joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e130
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502b3b
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
push esi
push edi
mov eax, dword [0x5473d8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x44]
call fcn.00418e90
mov dword [ebp - 4], 0
mov edi, dword [eax]
mov dword [ebp - 0x34], 0x6e0075
mov dword [ebp - 0x30], 0x6e0069
mov dword [ebp - 0x2c], 0x740073
mov dword [ebp - 0x28], 0x6c0061
mov dword [ebp - 0x24], 0x20006c
mov dword [ebp - 0x20], 0x720070
mov dword [ebp - 0x1c], 0x67006f
mov dword [ebp - 0x18], 0x650072
mov dword [ebp - 0x14], 0x730073
mov dword [ebp - 0x10], 0x3a
call fcn.00405dc0
push eax
push 0x13
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x38]
call fcn.00404e60
sub esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xdc]
call fcn.0040b430
mov byte [ebp - 4], 2
mov eax, 0x531ef4
mov esi, dword [ebp - 0x38]
test esi, esi
cmovne eax, esi
push eax
lea eax, [ebp - 0xdc]
push eax
call fcn.00409e50
add esp, 8
lea ecx, [ebp - 0xdc]
push dword [ebp + 8]
call fcn.00413410
mov eax, dword [edi]
lea ecx, [ebp - 0xdc]
push ecx
mov ecx, edi
call dword [eax + 0xc]
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xdc], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebp - 0xdc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ebp + ecx - 0xe0], eax
lea ecx, [ebp - 0xd8]
call fcn.0040c1d0
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xdc], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0xdc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0xe0], eax
lea eax, [ebp - 0x8c]
mov byte [ebp - 4], 3
push eax
mov dword [ebp - 0x8c], vtable.std::ios_base.0
call fcn.0041c00c
or edi, 0xffffffff
mov byte [ebp - 4], 0
add esp, 4
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40e2ab
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 4
mov esi, dword [ebp - 0x40]
test esi, esi
je 0x40e2d7
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x40e2d7
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x40e2d7
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 8]
test eax, eax
je 0x40e2f2
push 0
push dword [ebp + 8]
push 0x42a
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40e310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502b7b
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
push ebx
push esi
push edi
mov eax, dword [0x5473d8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebp - 0x34]
call fcn.00418e90
mov dword [ebp - 4], 0
mov edi, dword [eax]
mov dword [ebp - 0x28], 0x6e0075
mov dword [ebp - 0x24], 0x6e0069
mov dword [ebp - 0x20], 0x740073
mov dword [ebp - 0x1c], 0x6c0061
mov dword [ebp - 0x18], 0x20006c
mov dword [ebp - 0x14], 0x6e0065
mov dword [ebp - 0x10], 0x64
call fcn.00405dc0
push eax
push 0xd
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00404e60
sub esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xcc]
call fcn.0040b430
mov byte [ebp - 4], 2
mov eax, 0x531ef4
mov esi, dword [ebp - 0x2c]
test esi, esi
cmovne eax, esi
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.00409e50
mov eax, dword [edi]
lea ecx, [ebp - 0xcc]
add esp, 8
push ecx
mov ecx, edi
call dword [eax + 0xc]
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xcc], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebp - 0xcc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ebp + ecx - 0xd0], eax
lea ecx, [ebp - 0xc8]
call fcn.0040c1d0
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xcc], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0xcc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0xd0], eax
lea eax, [ebp - 0x7c]
mov byte [ebp - 4], 3
push eax
mov dword [ebp - 0x7c], vtable.std::ios_base.0
call fcn.0041c00c
or edi, 0xffffffff
mov byte [ebp - 4], 0
add esp, 4
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40e462
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 4
mov esi, dword [ebp - 0x30]
test esi, esi
je 0x40e48e
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x40e48e
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x40e48e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, dword [ebx + 8]
test eax, eax
je 0x40e4a5
push 0
push 0
push 0x42b
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416220
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5034c6
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x5473d8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x220], edi
push 0x20c
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x220], edi
push 0
push eax
call fcn.004c5380
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.00405dc0
mov ecx, eax
test ecx, ecx
je 0x41634c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x220]
call fcn.00404d20
test al, al
jne 0x4162f2
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4162d0
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x220]
call fcn.004051c0
push esi
lea edx, [ebp - 0x220]
mov dword [ebp - 4], 1
mov ecx, edi
call fcn.00416d80
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov esi, dword [ebp - 0x220]
or eax, 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41632f
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00499723
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00405ba0
int3
Function at 0x416650
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50355b
mov eax, dword fs:[0]
push eax
sub esp, 0x840
mov eax, dword [0x5473d8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x84c], ecx
push 0x802
lea eax, [ebp - 0x814]
push 0
push eax
call fcn.004c5380
add esp, 0xc
mov dword [ebp - 0x81c], 1
xor eax, eax
mov dword [ebp - 0x818], 0x400
mov dword [ebp - 0x834], 0x650053
mov ebx, 0x74
mov dword [ebp - 0x830], 0x750074
mov dword [ebp - 0x82c], 0x200070
mov dword [ebp - 0x828], 0x610050
mov dword [ebp - 0x824], 0x680074
mov word [ebp - 0x820], ax
call fcn.00405dc0
push eax
push 0xa
lea eax, [ebp - 0x834]
push eax
lea ecx, [ebp - 0x844]
call fcn.00404e60
mov dword [ebp - 4], 0
mov dword [ebp - 0x840], 0x4f0053
mov dword [ebp - 0x83c], 0x540046
mov dword [ebp - 0x838], 0x410057
mov dword [ebp - 0x834], 0x450052
mov dword [ebp - 0x830], 0x41005c
mov dword [ebp - 0x82c], 0x79006e
mov dword [ebp - 0x828], 0x680074
mov dword [ebp - 0x824], 0x6e0069
mov dword [ebp - 0x820], 0x67
call fcn.00405dc0
push eax
push 0x11
lea eax, [ebp - 0x840]
push eax
lea ecx, [ebp - 0x848]
call fcn.00404e60
mov edi, dword [ebp - 0x844]
lea eax, [ebp - 0x818]
mov esi, dword [ebp - 0x848]
push eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x81c]
push eax
push edi
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
lea edx, [esi - 0x10]
sete bl
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4167d0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], esi
dec esi
test esi, esi
jg 0x4167ec
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x416839
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x416839
lea eax, [ebp - 0x814]
lea edx, [eax + 2]
nop word [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x416810
mov ecx, dword [ebp - 0x84c]
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x814]
push eax
call fcn.004051c0
mov eax, 1
jmp 0x41683b
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00499723
mov esp, ebp
pop ebp
ret
Function at 0x416860
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5035b1
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5473d8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], 0
mov dword [esi], 0
call fcn.00405dc0
mov ecx, eax
test ecx, ecx
je 0x416994
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push edi
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], 0
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x416968
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
call fcn.00404bf0
mov dword [ebp - 4], 1
or ebx, 0xffffffff
mov edx, dword [eax]
mov edi, dword [esi]
sub edi, 0x10
lea ecx, [edx - 0x10]
cmp ecx, edi
je 0x41694c
cmp dword [edi + 0xc], 0
jl 0x416941
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x416941
call fcn.004075e0
mov dword [ebp - 0x20], eax
lea edx, [edi + 0xc]
mov ecx, ebx
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41693a
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x20]
add eax, 0x10
mov dword [esi], eax
jmp 0x41694c
push dword [edx - 0xc]
mov ecx, esi
push edx
call fcn.004051c0
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x416968
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x416976
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00499723
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00405ba0
int3
Function at 0x4179b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x503718
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x5473d8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x5c]
xor eax, eax
mov dword [ebp - 0x60], esi
mov word [ebp - 0x5c], ax
lea eax, [ebp - 0x44]
push 0x19
push eax
mov dword [ebp - 0x44], 0x65004d
mov dword [ebp - 0x40], 0x730073
mov dword [ebp - 0x3c], 0x670061
mov dword [ebp - 0x38], 0x420065
mov dword [ebp - 0x34], 0x78006f
mov dword [ebp - 0x30], 0x6d005c
mov dword [ebp - 0x2c], 0x730065
mov dword [ebp - 0x28], 0x610073
mov dword [ebp - 0x24], 0x650067
mov dword [ebp - 0x20], 0x6f0062
mov dword [ebp - 0x1c], 0x2e0078
mov dword [ebp - 0x18], 0x6d0078
mov dword [ebp - 0x14], 0x6c
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 7
call fcn.00405f00
mov dword [ebp - 4], 0
lea eax, [ebp - 0x5c]
cmp dword [ebp - 0x48], 8
mov ecx, esi
push 0xffffffffffffffff
cmovae eax, dword [ebp - 0x5c]
push eax
call fcn.00426000
mov edx, dword [ebp - 0x48]
cmp edx, 8
jb 0x417ab0
mov ecx, dword [ebp - 0x5c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x417aa6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417ad0
push edx
push ecx
call fcn.00499734
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00499723
mov esp, ebp
pop ebp
ret 4
call fcn.004c8a99
int3

Function at 0x417ae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50374c
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5473d8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x553a64]
cmp eax, dword [ecx + 4]
jle 0x417bbd
push 0x553a64
call fcn.0049a9a7
add esp, 4
cmp dword [0x553a64], 0xffffffff
jne 0x417bbd
mov dword [ebp - 4], 0
xor eax, eax
mov word [0x553a68], ax
mov ecx, 0x553a68
push 0xf
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x65006d
push eax
mov dword [ebp - 0x2c], 0x730073
mov dword [ebp - 0x28], 0x670061
mov dword [ebp - 0x24], 0x5f0065
mov dword [ebp - 0x20], 0x6f0062
mov dword [ebp - 0x1c], 0x5f0078
mov dword [ebp - 0x18], 0x6e0077
mov dword [ebp - 0x14], 0x64
mov dword [0x553a78], 0
mov dword [0x553a7c], 7
call fcn.00405f00
push 0x50b220
call fcn.004999f7
push 0x553a64
call fcn.0049a95d
add esp, 8
cmp dword [0x553a7c], 8
mov eax, 0x553a68
cmovae eax, dword [0x553a68]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00499723
mov esp, ebp
pop ebp
ret
Function at 0x418220
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x2c], 0x6e0041
mov dword [ebp - 0x28], 0x740079
mov dword [ebp - 0x24], 0x690068
mov dword [ebp - 0x20], 0x67006e
mov dword [ebp - 0x1c], 0x6e0049
mov dword [ebp - 0x18], 0x740073
mov dword [ebp - 0x14], 0x6c0061
mov dword [ebp - 0x10], 0x65006c
mov dword [ebp - 0xc], 0x72
call fcn.00405dc0
push eax
push 0x11
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 4]
call fcn.00404e60
mov esi, dword [ebp - 4]
push esi
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
or ebx, 0xffffffff
mov edi, eax
add esi, 0xfffffff0
mov ecx, ebx
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4182a6
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x418361
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41836a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [ebp - 0x30], 0x6e0041
mov dword [ebp - 0x2c], 0x740079
mov dword [ebp - 0x28], 0x690068
mov dword [ebp - 0x24], 0x67006e
mov dword [ebp - 0x20], 0x650053
mov dword [ebp - 0x1c], 0x750074
mov dword [ebp - 0x18], 0x4d0070
mov dword [ebp - 0x14], 0x690061
mov dword [ebp - 0x10], 0x57006e
mov dword [ebp - 0xc], 0x64006e
mov word [ebp - 8], ax
call fcn.00405dc0
push eax
push 0x14
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 4]
call fcn.00404e60
mov esi, dword [ebp - 4]
push 0
push esi
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov edi, eax
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x41834d
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
test edi, edi
je 0x418361
push 0
push 0
push 0x428
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [0x548f38], edi
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418410
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x503829
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x5473d8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x28], 0
cmp byte [esi + 8], 0
je 0x418453
call fcn.004185b0
mov byte [esi + 8], 0
cmp dword [esi + 4], 0x40000000
jle 0x41848f
mov eax, dword [esi + 0x24]
cmp eax, 0xffffffff
je 0x418474
push eax
call fcn.004d8bce
add esp, 4
mov dword [esi + 0x24], 0xffffffff
cmp dword [esi + 0x20], 8
lea eax, [esi + 0xc]
jb 0x41847f
mov eax, dword [eax]
push eax
call fcn.004d8d21
add esp, 4
mov ecx, esi
call fcn.004185b0
mov dword [ebp - 4], 0
xor ecx, ecx
mov eax, dword [edi + 0x10]
mov edx, 2
mul edx
push 0
mov dword [ebp - 0x14], 0
seto cl
mov dword [ebp - 0x10], 0xf
neg ecx
mov byte [ebp - 0x24], 0
or ecx, eax
push ecx
lea ecx, [ebp - 0x24]
call fcn.004197a0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], 1
test eax, eax
je 0x41850e
cmp dword [ebp - 0x10], 0x10
lea ecx, [ebp - 0x24]
mov edx, edi
cmovae ecx, dword [ebp - 0x24]
cmp dword [edi + 0x14], 8
jb 0x4184e9
mov edx, dword [edi]
push 0
push 0
push eax
push ecx
push dword [edi + 0x10]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push eax
lea ecx, [ebp - 0x24]
call fcn.00415b70
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
lea ebx, [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
cmp edx, 0x10
cmovae ebx, ecx
cmp dword [esi + 0x24], 0xffffffff
je 0x41853a
push eax
push ebx
push dword [esi + 0x24]
call fcn.004d85eb
mov edx, dword [ebp - 0x10]
add esp, 0xc
mov ecx, dword [ebp - 0x24]
mov ebx, eax
jmp 0x41853d
or ebx, 0xffffffff
cmp edx, 0x10
jb 0x418567
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41855d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4185a5
push edx
push ecx
call fcn.00499734
add esp, 8
test ebx, ebx
jle 0x418582
add dword [esi + 4], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x14], 8
jb 0x41858a
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.004c8a99
int3
Function at 0x4185b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50385b
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x5473d8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x20], 8
lea esi, [edi + 0xc]
jb 0x4185eb
mov esi, dword [esi]
push 0x180
push 0x40
push 0x8101
lea ebx, [edi + 0x24]
push esi
push ebx
call fcn.004d802a
add esp, 0x14
mov dword [ebp - 0xc4], eax
test eax, eax
je 0x418718
push 0x98
lea eax, [ebp - 0xa8]
push 0
push eax
call fcn.004c5380
add esp, 4
lea ecx, [ebp - 0xa8]
call fcn.0040b430
push 0x5323b0
push ecx
push dword [ebp - 0xc4]
lea eax, [ebp - 0xa8]
mov dword [ebp - 4], 0
push ecx
push str._error.__
push ecx
push esi
push ecx
push str.open
push eax
call fcn.00409e50
add esp, 0xc
push eax
call fcn.00409e50
add esp, 0xc
push eax
call fcn.00409e50
add esp, 0xc
mov ecx, eax
call fcn.00413410
add esp, 4
push eax
call fcn.00409e50
add esp, 8
lea eax, [ebp - 0xc0]
lea ecx, [ebp - 0xa8]
push eax
call fcn.00419060
cmp dword [eax + 0x14], 8
jb 0x4186a2
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edx, dword [ebp - 0xac]
cmp edx, 8
jb 0x4186e9
mov ecx, dword [ebp - 0xc0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4186df
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4187f3
push edx
push ecx
call fcn.00499734
add esp, 8
xor eax, eax
mov dword [ebp - 0xb0], 0
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0xac], 7
mov word [ebp - 0xc0], ax
mov dword [ebp - 4], 0xffffffff
call fcn.00408dc0
mov eax, dword [ebx]
cmp eax, 0xffffffff
je 0x41872e
push 2
push 0
push eax
call fcn.004d8b26
add esp, 0xc
jmp 0x418731
or eax, 0xffffffff
mov dword [edi + 4], eax
test eax, eax
jne 0x4187d7
push 3
push 0x5323d8
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], 0xf
mov byte [ebp - 0xc0], al
call fcn.0040c530
mov edx, dword [ebp - 0xac]
lea eax, [ebp - 0xc0]
mov ecx, dword [ebp - 0xc0]
cmp edx, 0x10
mov esi, dword [ebx]
cmovae eax, ecx
cmp esi, 0xffffffff
je 0x4187a3
push dword [ebp - 0xb0]
push eax
push esi
call fcn.004d85eb
mov edx, dword [ebp - 0xac]
add esp, 0xc
mov ecx, dword [ebp - 0xc0]
mov esi, eax
jmp 0x4187a6
or esi, 0xffffffff
cmp edx, 0x10
jb 0x4187d0
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4187c6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4187f8
push edx
push ecx
call fcn.00499734
add esp, 8
test esi, esi
jle 0x4187d7
add dword [edi + 4], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00499723
mov esp, ebp
pop ebp
ret
call fcn.004c8a99
call fcn.004c8a99
int3