joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7c0662f7
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
call sym.MSVCI70.dll_protected:_int___thiscall_streambuf::allocate_void_
cmp eax, 0xffffffff
je 0x7c06636c
push edi
mov edi, dword [esi + 8]
test edi, edi
jne 0x7c066344
cmp dword [esi + 0x2c], edi
jne 0x7c066342
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
cmp ecx, edx
jbe 0x7c066321
mov eax, ecx
sub eax, edx
jmp 0x7c066323
xor eax, eax
cmp ecx, edx
jbe 0x7c06632b
sub ecx, edx
jmp 0x7c06632d
xor ecx, ecx
sar ecx, 1
sar eax, 1
add ecx, edx
add eax, edx
or dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x24], edx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], eax
test edi, edi
pop edi
jne 0x7c066398
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x7c066398
cmp dword [esi + 0x28], eax
jb 0x7c066390
mov ecx, dword [esi + 0x24]
push dword [esi + 0x4c]
sub eax, ecx
push eax
push 1
push ecx
call dword [sym.imp.MSVCR70.dll_fread]
add esp, 0x10
test eax, eax
jne 0x7c066371
or eax, 0xffffffff
pop esi
ret
mov ecx, dword [esi + 0x2c]
mov edx, dword [esi + 0x24]
or dword [esi + 0xc], 0xffffffff
sub ecx, eax
cmp ecx, edx
mov dword [esi + 0x28], ecx
je 0x7c066390
push eax
push edx
push ecx
call dword [sym.imp.MSVCR70.dll_memmove]
add esp, 0xc
mov ecx, esi
pop esi
jmp sym.MSVCI70.dll_public:_int___thiscall_streambuf::sbumpc_void_
push dword [esi + 0x4c]
call dword [sym.imp.MSVCR70.dll_fgetc]
pop ecx
pop esi
ret
Function at 0x402528
Capabilities:
Check if file exists
Check mutex on windows
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
lea edx, [ebp + 0xc]
lea eax, [ebp + 0xc]
call fcn.00420000
lea edx, [ebp + 8]
lea eax, [ebp + 8]
call fcn.00420000
push 0xfffffffffffffff1
call sub.KERNEL32.DLL_GetCurrentThread
push eax
call sub.KERNEL32.DLL_SetThreadPriority
push 0x421108
push 0
push 0
call sub.KERNEL32.DLL_CreateMutexA
mov ebx, eax
call sub.KERNEL32.DLL_GetLastError
push 0xffffffffffffffff
push ebx
call sub.KERNEL32.DLL_WaitForSingleObject
push 0
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
je 0x40257d
cmp eax, 5
jne 0x4025b5
push 3
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.0040236c
add esp, 0xc
push 6
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0040236c
add esp, 0xc
push 4
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040236c
add esp, 0xc
jmp 0x4025eb
push 4
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.0040236c
add esp, 0xc
push 3
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0040236c
add esp, 0xc
push 6
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040236c
add esp, 0xc
push ebx
call sub.KERNEL32.DLL_ReleaseMutex
push ebx
call sub.KERNEL32.DLL_CloseHandle
lea eax, [ebp + 8]
mov edx, 2
call fcn.00420080
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.00420080
pop ebx
pop ebp
ret

Function at 0x404fc8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x405001
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00412d84
jmp 0x40500a
mov eax, ebx
mov edx, esi
call fcn.00412ce8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405014
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x405035
mov al, byte [esp]
jmp 0x405037
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x406204
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x406268
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00412efc
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.00403610
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40626f
lea eax, [ebp - 0xc]
call fcn.00412c94
ret
Function at 0x4116ec
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x411729
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push esp
call sub.KERNEL32.DLL_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test bl, bl
je 0x411749
lea eax, [esp + 0x109]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00412efc
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x412128
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4215f4]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4121c0
push SysFreeString
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4121a0
xor eax, eax
push ebp
push 0x412199
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4121dc
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4121a0
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x4215f4]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4215f4], ax
mov esp, ebp
pop ebp
ret

Function at 0x412b18
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x425224], 0
je 0x412b79
cmp word [0x4253f8], 0xd7b2
jne 0x412b41
cmp dword [0x425400], 0
jbe 0x412b41
mov eax, 0x4253f4
call dword [0x425410]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x421638
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x412ba0
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x421600], 0
jne 0x412b95
push 0
push 0x421658
push 0x421638
push 0
call sub.USER32.DLL_MessageBoxA
pop edx
ret
Function at 0x416be9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x416c28
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x416c28
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x416c28
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x416c28
cmp dword [ecx + 0x74], 0xe
jbe 0x416c28
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x418a90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422f04
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x434340]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
test eax, eax
js 0x418b85
push 0
push 0
push 0
push 0
push dword [ebp + 0xc]
push eax
push 1
call sub.mfc140u.dll_CListCtrl::InsertItem
mov edi, eax
test edi, edi
js 0x418b88
mov ecx, ebx
call fcn.004186e0
mov esi, eax
xor ecx, ecx
mov edx, 0x4c
mov dword [ebp + 8], esi
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call sub.mfc140u.dll_operator_1
add esp, 4
mov dword [ebp + 0xc], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x418b3a
push 0x4173d0
push 0x417240
push dword [ebp + 8]
mov dword [eax], esi
lea esi, [eax + 4]
push 0x4c
push esi
call fcn.00416360
jmp 0x418b3c
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x418b85
mov eax, dword [ebp + 0x10]
mov ecx, ebx
push esi
push 0
push 0
push 0
push 0
push 4
push 0
mov dword [esi + 0x2c], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [esi + 0x30], eax
mov dword [esi + 0xc], 0xffffffff
call sub.mfc140u.dll_CListCtrl::SetItem
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40a4b0
Capabilities:
Encode data using xor

Disassembly:
rol byte [eax], 0x33
rol bl, 0x90
nop
push ebp
mov ebp, esp
mov edx, dword [edi + 0x758b567a]
test eax, 0xc01bdef7
neg eax
aam 0x50
mov eax, dword [eax]
mov byte [eax - 1], bl
xor al, 0x69
rol byte [eax], 0x85
ror byte [ecx + 0x4b751474], 0x8b
pop edi
sub cl, byte [ebp + 0x5251144d]
add byte [ebp + 0x147489c0], al
jne 0x40a51e
mov ebx, dword [edi + 0x2a]
lea ecx, [ebp + 0x14]
push ecx
push edx
inc dword [esi + 0x24]
rol byte [eax], 0x85
sal byte [ebp + ecx*4 - 0x75], 0xaa
dec esi
mov ecx, dword [ebp + 0x7c]
test dword [ecx + 0x82d0274], ebp
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x40a478
mov eax, dword [0xffffaee8]
inc dword [ebx + 0x26f04c4]
mov esp, dword [ebx + 0x15ff1f14]
je 0x40a4cb
inc eax
mov ebx, 0x144688
and eax, 0x75b80000
adc dword [ecx], eax
add byte [esi - 0x42], bl
shl byte [eax + eax], 1
cmp eax, 0x102
jne 0x40a564
mov eax, 0x11124
pop esi
pop ebp
ret 0xcb10
jae 0x40a577
mov edx, dword [ebp + 0xc]
xor al, 0xa
mov bh, 0xc9
or byte [edi], dl
or dword [eax + 0x42], eax
cmp eax, esi
jb 0x40a569
mov byte [eax], 0
pop esi
pop ebp
ret 0xce0c
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x44ba10
Capabilities:
Accept command line arguments
Check os version

Disassembly:
sub esp, 8
mov al, byte [0x662041]
mov cl, byte [0x66204b]
xor cl, al
push ebx
mov byte [0x66204b], cl
mov cl, byte [0x662042]
or cl, 0x10
shr cl, 3
and ecx, 0xff
mov dword [esp + 4], ecx
fild dword [esp + 4]
fdivr qword [0x665958]
fadd qword [0x662058]
fstp qword [0x6659c8]
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dl, byte [0x66204d]
mov ebx, eax
mov al, byte [0x662041]
or al, dl
mov byte [0x662041], al
mov al, byte [0x662045]
or al, 2
shr al, 1
and eax, 0xff
mov dword [esp + 4], eax
fild dword [esp + 4]
fdivr qword [0x662058]
fadd qword [0x65e718]
fstp qword [0x665968]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x44bac9
mov edx, dword [0x665ab4]
push 0x6657cc
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, dword [0x665ab4]
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov ecx, ebx
xor eax, eax
and ecx, 0xff
mov al, bh
cmp ecx, 5
pop ebx
jne 0x44baee
cmp eax, 1
jae 0x44bafe
mov dword [0x664fb8], 0x409
add esp, 8
ret
ja 0x44bafe
mov dword [0x664fb8], 0x409
add esp, 8
ret
mov dword [0x664fb8], 0x7f
add esp, 8
ret

Function at 0x56d4f0
Capabilities:
Encode data using xor

Disassembly:
inc ebx
and eax, 0x3d2264af
xor esp, esp
and ah, byte [esi + ecx - 0x64]
and cl, byte [esi]
invalid
cmpsb byte [esi], byte es:[edi]
xor byte [ecx], 0xd1
test eax, 0x204575f2
popal
adc al, 0xdb
inc ecx
sub bh, cl
lodsd eax, dword [esi]
mov eax, dword [edi + 0x4a]
loope 0x56d527
push ebp
pushal
inc esi
adc byte [esi + 0x53], dl
mov fs, word [esi]
lcall 0x5de5, 0xe8e84055
ficomp word [edi]
insb byte es:[edi], dx
inc edx
mov esp, 0x1039ab98
test dl, dl
mov al, 0x56
jbe 0x56d4c1
ja 0x56d56a
test esi, esp
push ebp
fnstenv [esi + ebp*8]
mov dh, 0x2a
sbb byte [edx], bh
mov ecx, dword [edx]
dec esp
stosb byte es:[edi], al
push 0xffffffffffffff9a
pop edx
mov dword [0x5238868c], eax
mov al, byte [0x18f3c0aa]
push es
xor byte [ecx + 0x20], dl
mov esp, 0x131d0b10
mov esp, 0x93262016
invalid
sbb esp, dword [edx]
stosb byte es:[edi], al
add eax, 0xb000ea55
ret 0xeaa0
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x4017e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0042c5e0
mov eax, dword [0x4748f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1008], ecx
mov eax, dword [ebp - 0x1008]
mov dword [eax], vtable.cAESFile.0
mov byte [ebp - 0x1004], 0x23
mov byte [ebp - 0x1003], 0x4c
mov byte [ebp - 0x1002], 0x45
mov byte [ebp - 0x1001], 0x47
mov byte [ebp - 0x1000], 0x45
mov byte [ebp - 0xfff], 0x4e
mov byte [ebp - 0xffe], 0x44
mov byte [ebp - 0xffd], 0x4d
mov byte [ebp - 0xffc], 0x53
mov byte [ebp - 0xffb], 0x4f
mov byte [ebp - 0xffa], 0x21
mov byte [ebp - 0xff9], 0x24
mov byte [ebp - 0xff8], 0x23
mov byte [ebp - 0xff7], 0x48
mov byte [ebp - 0xff6], 0x41
mov byte [ebp - 0xff5], 0x4e
mov byte [ebp - 0xff4], 0x53
mov byte [ebp - 0xff3], 0x45
mov byte [ebp - 0xff2], 0x52
mov byte [ebp - 0xff1], 0x45
mov byte [ebp - 0xff0], 0x52
mov byte [ebp - 0xfef], 0x56
mov byte [ebp - 0xfee], 0x45
mov byte [ebp - 0xfed], 0x52
mov byte [ebp - 0xfec], 0x40
mov byte [ebp - 0xfeb], 0x40
mov byte [ebp - 0xfea], 0x58
mov byte [ebp - 0xfe9], 0x4d
mov byte [ebp - 0xfe8], 0x41
mov byte [ebp - 0xfe7], 0x4e
mov byte [ebp - 0xfe6], 0x53
mov byte [ebp - 0xfe5], 0x32
mov byte [ebp - 0xfe4], 0x30
mov byte [ebp - 0xfe3], 0x32
mov byte [ebp - 0xfe2], 0x35
mov byte [ebp - 0xfe1], 0x21
mov byte [ebp - 0xfe0], 0x4d
mov byte [ebp - 0xfdf], 0x41
mov byte [ebp - 0xfde], 0x4c
mov byte [ebp - 0xfdd], 0x41
mov byte [ebp - 0xfdc], 0x59
mov byte [ebp - 0xfdb], 0x53
mov byte [ebp - 0xfda], 0x49
mov byte [ebp - 0xfd9], 0x41
mov byte [ebp - 0xfd8], 0
push 0xfd3
push 0
lea ecx, [ebp - 0xfd7]
push ecx
call fcn.0042a980
add esp, 0xc
mov edx, dword [ebp - 0x1008]
mov dword [edx + 4], 1
mov eax, dword [ebp - 0x1008]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 0x1008]
mov eax, dword [ecx*4 + 0x45e2ec]
mov dword [edx + 0xc], eax
push 0x1000
lea ecx, [ebp - 0x1004]
push ecx
mov edx, dword [ebp - 0x1008]
add edx, 0x1010
push edx
call fcn.0042a330
add esp, 0xc
mov eax, dword [ebp - 0x1008]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042c090
mov esp, ebp
pop ebp
ret
Function at 0x401c90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x738
mov eax, dword [0x4748f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x72c], ecx
cmp dword [ebp + 8], 0
jne 0x401cb6
xor eax, eax
jmp 0x401f01
cmp dword [ebp + 0xc], 0
jne 0x401cc3
xor eax, eax
jmp 0x401f01
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x730], eax
mov ecx, dword [ebp + 8]
push ecx
push 1
push 1
lea edx, [ebp - 0x71e]
push edx
call fcn.0042bca0
add esp, 0x10
mov eax, dword [ebp - 0x72c]
add eax, 0x10
mov dword [ebp - 0x734], eax
mov dword [ebp - 0x738], 0
push 0x200
push 0
lea ecx, [ebp - 0x204]
push ecx
call fcn.0042a980
add esp, 0xc
mov edx, dword [ebp - 0x72c]
add edx, 0x10
push edx
call fcn.0042aa10
add esp, 4
push eax
mov eax, dword [ebp - 0x72c]
add eax, 0x10
push eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.0042a330
add esp, 0xc
push pe_nt_image_headers32
lea edx, [ebp - 0x204]
push edx
lea eax, [ebp - 0x71c]
push eax
call fcn.00404250
add esp, 0xc
mov cl, byte [ebp + 0x14]
mov byte [ebp - 0x71d], cl
mov dword [ebp - 0x728], 0
jmp 0x401d7d
mov edx, dword [ebp - 0x728]
add edx, 0x10
mov dword [ebp - 0x728], edx
mov eax, dword [ebp - 0x728]
cmp eax, dword [ebp - 0x730]
jge 0x401e7d
mov ecx, dword [ebp + 8]
push ecx
push 0x10
push 1
lea edx, [ebp - 0x604]
push edx
call fcn.0042bca0
add esp, 0x10
cmp eax, 0x10
je 0x401df2
push 0
push str.Error__
push str.fread_Error__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x400
push 0
lea eax, [ebp - 0x604]
push eax
call fcn.0042a980
add esp, 0xc
push 0x118
push 0
lea ecx, [ebp - 0x71c]
push ecx
call fcn.0042a980
add esp, 0xc
xor eax, eax
jmp 0x401f01
lea edx, [ebp - 0x604]
push edx
lea eax, [ebp - 0x604]
push eax
push 0
lea ecx, [ebp - 0x71c]
push ecx
call fcn.00402d60
add esp, 0x10
mov dword [ebp - 0x724], 0
jmp 0x401e2c
mov edx, dword [ebp - 0x724]
add edx, 1
mov dword [ebp - 0x724], edx
cmp dword [ebp - 0x724], 0x10
jge 0x401e78
mov eax, dword [ebp - 0x728]
add eax, dword [ebp - 0x724]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x724]
mov dl, byte [ebp + edx - 0x604]
mov byte [ecx + eax], dl
movsx eax, byte [ebp - 0x71d]
mov ecx, dword [ebp - 0x728]
add ecx, dword [ebp - 0x724]
mov edx, dword [ebp + 0xc]
movsx ecx, byte [edx + ecx]
add eax, ecx
mov byte [ebp - 0x71d], al
jmp 0x401e1d
jmp 0x401d6e
mov edx, dword [ebp + 8]
push edx
push 1
push 1
lea eax, [ebp - 0x71f]
push eax
call fcn.0042bca0
add esp, 0x10
movsx ecx, byte [ebp - 0x71e]
movsx edx, byte [ebp - 0x71f]
cmp ecx, edx
jne 0x401eb8
movsx eax, byte [ebp - 0x71e]
movsx ecx, byte [ebp - 0x71d]
cmp eax, ecx
je 0x401efc
push 0
push str.Error__
push str.CheckCrc_Error__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x400
push 0
lea edx, [ebp - 0x604]
push edx
call fcn.0042a980
add esp, 0xc
push 0x118
push 0
lea eax, [ebp - 0x71c]
push eax
call fcn.0042a980
add esp, 0xc
xor eax, eax
jmp 0x401f01
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042c090
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401f80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.0042c5e0
mov eax, dword [0x4748f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x100c], ecx
mov byte [ebp - 0x1004], 0x23
mov byte [ebp - 0x1003], 0x4c
mov byte [ebp - 0x1002], 0x45
mov byte [ebp - 0x1001], 0x47
mov byte [ebp - 0x1000], 0x45
mov byte [ebp - 0xfff], 0x4e
mov byte [ebp - 0xffe], 0x44
mov byte [ebp - 0xffd], 0x4d
mov byte [ebp - 0xffc], 0x53
mov byte [ebp - 0xffb], 0x4f
mov byte [ebp - 0xffa], 0x21
mov byte [ebp - 0xff9], 0x24
mov byte [ebp - 0xff8], 0x23
mov byte [ebp - 0xff7], 0x48
mov byte [ebp - 0xff6], 0x41
mov byte [ebp - 0xff5], 0x4e
mov byte [ebp - 0xff4], 0x53
mov byte [ebp - 0xff3], 0x45
mov byte [ebp - 0xff2], 0x52
mov byte [ebp - 0xff1], 0x45
mov byte [ebp - 0xff0], 0x52
mov byte [ebp - 0xfef], 0x56
mov byte [ebp - 0xfee], 0x45
mov byte [ebp - 0xfed], 0x52
mov byte [ebp - 0xfec], 0x40
mov byte [ebp - 0xfeb], 0x40
mov byte [ebp - 0xfea], 0x58
mov byte [ebp - 0xfe9], 0x4d
mov byte [ebp - 0xfe8], 0x41
mov byte [ebp - 0xfe7], 0x4e
mov byte [ebp - 0xfe6], 0x53
mov byte [ebp - 0xfe5], 0x32
mov byte [ebp - 0xfe4], 0x30
mov byte [ebp - 0xfe3], 0x32
mov byte [ebp - 0xfe2], 0x35
mov byte [ebp - 0xfe1], 0x21
mov byte [ebp - 0xfe0], 0x4d
mov byte [ebp - 0xfdf], 0x41
mov byte [ebp - 0xfde], 0x4c
mov byte [ebp - 0xfdd], 0x41
mov byte [ebp - 0xfdc], 0x59
mov byte [ebp - 0xfdb], 0x53
mov byte [ebp - 0xfda], 0x49
mov byte [ebp - 0xfd9], 0x41
mov byte [ebp - 0xfd8], 0
push 0xfd3
push 0
lea eax, [ebp - 0xfd7]
push eax
call fcn.0042a980
add esp, 0xc
mov dword [ebp - 0x1008], 0
jmp 0x402109
mov ecx, dword [ebp - 0x1008]
add ecx, 1
mov dword [ebp - 0x1008], ecx
mov edx, dword [ebp - 0x100c]
mov eax, dword [ebp - 0x1008]
cmp eax, dword [edx + 4]
jge 0x402169
mov ecx, dword [ebp - 0x1008]
mov edx, dword [ecx*4 + 0x45e2f0]
cmp edx, dword [ebp + 8]
jne 0x402167
mov eax, dword [ebp - 0x100c]
mov ecx, dword [ebp - 0x1008]
mov edx, dword [ecx*4 + 0x45e2f0]
mov dword [eax + 8], edx
push 0x1000
lea eax, [ebp - 0x1004]
push eax
mov ecx, dword [ebp - 0x100c]
add ecx, 0x10
push ecx
call fcn.0042a330
add esp, 0xc
mov eax, 1
jmp 0x40216b
jmp 0x4020fa
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042c090
mov esp, ebp
pop ebp
ret 4
Function at 0x405370
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a0
mov eax, dword [0x4748f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4783b8], 0
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
je 0x4053d6
push eax
push dword [ebp + 0xc]
push ecx
push str.ASSERT___file:_s_line:_d___s__do_you_debug_
push 0x4783c0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x40004
push 0
push 0x4783c0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x4054db
int3
test eax, eax
je 0x4053f5
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x204]
push ecx
push str._s_line:_d__msg:_s_
push eax
call fcn.0042d5f0
add esp, 0x14
jmp 0x40540d
push dword [ebp + 0xc]
lea eax, [ebp - 0x204]
push ecx
push str._s_line:_d_
push eax
call fcn.0042d5f0
add esp, 0x10
push 0xff
lea eax, [ebp - 0x103]
mov byte [ebp - 0x104], 0
push 0
push eax
call fcn.0042a980
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x20e]
push eax
movzx eax, word [ebp - 0x212]
push eax
movzx eax, word [ebp - 0x214]
push eax
lea eax, [ebp - 0x104]
push str.._Log_Assert__4d_02d_02d.txt
push eax
call fcn.0042d5f0
add esp, 0x14
cmp dword [0x4784d0], 0
jne 0x4054db
push edi
push 0
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4054a0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042c090
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x2a0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [ebp - 0x2a0]
shl esi, 0x10
push edi
or esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4784d0]
cmp esi, 0xf4240
mov ecx, 1
cmova eax, ecx
pop esi
mov dword [0x4784d0], eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042c090
mov esp, ebp
pop ebp
ret