joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405e20
Capabilities:
Create thread
Terminate thread

Disassembly:
sub esp, 0x28
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, ecx
mov eax, dword [esi + 0x18]
xor ebx, ebx
push 0xffffffffffffffff
push eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
call edi
test eax, eax
jne 0x405f54
mov eax, dword [esp + 0x38]
push eax
lea ecx, [esi + 0x1c]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
mov ecx, dword [esp + 0x40]
push ecx
lea ecx, [esi + 0x20]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
mov eax, dword [esi + 0x3c]
mov edx, dword [esp + 0x48]
push eax
mov dword [esi + 0x24], edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esi + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea edx, [esp + 0x14]
push edx
push ebx
push esi
push 0x405d60
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [esi + 0x34], eax
je 0x405f54
push ebp
push 1
push ebx
push ebx
push ebx
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
cmp dword [esp + 0x20], 0x12
je 0x405f08
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [esp + 0x1c]
push ecx
call ebx
lea edx, [esp + 0x1c]
push edx
call ebp
mov eax, dword [esi + 0x34]
push 1
push eax
call edi
test eax, eax
je 0x405f30
mov ecx, dword [esi + 0x3c]
push 0
push ecx
call edi
test eax, eax
je 0x405f11
push 1
push 0
push 0
push 0
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.USER32.dll_PeekMessageA]
cmp dword [esp + 0x20], 0x12
jne 0x405ec6
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x405f32
mov eax, dword [esi + 0x34]
push 0x64
push eax
call edi
test eax, eax
je 0x405f29
mov ecx, dword [esi + 0x34]
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, esi
call fcn.00405190
xor ebx, ebx
mov eax, dword [esi + 0x34]
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
pop ebp
je 0x405f54
cmp dword [esp + 0x10], ebx
je 0x405f54
mov dword [esp + 0xc], 1
mov eax, dword [esi + 0x2c]
cmp eax, 0xffffffff
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x405f76
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [esi + 0x2c]
push ecx
call edi
mov dword [esi + 0x2c], 0xffffffff
mov eax, dword [esi + 0x34]
cmp eax, ebx
je 0x405f83
push eax
call edi
mov dword [esi + 0x34], ebx
mov eax, dword [esp + 0xc]
pop edi
mov dword [esi + 0x34], ebx
pop esi
pop ebx
add esp, 0x28
ret 0x14
Function at 0x406480
Capabilities:
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x4092f2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x230
mov eax, dword [0x4122b8]
push ebp
lea ecx, [esp + 0x18]
mov dword [esp + 0x230], eax
call fcn.004081fc
mov eax, dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_3]
push eax
push ecx
push 5
push 4
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x250], 0
call fcn.004088b3
push 0x104
lea eax, [esp + 0x34]
push eax
xor ebp, ebp
push ebp
mov byte [esp + 0x248], 1
mov byte [esp + 0x3c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4065bb
lea ecx, [esp + 0x30]
push 0x5c
push ecx
call dword [sym.imp.MSVCR71.dll_strrchr]
add esp, 8
test eax, eax
je 0x4065bb
push edi
lea edi, [esp + 0x34]
mov byte [eax], 0
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x406520
mov dx, word [0x40a740]
lea eax, [esp + 0x34]
push eax
mov word [edi], dx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x4065ba
push esi
push 0x40a6ec
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
push 0x40a828
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
push 0x40a820
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
push 0x40a814
lea ecx, [esp + 0x1c]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
push 0x40a808
lea ecx, [esp + 0x20]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
xor edi, edi
lea esi, [esp + 0xc]
push 0
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
lea ecx, [esp + 0x28]
call sub.MFC71.DLL_CFileFind::FindFile
test eax, eax
je 0x4065b9
inc edi
add esi, 4
cmp edi, 4
jle 0x406593
mov ebp, 1
pop esi
pop edi
mov ecx, dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
push ecx
push 5
push 4
lea edx, [esp + 0x10]
push edx
mov byte [esp + 0x24c], 0
call fcn.00408853
lea ecx, [esp + 0x18]
mov dword [esp + 0x23c], 0xffffffff
call sub.MFC71.DLL_CFileFind::CFileFind
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x230]
mov eax, ebp
pop ebp
call fcn.00408681
add esp, 0x23c
ret
Function at 0x406a90
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x409352
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
mov eax, dword [0x4122b8]
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x4c], eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_3]
xor ebx, ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0x5c], ebx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_3]
mov eax, dword [esi + 0x45c]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push 0x303
push eax
mov byte [esp + 0x6c], 1
call edi
mov dword [esp + 0x40], 0x5c3a41
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x10], eax
test eax, eax
je 0x406bc0
mov cl, bl
lea edx, [esp + 0x40]
add cl, 0x41
push edx
mov byte [esp + 0x44], cl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
jne 0x406bc0
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x406b8e
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], ecx
mov ecx, eax
and eax, 0x7fffffff
and ecx, 0x80000000
mov dword [esp + 0x1c], eax
fild qword [esp + 0x18]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], 0
fild qword [esp + 0x28]
fchs
faddp st(1)
fmul dword [0x40b65c]
fcomp dword [0x40b658]
fnstsw ax
test ah, 5
jp 0x406bc0
lea edx, [ebx + 0x41]
push edx
lea eax, [esp + 0x10]
push 0x40b650
push eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format_1]
add esp, 0xc
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
mov ecx, dword [esi + 0x45c]
push eax
push 0
push 0x143
push ecx
call edi
mov eax, dword [esp + 0x10]
shr eax, 1
inc ebx
cmp ebx, 0x19
mov dword [esp + 0x10], eax
jle 0x406b03
mov edx, dword [esi + 0x45c]
push 0
push 0
push 0x146
push edx
call edi
test eax, eax
push 0
jne 0x406bf6
lea ecx, [esi + 0x7c]
call sub.MFC71.DLL_CWnd::EnableWindow
jmp 0x406c06
mov eax, dword [esi + 0x45c]
push 0
push 0x14e
push eax
call edi
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x4c]
call fcn.00408681
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408954
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x40b8c0
call fcn.00408b54
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x408994
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x408994
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4089ac
cmp eax, 0x20b
je 0x408999
mov dword [ebp - 0x1c], ebx
jmp 0x4089c0
cmp dword [ecx + 0x84], 0xe
jbe 0x408994
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x4089ba
cmp dword [ecx + 0x74], 0xe
jbe 0x408994
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x4132fc], 0xffffffff
or dword [0x413300], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x4132b4]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x4132b0]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4132f8], eax
call fcn.00408c52
call fcn.00408cf2
cmp dword [0x4122e0], ebx
jne 0x408a20
push fcn.00408cf2
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.00408ce0
push 0x40e030
push 0x40e02c
call sub.MSVCR71.dll__initterm
push 0x408c96
call fcn.0040893b
mov eax, dword [0x4132ac]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x4132a8]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x408a74
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x40e028
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x408af2
cmp al, bl
je 0x408a9e
cmp dword [ebp - 0x20], ebx
jne 0x408af2
mov al, byte [esi]
cmp al, bl
je 0x408aae
cmp al, 0x20
ja 0x408aae
inc esi
mov dword [ebp - 0x24], esi
jmp 0x408a9e
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
je 0x408aca
movzx eax, word [ebp - 0x54]
jmp 0x408acd
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.00408df4
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x408aea
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x408b47
cmp al, 0x22
jne 0x408b01
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR71.dll__ismbblead]
pop ecx
test eax, eax
je 0x408b14
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x408a8c
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00408b8f
ret
Function at 0x401fc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x539d89
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [case.0x41724b.0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], 0x33323130
mov dword [ebp - 0x1c], 0x37363534
mov dword [ebp - 0x18], 0x42413938
mov dword [ebp - 0x14], 0x46454443
call fcn.0041745a
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40202f
push 0x80004005
call fcn.004038f0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
movzx eax, bl
mov ecx, eax
mov dword [ebp - 4], 0
and eax, 0xf
movsx edx, byte [ebp + eax - 0x20]
shr ecx, 4
mov cl, byte [ebp + ecx - 0x20]
push edx
movsx eax, cl
push eax
push 0x569ed4
push esi
mov dword [ebp - 0x24], 1
call fcn.004034d0
add esp, 0x10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00516418
mov esp, ebp
pop ebp
ret

Function at 0x403bd0
Capabilities:
Encode data using xor

Disassembly:
add edx, ecx
or eax, 0xffffffff
cmp ecx, edx
jae 0x403bfb
push esi
lea ebx, [ebx]
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x58eec8]
inc ecx
cmp ecx, edx
jb 0x403be0
pop esi
not eax
ret

Function at 0x4088c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
mov ebx, eax
xor eax, eax
push 0xffffffffffffffff
push eax
mov ecx, esi
mov word [ebp - 3], ax
mov byte [ebp - 1], al
mov word [ebp - 7], ax
mov byte [ebp - 5], al
call fcn.0041929c
mov eax, dword [esi + 8]
push 2
push eax
mov ecx, esi
call fcn.004193ae
mov ecx, ebx
mov edx, ebx
mov eax, ebx
sar ecx, 0x18
sar edx, 0x10
sar eax, 8
mov byte [ebp - 4], cl
mov byte [ebp - 3], dl
mov byte [ebp - 2], al
mov byte [ebp - 1], bl
xor edi, edi
mov edi, edi
movzx ecx, byte [ebp + edi - 4]
mov edx, dword [esi + 8]
push ecx
push edx
mov ecx, esi
call fcn.004193ae
inc edi
cmp edi, 4
jl 0x408910
xor edi, edi
test ebx, ebx
jle 0x408948
lea ecx, [ecx]
mov eax, dword [ebp + 8]
movzx ecx, byte [edi + eax]
mov edx, dword [esi + 8]
push ecx
push edx
mov ecx, esi
call fcn.004193ae
inc edi
cmp edi, ebx
jl 0x408930
mov eax, dword [esi + 8]
push 3
push eax
mov ecx, esi
call fcn.004193ae
mov ecx, dword [ebp + 8]
add ebx, ecx
or eax, 0xffffffff
cmp ecx, ebx
jae 0x40897b
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x58eec8]
inc ecx
cmp ecx, ebx
jb 0x408961
not eax
mov ecx, eax
shr ecx, 0x18
mov byte [ebp - 8], cl
mov edx, eax
mov ecx, eax
shr edx, 0x10
shr ecx, 8
mov byte [ebp - 7], dl
mov byte [ebp - 6], cl
mov byte [ebp - 5], al
xor edi, edi
lea ebx, [ebx]
movzx edx, byte [ebp + edi - 8]
mov eax, dword [esi + 8]
push edx
push eax
mov ecx, esi
call fcn.004193ae
inc edi
cmp edi, 4
jl 0x4089a0
pop edi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x412f60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1478
call fcn.0051c380
mov eax, dword [case.0x41724b.0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x1387
mov esi, edx
lea edx, [ebp - 0x138b]
push 0
push edx
mov dword [ebp - 0x1470], edi
mov dword [ebp - 0x1478], eax
mov dword [ebp - 0x1468], ecx
mov byte [ebp - 0x138c], 0
call fcn.00518b60
mov eax, dword [ebp + 0x14]
shr eax, 0x10
add esp, 0xc
mov dword [ebp - 0x146c], 0
mov ebx, esi
cmp al, 1
jne 0x412fe6
lea ebx, [esi + 1]
test esi, esi
jne 0x412fe6
lea ecx, [ebp - 0x146c]
push ecx
lea edx, [edi + 0x14c]
lea ecx, [ebp - 0x138c]
call fcn.0040de00
mov edx, dword [ebp + 0x60]
cmp dword [edx], 0
mov dword [ebp - 0x1474], 0
jbe 0x41311e
mov eax, dword [ebp - 0x1468]
mov dword [ebp - 0x1468], eax
jmp 0x413016
mov edi, dword [ebp - 0x1470]
push 0x1388
lea ecx, [ebp - 0x138c]
push 0
push ecx
call fcn.00518b60
push 0xce
lea edx, [ebp - 0x1460]
push 0
push edx
call fcn.00518b60
add esp, 0x18
lea eax, [ebp - 0x146c]
push eax
lea ecx, [ebp - 0x138c]
lea edx, [edi + 0x14c]
call fcn.0040de00
mov ecx, dword [ebp - 0x146c]
inc ebx
push ebx
push ecx
lea edx, [ebp - 0x138c]
push edx
mov edx, dword [ebp - 0x1470]
sub esp, 0x50
mov edi, esp
mov byte [ebp - 0x1461], al
mov ecx, 0x14
lea esi, [ebp + 0x10]
lea eax, [ebp - 0x1460]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x1478]
push eax
push ecx
push edx
call fcn.00413150
test eax, eax
je 0x413136
lea ecx, [ebp - 0x145c]
or eax, 0xffffffff
jmp 0x4130b0
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x58eec8]
inc ecx
lea edx, [ebp - 0x1392]
cmp ecx, edx
jb 0x4130b0
mov ecx, dword [ebp - 0x1468]
not eax
mov dword [ebp - 0x1460], eax
push 0xce
lea eax, [ebp - 0x1460]
push eax
push ecx
call fcn.0051c010
add esp, 0xc
cmp byte [ebp - 0x1461], 0
je 0x41311e
mov eax, dword [ebp - 0x1474]
mov edx, dword [ebp + 0x60]
add dword [ebp - 0x1468], 0xce
inc eax
mov dword [ebp - 0x1474], eax
cmp eax, dword [edx]
jb 0x413010
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00516418
mov esp, ebp
pop ebp
ret 0x5c
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00516418
mov esp, ebp
pop ebp
ret 0x5c
Function at 0x413d40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53bc1d
mov eax, dword fs:[0]
push eax
sub esp, 0xf0
mov eax, dword [case.0x41724b.0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, edx
mov ebx, dword [esi + 0x188]
add ebx, dword [ebp + 0xc]
push 0x14
mov dword [ebp - 0xfc], esi
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xec], ecx
call fcn.004173b9
add esp, 4
mov dword [ebp - 0xf0], eax
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp eax, ecx
je 0x413db8
mov ecx, eax
call fcn.0041ada3
mov edi, eax
mov dword [ebp - 0xf4], edi
jmp 0x413dc0
mov dword [ebp - 0xf4], ecx
mov edi, ecx
mov dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x1a], 1
jne 0x413e1a
cmp dword [ebp + 0xc], 0
jne 0x413e19
mov ecx, dword [0x59677c]
push 0xffffffffffffffff
push 0
call fcn.0041ae3a
mov edx, dword [0x59677c]
push edx
lea eax, [esi + 0x74]
push eax
mov ecx, ebx
call fcn.0040ed60
test eax, eax
jne 0x413e19
push ecx
mov ecx, esp
mov dword [ebp - 0xf8], esp
push 0x56a8cc
call fcn.00403390
mov ecx, esi
call fcn.00410250
xor eax, eax
jmp 0x413f35
inc ebx
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
mov dword [ebp - 0xf0], 0
jbe 0x413f21
mov edx, dword [ebp - 0xec]
mov dword [ebp - 0xec], edx
push 0xce
lea eax, [ebp - 0xe8]
push 0
push eax
call fcn.00518b60
add esp, 0xc
push edi
lea eax, [esi + 0x74]
push eax
mov ecx, ebx
call fcn.0040ed60
push edi
inc ebx
call fcn.00405850
add esp, 4
test eax, eax
je 0x413e77
inc dword [esi + 0x188]
jmp 0x413f10
push ebx
push edi
sub esp, 0x50
mov edi, esp
mov ecx, 0x14
lea esi, [ebp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xf8]
mov esi, dword [ebp - 0xfc]
push ecx
push esi
lea edx, [ebp - 0xe8]
call fcn.004132d0
test eax, eax
je 0x413e12
lea ecx, [ebp - 0xe4]
or eax, 0xffffffff
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x58eec8]
inc ecx
lea edx, [ebp - 0x1a]
cmp ecx, edx
jb 0x413eb2
mov ecx, dword [ebp - 0xec]
not eax
mov dword [ebp - 0xe8], eax
push 0xce
lea eax, [ebp - 0xe8]
push eax
push ecx
call fcn.0051c010
mov edi, dword [ebp - 0xf4]
add esp, 0xc
cmp ebx, dword [esi + 0x13c]
jge 0x413f21
inc dword [ebp - 0xf0]
add dword [ebp - 0xec], 0xce
mov edx, dword [ebp - 0xf0]
mov eax, dword [ebp + 0x10]
cmp edx, dword [eax]
jb 0x413e3c
test edi, edi
je 0x413f30
mov edx, dword [edi]
mov eax, dword [edx + 4]
push 1
mov ecx, edi
call eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00516418
mov esp, ebp
pop ebp
ret 0x5c

Function at 0x42f708
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.00421308
call fcn.0041c3b8
cmp eax, esi
pop esi
jne 0x42f724
mov ecx, 0x591e08
jmp fcn.0043a8c3
ret
Function at 0x404840
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x404926
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x404915
jg 0x404880
test edx, edx
je 0x404915
nop dword [eax]
call fcn.004061a0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x4048d4
jg 0x404897
test esi, esi
je 0x4048d4
cmp ebx, eax
jg 0x4048a7
jl 0x4048a1
cmp edi, esi
jae 0x4048a7
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.004094d0
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x4048f9
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x40490f
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x404880
jl 0x40490f
test edi, edi
jne 0x404880
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x404948
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x40494a
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x4049c8
jg 0x40495d
test esi, esi
je 0x4049c8
test eax, eax
jl 0x4049ac
jg 0x404967
test ebx, ebx
je 0x4049ac
cmp edi, eax
jg 0x404977
jl 0x404971
cmp esi, ebx
jae 0x404977
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.004094d0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x4049c8
jg 0x4049af
test esi, esi
je 0x4049c8
jmp 0x4049af
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x4049c8
push eax
push esi
push 1
push edx
call fcn.0040f100
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4049e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x404a12
jl 0x404a05
test ecx, ecx
jne 0x404a12
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x404ad2
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.004061c0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x404a7e
jg 0x404a3d
test esi, esi
je 0x404a7e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x404a55
mov eax, dword [esp + 0x10]
jl 0x404a4f
cmp eax, esi
jae 0x404a55
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.004094d0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x404a9f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x404abb
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x404a24
jl 0x404abb
test ecx, ecx
jne 0x404a24
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x404b11
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x404b11
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.004094d0
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x404b80
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x404b37
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
mov ecx, edi
cmp edi, 0xfff
jbe 0x404b69
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.0040f757
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x404b94
cmp edi, eax
ja 0x404b45
test ecx, ecx
je 0x404b80
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.0040f757
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
sbb edx, 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc