pop ecx
mov ecx, dword [0x4a17bc]
mov ecx, dword [ecx*4 + 0x4a17c0]
mov dword [ecx], eax
call fcn.00449fee
mov edx, dword [0x4a17bc]
mov ecx, dword [edx*4 + 0x4a17c0]
inc edx
mov dword [0x4a17bc], edx
mov dword [ecx + 4], eax
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 3
push edx
push 0x102f
push dword [0x7e6484]
call esi
mov eax, dword [0x4a17bc]
push 0
dec eax
push eax
push 0x1013
push dword [0x7e6484]
call esi
push ebx
call fcn.0044a2d1
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00445b7e
leave
ret
Function at 0x426348
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x7ef6cc], 0
je 0x426451
cmp dword [0x6b8390], 0
je 0x426451
push ebx
push esi
push 4
mov edx, 0x6b8394
mov esi, 0x475f7c
xor ecx, ecx
pop ebx
movzx eax, byte [edx + ecx]
cmp al, byte [esi + ecx]
jne 0x426393
inc ecx
cmp ecx, ebx
jne 0x426380
jmp 0x42644f
mov esi, 0x475f80
xor ecx, ecx
movzx eax, byte [edx + ecx]
cmp al, byte [esi + ecx]
jne 0x4263ad
inc ecx
cmp ecx, ebx
jne 0x42639a
jmp 0x42644f
mov esi, 0x475f84
xor ecx, ecx
movzx eax, byte [edx + ecx]
cmp al, byte [esi + ecx]
jne 0x4263c7
inc ecx
cmp ecx, ebx
jne 0x4263b4
jmp 0x42644f
mov esi, 0x475f88
xor ecx, ecx
movzx eax, byte [edx + ecx]
cmp al, byte [esi + ecx]
jne 0x4263de
inc ecx
cmp ecx, ebx
jne 0x4263ce
jmp 0x42644f
mov esi, 0x475f8c
xor ecx, ecx
movzx eax, byte [edx + ecx]
cmp al, byte [esi + ecx]
jne 0x4263f5
inc ecx
cmp ecx, ebx
jne 0x4263e5
jmp 0x42644f
cmp dword [0x6b83d8], 0
jne 0x42644f
test byte [0x83172c], 8
jne 0x42644f
mov edx, str.0.6M8
mov ecx, 0x48bfcc
call fcn.004057bd
test eax, eax
je 0x426444
push 0
push 8
lea eax, [ebp - 8]
mov byte [ebp - 8], 8
push eax
push dword [0x49123c]
mov byte [ebp - 7], bl
mov word [ebp - 6], 0x900
mov dword [ebp - 4], 0x804
call dword [sym.imp.WS2_32.dll_send]
jmp 0x42644f
push str._press_3
call fcn.00407b9c
pop ecx
pop esi
pop ebx
leave
ret
Function at 0x427a8d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x485008]
xor eax, ebp
mov dword [ebp - 4], eax
test dword [0x83172c], 0x4100
jne 0x427c20
cmp byte [0x6b80a0], 0
je 0x427c20
cmp byte [0x6b807b], 0
jne 0x427c20
cmp dword [0x492114], 0
push ebx
push esi
push str.Setup_Filter___Custom_:
push 4
push 0x14
push 1
mov esi, 0x81
setne bh
push esi
push 0x243
push 0x64
push 0x47661c
call fcn.0040807f
mov ecx, str._OFF_
test bh, bh
mov eax, str._ON_
cmove eax, ecx
push eax
push 5
push 7
push 5
push esi
mov eax, 0x21b
mov esi, 0x47661c
push eax
push 0x65
push esi
call fcn.0040807f
add esp, 0x40
push 0x65
pop ecx
call fcn.0040871e
test eax, eax
je 0x427b51
mov ecx, dword [0x492114]
xor eax, eax
test ecx, ecx
sete al
xor edx, edx
mov dword [0x492114], eax
test ecx, ecx
mov eax, dword [0x83e2a0]
cmovne eax, edx
mov dword [0x83e2a0], eax
mov bl, byte [0x4a0518]
movsx ecx, bl
call fcn.004276d6
lea edx, [ebp - 0x44]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x427b64
cmp bl, 7
jge 0x427ba7
cmp byte [0x4a0519], 0
mov ecx, 0x46e3bf
mov eax, 0x476650
cmove eax, ecx
push eax
movsx eax, byte [0x4a051a]
inc eax
push eax
lea eax, [ebp - 0x44]
push eax
push str._s_d_s
push 0x40
push eax
call fcn.00401599
add esp, 0x18
jmp 0x427bbb
lea eax, [ebp - 0x44]
push eax
push 0x47665c
push 0x40
push eax
call fcn.00401599
add esp, 0x10
lea eax, [ebp - 0x44]
test bh, bh
push eax
push 0x476660
push 5
push 0xd
mov eax, 0x227
push 5
push 0x88
lea ecx, [eax - 0xc]
cmovne eax, ecx
push eax
push 0x66
push esi
call fcn.0040807f
add esp, 0x24
push 0x66
pop ecx
call fcn.0040871e
pop esi
pop ebx
test eax, eax
je 0x427c31
xor eax, eax
cmp dword [0x83e2a0], eax
sete al
mov dword [0x83e2a0], eax
test eax, eax
je 0x427c31
push 0x83e2a0
push 0
push 0x427824
call fcn.0044b34c
add esp, 0xc
jmp 0x427c31
mov ecx, 0x47661c
call fcn.00408691
and dword [0x83e2a0], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00445b7e
leave
ret
Function at 0x42883d
Capabilities:
Copy file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54c
mov eax, dword [0x485008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x548]
mov edi, ecx
push eax
push edi
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x42892a
test byte [ebp - 0x548], 0x10
jne 0x42890d
lea edx, [ebp - 0x408]
mov ecx, edi
sub edx, edi
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x428887
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42889a
sub ecx, edx
lea edx, [ebp - 0x51c]
lea ecx, [ebp + ecx - 0x409]
mov al, byte [edx]
inc edx
mov byte [ecx], al
inc ecx
test al, al
jne 0x4288b0
lea edx, [ebp - 0x208]
mov ecx, ebx
sub edx, ebx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x4288c4
lea ecx, [ebp - 0x208]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4288d7
sub ecx, edx
lea edx, [ebp - 0x51c]
lea ecx, [ebp + ecx - 0x208]
mov al, byte [edx]
inc edx
mov byte [ecx], al
inc ecx
test al, al
jne 0x4288ed
push 1
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x548]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x428870
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00445b7e
leave
ret
Function at 0x42c266
Capabilities:
Check if file exists
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x485008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
lea eax, [ebp - 0x44]
push ebx
push eax
call fcn.00447370
add esp, 0xc
lea edx, [ebp - 0x248]
mov edi, 0x104
mov ecx, 0x4771f0
push 0x4771ec
push edi
call fcn.00402de6
pop ecx
push eax
call fcn.0044a0f7
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x42c36f
push esi
push 1
lea eax, [ebp - 0x44]
push 6
push eax
call fcn.00451a9d
push 2
push ebx
push esi
call fcn.0044ad58
push esi
call fcn.00449ec5
push ebx
push 6
push esi
mov edi, eax
call fcn.0044ad58
add esp, 0x2c
lea eax, [ebp - 0x44]
mov edx, 0x4771e4
mov ecx, ebx
movzx eax, byte [eax + ecx]
cmp al, byte [edx + ecx]
jne 0x42c340
inc ecx
lea eax, [ebp - 0x44]
cmp ecx, 7
jne 0x42c2f0
push 0x3c
lea eax, [edi - 6]
xor edx, edx
pop edi
div edi
push edi
push eax
mov dword [0x4a16ec], eax
call fcn.00449f17
mov dword [0x4a16f0], eax
pop ecx
pop ecx
test eax, eax
je 0x42c3bf
push esi
push dword [0x4a16ec]
push edi
push eax
call fcn.00451a9d
push esi
call fcn.0044a2d1
add esp, 0x14
jmp 0x42c3b0
push esi
call fcn.0044a2d1
push edi
push 0x4771e4
lea eax, [ebp - 0x144]
push str.Corrupt_PB_file__nHeader__6s__Size__d_
push eax
call fcn.00401468
add esp, 0x14
lea eax, [ebp - 0x144]
push ebx
push 0x477224
push eax
jmp 0x42c3ca
push edi
lea edx, [ebp - 0x248]
mov ecx, 0x477250
call fcn.00402de6
pop ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x42c39a
push 0x30
push 0x46e060
push str.PBs_file_exist__but_cannot_open
jmp 0x42c3ca
push 0x3c
push 1
mov dword [0x4a16ec], ebx
call fcn.00449f17
pop ecx
pop ecx
mov dword [0x4a16f0], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00445b7e
leave
ret
push ebx
push str.ERROR
push str.Cannot_allocate_PBs_memory
push dword [0x6b845c]
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call fcn.004498af
int3
Function at 0x42c41c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0xc], edx
mov ecx, dword [0x4a16ec]
push edi
test ecx, ecx
jle 0x42c4d8
mov edx, dword [0x4a16f0]
add edx, 9
lea edi, [edx - 4]
mov eax, esi
mov bl, byte [eax]
cmp bl, byte [edi]
jne 0x42c46a
test bl, bl
je 0x42c466
mov bl, byte [eax + 1]
cmp bl, byte [edi + 1]
jne 0x42c46a
add eax, 2
add edi, 2
test bl, bl
jne 0x42c44a
xor eax, eax
jmp 0x42c46f
sbb eax, eax
or eax, 1
test eax, eax
jne 0x42c4c6
mov eax, dword [ebp - 0xc]
lea ebx, [edx - 9]
mov edi, ebx
mov cl, byte [eax]
cmp cl, byte [edi]
mov byte [ebp - 1], cl
mov ecx, dword [0x4a16ec]
jne 0x42c4ae
cmp byte [ebp - 1], 0
je 0x42c4aa
mov bl, byte [eax + 1]
cmp bl, byte [edi + 1]
mov byte [ebp - 1], bl
lea ebx, [edx - 9]
jne 0x42c4ae
add eax, 2
add edi, 2
cmp byte [ebp - 1], 0
jne 0x42c47b
xor eax, eax
jmp 0x42c4b3
sbb eax, eax
or eax, 1
test eax, eax
jne 0x42c4c6
mov al, byte [ebp + 8]
cmp byte [edx], al
jne 0x42c4c6
mov al, byte [ebp + 0xc]
cmp byte [edx + 1], al
je 0x42c504
mov ebx, dword [ebp - 8]
add edx, 0x3c
inc ebx
mov dword [ebp - 8], ebx
cmp ebx, ecx
jl 0x42c445
cmp dword [ebp + 0x10], 0
je 0x42c556
inc ecx
imul eax, ecx, 0x3c
mov dword [0x4a16ec], ecx
push eax
push dword [0x4a16f0]
call fcn.0044a5c4
pop ecx
pop ecx
mov ecx, eax
mov dword [0x4a16f0], ecx
test ecx, ecx
je 0x42c55d
jmp 0x42c508
mov eax, ebx
jmp 0x42c558
imul edx, dword [0x4a16ec], 0x3c
add edx, ecx
mov ecx, edx
sub ecx, esi
mov al, byte [esi]
mov byte [ecx + esi - 0x37], al
inc esi
test al, al
jne 0x42c515
lea edi, [edx - 0x3c]
mov ecx, 0x831738
mov esi, edi
sub esi, ecx
mov al, byte [ecx]
mov byte [esi + ecx], al
inc ecx
test al, al
jne 0x42c52c
mov al, byte [ebp + 8]
lea ecx, [edx - 0x30]
push 0x30
mov byte [edx - 0x33], al
mov al, byte [ebp + 0xc]
push 0
push ecx
mov byte [edx - 0x32], al
call fcn.00447370
add esp, 0xc
mov eax, edi
jmp 0x42c558
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push str.Cannot_reallocate_PBs_memory
push 0
call fcn.00407cc3
pop ecx
pop ecx
push 0
call fcn.004498af
int3