joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ea00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x434848
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x48f868]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x40], 0
je 0x40ea40
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x45]
test edx, edx
jne 0x40ea4c
mov al, 1
jmp 0x40ebef
mov dword [ebp - 0x54], 8
call fcn.00409150
push eax
mov eax, dword [ebp - 0x30]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x30]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x40], eax
call fcn.00409150
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x44]
push edx
call fcn.004091b0
add esp, 8
movzx eax, al
test eax, eax
je 0x40ea8f
xor al, al
jmp 0x40ebef
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.0040bd10
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x28]
call fcn.004043c0
mov ecx, eax
call fcn.00401d90
mov esi, eax
lea ecx, [ebp - 0x28]
call fcn.00404ba0
add esi, eax
push esi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x28]
call fcn.004043c0
mov ecx, eax
call fcn.00401d90
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x48
push ecx
mov edx, dword [ebp - 0x30]
mov ecx, dword [edx + 0x40]
call fcn.004126c0
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x40eb0a
cmp dword [ebp - 0x3c], 1
je 0x40eb11
cmp dword [ebp - 0x3c], 3
je 0x40ebab
jmp 0x40ebc3
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x45], 0
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.004043c0
mov ecx, eax
call fcn.00401d90
mov edx, dword [ebp - 0x2c]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x40eb74
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x50]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x28]
call fcn.004043c0
mov ecx, eax
call fcn.00401d90
push eax
call fcn.0041ff14
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x40eb74
mov byte [ebp - 0x34], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401aa0
mov al, byte [ebp - 0x34]
jmp 0x40ebef
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x45]
test edx, edx
jne 0x40eb97
mov byte [ebp - 0x31], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401aa0
mov al, byte [ebp - 0x31]
jmp 0x40ebef
cmp dword [ebp - 0x38], 0
jne 0x40eba9
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.00408b90
jmp 0x40ebdb
mov byte [ebp - 0x33], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401aa0
mov al, byte [ebp - 0x33]
jmp 0x40ebef
mov byte [ebp - 0x32], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401aa0
mov al, byte [ebp - 0x32]
jmp 0x40ebef
jmp 0x40eaa2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e932
mov esp, ebp
pop ebp
ret
Function at 0x414860
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
imul eax, eax, 0
movsx ecx, byte [ebp + 0xc]
mov edx, dword [ebp + 8]
xor ecx, dword [edx + eax]
and ecx, 0xff
mov eax, 4
imul eax, eax, 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + eax]
shr eax, 8
xor eax, dword [ecx*4 + 0x4825f0]
mov ecx, 4
imul ecx, ecx, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx], eax
mov eax, 4
shl eax, 0
mov ecx, 4
imul ecx, ecx, 0
mov edx, dword [ebp + 8]
mov ecx, dword [edx + ecx]
and ecx, 0xff
mov edx, dword [ebp + 8]
add ecx, dword [edx + eax]
mov eax, 4
shl eax, 0
mov edx, dword [ebp + 8]
mov dword [edx + eax], ecx
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax]
imul edx, edx, 0x8088405
add edx, 1
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], edx
mov edx, 4
shl edx, 1
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + eax]
shr eax, 0x18
mov ecx, dword [ebp + 8]
xor eax, dword [ecx + edx]
and eax, 0xff
mov edx, 4
shl edx, 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + edx]
shr edx, 8
xor edx, dword [eax*4 + 0x4825f0]
mov eax, 4
shl eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], edx
pop ebp
ret
Function at 0x419520
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x419530
xor eax, eax
jmp 0x4196cd
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x41968e
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4825f0]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x4825f0]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x4825f0]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4825f0]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x4825f0]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x4825f0]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4825f0]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x4825f0]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x419539
cmp dword [ebp + 0x10], 0
je 0x4196c7
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x4825f0]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x419694
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x402144
Capabilities:
Delete file
Move file

Disassembly:
xor eax, eax
push eax
call fcn.0041ed30
mov edx, dword [esp + 8]
lea ecx, [esp]
call fcn.00413060
push 4
push 0
push dword [esp + 8]
call sub.KERNEL32.dll_MoveFileExW
xor eax, eax
push dword [esp]
call fcn.0041ed90
add esp, 4
ret 4
Function at 0x4087c2
Capabilities:
Check mutex on windows

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
call fcn.0041ed30
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov edx, dword [esp]
mov ebp, dword [edx]
push dword [ebp + 8]
call fcn.00414010
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
cmp ebx, 1
jne 0x40883b
mov edx, dword [esp]
mov ebp, dword [edx]
mov edx, dword [ebp + 0xc]
push edx
call fcn.0041ec80
pop edx
push eax
push edx
call fcn.0041edc0
lea eax, [esp + 0xc]
push eax
call fcn.0041ee20
push dword [esp + 8]
push 1
push 0
call sub.KERNEL32.dll_CreateMutexW
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
jne 0x40883b
push 0xb7
call sub.KERNEL32.dll_ExitProcess
xor eax, eax
push dword [esp + 8]
call fcn.0041ed90
add esp, 0xc
pop ebx
pop ebp
ret 4

Function at 0x40926b
Capabilities:
Get disk size

Disassembly:
push ebx
mov edx, 8
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x409271
call fcn.0041ed30
mov edx, dword [esp + 0x28]
lea ecx, [esp]
call fcn.00413060
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 4]
call fcn.00413060
mov dword [esp + 8], 0xffffffff
mov dword [esp + 0xc], 0xffffffff
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0xc]
call sub.KERNEL32.dll_GetDiskFreeSpaceExW
and eax, eax
je 0x409385
push edx
call fcn.0041ec80
pop edx
push eax
push dword [esp + 8]
call fcn.0040fbd7
call fcn.0041ecc0
mov edx, 0x422390
mov ecx, dword [esp]
push ecx
call fcn.004131d0
pop ecx
add ecx, eax
call fcn.00413210
je 0x40930c
push dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], eax
pop dword [esp + 0x10]
jmp 0x409380
mov edx, 0x42238c
mov ecx, dword [esp]
push ecx
call fcn.004131d0
pop ecx
add ecx, eax
call fcn.00413210
je 0x409336
push dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
pop dword [esp + 0x10]
jmp 0x409380
mov edx, 0x422394
mov ecx, dword [esp]
push ecx
call fcn.004131d0
pop ecx
add ecx, eax
call fcn.00413210
je 0x409370
push dword [esp + 0x20]
push dword [esp + 0x20]
lea eax, [esp + 0x1c]
mov edx, dword [eax]
sub dword [esp], edx
mov edx, dword [eax + 4]
sbb dword [esp + 4], edx
pop dword [esp + 0x10]
pop dword [esp + 0x10]
jmp 0x409380
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], 0xffffffff
call fcn.00413200
lea eax, [esp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
jmp 0x409394
push edx
push dword [esp + 8]
call fcn.0041ed90
push dword [esp + 4]
call fcn.0041ed90
pop edx
add esp, 0x20
pop ebx
ret 8
Function at 0x40bf66
Capabilities:
Get common file path

Disassembly:
push ebp
push ebx
mov edx, 8
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40bf6d
call fcn.0041ed30
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov edx, dword [esp]
mov ebp, dword [edx]
push dword [ebp + 0x10c]
call fcn.00414010
mov dword [esp + 4], eax
push dword [ebp + 0x110]
call fcn.00414010
push edx
push eax
fild qword [esp]
fstp qword [esp]
pop dword [esp + 0xc]
pop dword [esp + 0xc]
mov ebx, dword [esp + 4]
cmp ebx, 1
jne 0x40c077
push edx
call fcn.0041ec80
pop edx
push eax
push edx
call fcn.0041ec80
pop edx
push eax
push 0x104
call fcn.00413ef0
lea eax, [esp + 0x14]
push eax
call fcn.0041ee20
push 0x104
push dword [esp + 0x14]
call sub.KERNEL32.dll_GetSystemDirectoryW
push edx
call fcn.0041ec80
pop edx
push eax
push edx
call fcn.0041ec80
pop edx
push eax
push 1
push 1
mov eax, 0x422028
push eax
mov eax, str.WindowsSystem32
push eax
push dword [esp + 0x28]
call fcn.00413b80
lea eax, [esp + 0x18]
push eax
call fcn.0041ee20
mov eax, 0x422390
push eax
push dword [esp + 0x18]
call fcn.0040926b
push edx
push eax
pop dword [esp + 0x1c]
pop dword [esp + 0x1c]
push dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
pop edx
mov dword [esp - 8], eax
mov dword [esp - 4], edx
fild qword [esp - 8]
fld qword [esp + 8]
fcompp
fnstsw ax
test ah, 0x41
jne 0x40c077
mov dword [0x424ea0], 1
call fcn.00403fc1
xor eax, eax
push dword [esp + 0x14]
call fcn.0041ed90
push dword [esp + 0x10]
call fcn.0041ed90
add esp, 0x20
pop ebx
pop ebp
ret 4

Function at 0x40cef4
Capabilities:
Get disk information

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.0041ed30
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov edx, dword [esp]
mov ebp, dword [edx]
push dword [ebp + 0x48]
call fcn.00414010
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
cmp ebx, 1
jne 0x40cf59
mov edx, dword [esp]
mov ebp, dword [edx]
push dword [ebp + 0x4c]
call fcn.00414010
mov dword [esp + 8], eax
push 0
call sub.KERNEL32.dll_GetDriveTypeW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
cmp ebx, dword [esp + 8]
jne 0x40cf4f
jmp 0x40cf5b
push 0
call sub.KERNEL32.dll_ExitProcess
xor eax, eax
add esp, 0x10
pop ebx
pop ebp
ret 4
Function at 0x40f530
Capabilities:
Query environment variable

Disassembly:
xor eax, eax
push eax
push eax
call fcn.0041ed30
push dword [esp + 0x10]
call fcn.00413200
mov edx, dword [esp + 0xc]
lea ecx, [esp]
call fcn.00413060
push edx
call fcn.0041ec80
pop edx
push eax
push edx
call fcn.0041ec80
pop edx
push eax
push 0x104
call fcn.00413ef0
lea eax, [esp + 8]
push eax
call fcn.0041ee20
push 0x104
mov eax, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
and eax, eax
je 0x40f5aa
mov edx, dword [esp + 4]
push edx
call fcn.0041ec80
pop edx
push eax
push edx
call fcn.0041edc0
pop eax
push eax
call fcn.004131d0
pop edx
add eax, edx
jmp 0x40f5d3
mov edx, 0x422028
push edx
call fcn.0041ec80
pop edx
push eax
push edx
call fcn.0041edc0
pop eax
push eax
call fcn.004131d0
pop edx
add eax, edx
jmp 0x40f5d3
push dword [esp + 4]
call fcn.0041ed90
push dword [esp]
call fcn.0041ed90
add esp, 8
ret 4

Function at 0x40fb31
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
call fcn.0041ed30
push dword [esp + 8]
call fcn.0041e830
push eax
call fcn.0041e7d0
mov dword [0x424ee4], eax
push dword [esp + 8]
call fcn.0041e830
push eax
push dword [0x424ee4]
push dword [esp + 0x10]
call fcn.0041e7f0
push 0
push 0
push 0
lea eax, [0x401e11]
push eax
push 0
push 0
call sub.KERNEL32.dll_CreateThread
mov dword [esp], eax
push 0xffffffff
push dword [esp + 4]
call sub.KERNEL32.dll_WaitForSingleObject
xor eax, eax
add esp, 4
ret 4
Function at 0x413686
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
je 0x41371e
push edi
push 0x4259e0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x425030]
test edi, edi
je 0x4136f2
push ebx
push esi
lea ebx, [edi + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4136eb
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
push ebx
push 0x425030
call fcn.0041e2e8
pop ecx
pop ecx
jmp 0x4136ed
mov edi, dword [edi]
test edi, edi
jne 0x4136c2
pop ebx
mov eax, dword [0x42435c]
mov esi, eax
inc eax
push 0x10
push 0x425030
mov dword [0x42435c], eax
call fcn.0041e328
pop ecx
pop ecx
push 0x4259e0
mov dword [eax], ebp
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8

Function at 0x4137c1
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
push 0
push edi
call fcn.0041363a
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebx, 0x4259e0
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x425030]
jmp 0x4137f2
cmp dword [esi + 0xc], edi
je 0x4137f8
mov esi, dword [esi]
test esi, esi
jne 0x4137eb
jmp 0x413810
add esi, 8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0x425030
call fcn.0041e2e8
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
ret 4
Function at 0x413885
Capabilities:
Check os version

Disassembly:
sub esp, 0x350
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x114
xor ebx, ebx
mov esi, 0xc8
and dword [esp + 0x10], ebx
xor edi, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4139fb
mov eax, dword [esp + 0x24]
dec eax
je 0x4139de
dec eax
jne 0x4139fb
lea eax, [esp + 0x128]
xor ebp, ebp
push eax
call fcn.0041383e
pop ecx
test eax, eax
je 0x41393c
mov ebx, dword [esp + 0x12c]
mov edi, dword [esp + 0x130]
mov eax, dword [esp + 0x134]
cmp byte [esp + 0x242], 1
jne 0x4138ff
xor ebp, ebp
inc ebp
sub ebx, 3
je 0x4139da
dec ebx
je 0x4139d6
dec ebx
je 0x4139b5
dec ebx
je 0x41396f
sub ebx, 4
jne 0x4139fb
test edi, edi
jne 0x4139fb
cmp eax, 0x55f0
sbb esi, esi
and esi, 0xfffffff6
add esi, 0x78
jmp 0x4139fb
lea eax, [esp + 0x244]
mov dword [esp + 0x244], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, dword [esp + 0x10]
je 0x4138ff
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
cmp byte [esp + 0x35e], 1
jmp 0x4138fa
sub edi, 0
je 0x4139a7
dec edi
je 0x413999
dec edi
je 0x41398b
dec edi
jne 0x4139fb
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x69
jmp 0x4139fb
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x5f
jmp 0x4139fb
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x55
jmp 0x4139fb
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
jmp 0x4139fb
sub edi, 0
je 0x4139d2
dec edi
je 0x4139ce
dec edi
jne 0x4139fb
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x4139fb
push 0x3c
jmp 0x4139fa
push 0x32
jmp 0x4139fa
push 0x14
jmp 0x4139fa
push 5
jmp 0x4139fa
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4139f8
cmp eax, 0xa
je 0x4139f4
cmp eax, 0x5a
jne 0x4139fb
push 0x28
jmp 0x4139fa
push 0x1e
jmp 0x4139fa
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret
Function at 0x414f12
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x425a04]
call fcn.0041da98
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x415012
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x414f68
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x414f60
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x414fa8
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x414fea
push 0x22
pop edx
cmp cx, dx
je 0x414f9a
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x414f8a
xor ecx, ecx
cmp word [eax], cx
je 0x414fea
mov ecx, eax
add eax, 2
jmp 0x414fec
test dx, dx
je 0x414ff2
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x414f9a
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x414fe0
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x414fea
cmp cx, dx
je 0x414fdd
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x414fcd
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x414fb2
jmp 0x414f9a
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x414ff4
xor edx, edx
cmp dword [ebp], ebx
jne 0x414ffd
test edi, edi
jne 0x41501a
test edx, edx
je 0x415002
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x414f56
test edi, edi
jne 0x41502b
mov eax, ebx
jmp 0x41502f
test esi, esi
je 0x41502b
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x41502f
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x41513f
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebp
push esi
push edi
push dword [esp + 0x38]
xor esi, esi
mov dword [esp + 0x10], esi
call fcn.0041fdb0
mov edi, dword [esp + 0x34]
mov dword [esp + 0x10], eax
lea eax, [edi + 0x18]
push eax
push esi
push dword [0x424e7c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
je 0x41523e
push ebx
mov ebx, dword [esp + 0x30]
lea eax, [edi + 0x18]
push esi
push dword [ebx + 0x18]
push eax
push ebp
push edi
push dword [esp + 0x48]
call fcn.0041562e
mov esi, eax
add esp, 0x18
test esi, esi
je 0x4151a2
cmp esi, edi
jge 0x4151a2
mov dword [esp + 0x34], ebp
jmp 0x4151a4
mov esi, edi
push dword [esp + 0x14]
call sub.MSVCRT.dll_strlen
mov word [esp + 0x2c], ax
mov eax, edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
cdq
mov dword [esp + 0x1c], eax
mov eax, esi
pop ecx
mov dword [esp + 0x1c], edx
cdq
push 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x40]
push eax
push 0x12
lea eax, [esp + 0x24]
mov dword [esp + 0x30], edx
push eax
push dword [ebx]
call edi
cmp dword [esp + 0x3c], 0x12
jne 0x415223
push 0
lea eax, [esp + 0x40]
push eax
movsx eax, word [esp + 0x30]
push eax
push dword [esp + 0x20]
push dword [ebx]
call edi
movsx eax, word [esp + 0x28]
cmp eax, dword [esp + 0x3c]
jne 0x415223
push 0
lea eax, [esp + 0x40]
push eax
push esi
push dword [esp + 0x40]
push dword [ebx]
call edi
cmp esi, dword [esp + 0x3c]
jne 0x415223
xor esi, esi
inc esi
jmp 0x415227
mov esi, dword [esp + 0x10]
push ebx
call fcn.00415848
pop ecx
push ebp
push 0
push dword [0x424e7c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebx
push dword [esp + 0x10]
call fcn.0041fda0
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x1c
ret 0x10
Function at 0x415479
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
or dword [esp], 0xffffffff
xor edx, edx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
mov esi, edx
test edi, edi
je 0x4154b0
cmp word [edi], dx
je 0x4154b0
push edi
call fcn.0041fdb0
mov ebp, dword [esp + 0x20]
mov edi, eax
push edi
push ebp
call fcn.0041588d
pop ecx
pop ecx
mov esi, eax
xor edx, edx
jmp 0x4154c6
mov ebp, dword [esp + 0x20]
cmp dword [ebp + 8], edx
je 0x4155db
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 4]
mov esi, dword [eax + ecx*4]
test esi, esi
je 0x4155db
cmp dword [esp + 0x30], 0
je 0x4154ea
push dword [esi]
push edx
push dword [0x424e7c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov eax, dword [esi]
jmp 0x4154f2
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x14], eax
test ebx, ebx
je 0x4155df
cdq
cmp edx, dword [esi + 4]
jl 0x4155df
jg 0x415512
cmp eax, dword [esi]
jb 0x4155df
push 0
lea eax, [esi + 0x14]
push eax
push dword [esi + 0x10]
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 8]
cmp eax, dword [esi]
jne 0x415564
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 4]
jne 0x415564
push 0
lea eax, [esp + 0x30]
push eax
push dword [esi]
push ebx
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebp, dword [esp + 0x2c]
mov eax, ebp
cdq
cmp dword [esi], eax
jne 0x4155df
cmp dword [esi + 4], edx
jne 0x4155df
mov dword [esp + 0x10], ebp
jmp 0x4155e3
push dword [esi + 8]
push 0
push dword [0x424e7c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x4155df
push 0
lea ecx, [esp + 0x30]
push ecx
push dword [esi + 8]
push eax
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x2c]
cdq
cmp dword [esi + 8], eax
jne 0x4155c3
cmp dword [esi + 0xc], edx
jne 0x4155c3
push dword [esp + 0x14]
push ebx
push dword [esp + 0x20]
call fcn.00415aee
cdq
add esp, 0xc
cmp eax, dword [esi]
jne 0x4155c3
cmp edx, dword [esi + 4]
jne 0x4155c3
mov ebp, dword [esi]
mov dword [esp + 0x10], ebp
jmp 0x4155c7
mov ebp, dword [esp + 0x10]
push dword [esp + 0x18]
push 0
push dword [0x424e7c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4155e3
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x10]
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x41560f
cmp ebp, 0xffffffff
jne 0x415609
test ebx, ebx
je 0x415603
push ebx
push 0
push dword [0x424e7c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov ebx, eax
jmp 0x415615
mov eax, dword [esi]
mov dword [ecx], eax
jmp 0x415613
mov ebx, dword [esp + 0x10]
xor eax, eax
test edi, edi
je 0x415624
cmp word [edi], ax
je 0x415624
push edi
call fcn.0041fda0
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0xc
ret