joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442c93
Capabilities:
Read file via mapping

Disassembly:
xor esi, 0x10be8af4
sub edi, edx
shr edi, 4
not eax
or ebx, eax
neg edx
xor esi, esp
sub esi, 0x9d81566
or ebx, eax
call fcn.0041f196
mov ecx, 0xbc1795
mov dword [0x4e74d4], esi
call fcn.0041f196
inc eax
rol eax, 0x1d
inc esi
mov ebx, dword [vtable.type_info.0]
rol eax, 0x11
shl edx, 4
shr edx, 0x11
call fcn.00411d3f
neg eax
loop 0x442cb8
push 0
xor esi, dword [0x4e1843]
xor esi, eax
xchg esi, esi
call fcn.0040771a
ror edi, 0x13
dec edi
ror esi, 0x18
add eax, eax
rol edx, 0x18
not esi
xor dword [0x4e78ed], ecx
xor ebx, dword [0x4e1013]
dec esi
xor esi, dword [0x4e109e]
neg edx
rol edi, 9
mov dword [0x4e746c], 0x9bebe2b
xor esi, dword [vtable.type_info.0]
neg esi
xor esi, esp
mov dword [0x4e7470], 0x405a4f6
call fcn.00405dcf
mov ebx, 0x657
sub ebx, dword [0x4e7cd0]
sub esi, ebp
add esi, eax
xor esi, ebp
add ebx, esp
call fcn.0040449d
not esi
inc edi
call fcn.00407322
mov dword [0x4e76f0], 0xdb9ba54
xor ecx, esp
xor ecx, esp
xor dword [0x4e76ba], 0x7fc4eed
dec edi
not esi
call fcn.004075cc
sub ebx, esp
xor esi, ebp
sub esi, eax
add esi, ebp
push ebx
call fcn.00408310
dec eax
xor dword [0x4e7607], esi
xor esi, eax
rol esi, 0x1b
xor edi, eax
xor eax, ebp
call fcn.00404fad
inc esi
xor eax, 0x3170c0ac
mov dword [0x4e76ba], 0x91223b0
sub dword [0x4e78be], 0xa264959
xor eax, 0x3170c0ac
dec esi
call fcn.00404804
xor eax, ebp
xor edi, eax
ror esi, 0x1b
xor esi, eax
lock add dword [0x4e7628], edi
inc eax
call fcn.00405e15
push 0
xor ebx, edx
sub esi, eax
xor edi, esi
xchg esi, eax
rol eax, 0x18
inc ecx
call fcn.00401f22
sub dword [0x4e756e], edx
add edi, dword [0x4e7a28]
or dword [0x4e79de], esi
call fcn.00406cec
dec ecx
ror eax, 0x18
xchg esi, eax
xor edi, esi
add esi, eax
xor ebx, edx
push 0x40
sub esi, dword [0x4e7e24]
xor eax, 0x4e7e24
add dword [0x4e74c5], 0x2348154
ror eax, 0x1a
xor edi, edx
neg ebx
xor eax, edx
neg esi
and dword [0x4e77b0], ecx
call fcn.0040550d
sub dword [0x4e7966], edx
sub edx, dword [0x4e7b20]
xor esi, eax
sub ecx, dword [0x4e7b81]
sub dword [0x4e7782], ecx
mov dword [0x4e7646], 0x5dfa2a8
call fcn.00404b48
xor ecx, dword [0x4e7ae7]
add ecx, dword [0x4e7a29]
mov dword [0x4e7522], edi
call fcn.004078a8
mov dword [0x4e7751], 0xdc3dc30
sub ebx, dword [0x4e7f8f]
invalid
or eax, 0x4e7814
xchg ah, al

Function at 0x442ef0
Capabilities:
Read file via mapping

Disassembly:
inc esi
cld
push edi
fiadd dword [ecx + 0x62110cc1]
adc dword [ebx], esi
fsubr st(0)
movsd dword es:[edi], dword [esi]
add al, 0xfc
push dword [ebx]
invalid
Function at 0x442fa0
Capabilities:
Read file via mapping

Disassembly:
call fcn.004078a8
call fcn.00402617
xor eax, 0x2e3295
rol esi, 4
mov dword [0x4e7824], esi
rol esi, 8
inc eax
ror ecx, 7
sub eax, 0x309afa64
not esi
inc eax
xchg ebx, esi
sub esi, eax
xor edi, ecx
ror esi, 2
sub ecx, eax
xor eax, 0x2654f5d
push ebx
inc esi
add ebx, esp
add ecx, dword [0x4e7bc0]
inc ebx
call fcn.00401fb0
and dword [0x4e78be], edx
xor ebx, edx
dec ecx
xor dword [0x4e7a06], esi
rol ebx, 6
ror ebx, 6
sub dword [0x4e764b], ecx
inc ecx
xor ebx, edx
sub dword [0x4e74aa], ecx
call fcn.004054d5
dec ebx
sub ebx, esp
dec esi
push 0
not ecx
sub ecx, dword [0x4e7fc4]
add edi, dword [0x4e7f66]
call fcn.004089f3
push edi
fiadd word [ebx]
invalid
rol edi, 0xe
add dword [0x4e78f3], ecx
call fcn.004039b4
sub ebx, dword [0x4e7db8]
mov dword [0x4e7683], ecx
sub edi, dword [0x4e7d18]

Function at 0x443630
Capabilities:
Hash data using murmur3

Disassembly:
or eax, 0x4e7773
ror edi, 0x16
xchg eax, eax
inc edx
not edx
add esi, 0x33390964
sub ebx, esp
pop edi
add ebx, dword [0x4e7bbe]
add edi, dword [0x4e7c6a]
xchg eax, edx
mov dword [0x4e77b0], edx
xor eax, 0x156a404
xor ecx, dword [0x4e7c30]
rol esi, 0xd
xor edx, ecx
ror ebx, 4
xor esi, edi
sub edx, dword [0x4e7da8]
not edi
sub ebx, dword [0x4e7fa4]
xor esi, eax
xor eax, ebp
xchg edx, edx
xor esi, eax
xor esi, eax
xchg edx, edx
xor eax, ebp
xor esi, eax
not edi
xor esi, edi
rol ebx, 4
xor edx, ecx
ror esi, 0xd
xor eax, 0x156a404
mov dword [0x4e7623], ebx
xchg eax, edx
add edi, 0x395
mov dword [0x4e74ca], 0x1d4368fa
sub dword [0x4e798a], 0x12627589
xor esi, edi
add esi, eax
mov dword [0x4e754e], edi
inc edx
mov dword [0x4e778c], 0x10029aad
add edi, ecx
xor ebx, esp
not esi
mov dword [0x4e74a2], 0x5a2cd07
or dword [0x4e7813], 0x252b3b91
add edi, eax
dec eax
inc eax
sub edi, eax
mov dword [0x4e75ec], 0x181910a
mov dword [0x4e75fa], 0x47ec1cc
not esi
xor ebx, esp
sub edi, ecx
mov dword [0x4e7774], 0x15ed488d
dec edx
sub esi, eax
xor esi, edi
or dword [0x4e782e], 0x50ea0d8
add dword [0x4e7874], 0xef6d1fe
not dword [edi]
xor ebx, edx
xor eax, edx
inc esi
xor eax, 0x225548e5
sub dword [0x4e7545], 0x2ba284b0
sub dword [0x4e774f], edx
xchg eax, esi
inc edx
ror esi, 4
sub esi, esp
mov dword [0x4e787a], 0x44dbbe3
inc eax
ror ecx, 0x1f
add edi, dword [0x4e7caa]
ror eax, 0xe
xor esi, eax
xor ecx, eax
neg esi
neg esi
xor ecx, eax
xor esi, eax
rol eax, 0xe
rol ecx, 0x1f
dec eax
xor dword [0x4e777a], 0x8883815
add esi, esp
rol esi, 4
dec edx
xchg eax, esi
xor dword [0x4e7675], 0x28572b2c
invalid
invalid
in eax, 0x48
push ebp

Function at 0x456663
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4cede8
push 0x4cede0
push str.FlsAlloc
push 0x1f
call fcn.004564ce
mov esi, eax
add esp, 0x10
test esi, esi
je 0x456697
push dword [ebp + 8]
mov ecx, esi
call dword [0x46b2fc]
call esi
jmp 0x45669d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x4566e1
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4cedf8
push 0x4cedf0
push str.FlsGetValue
push 0x21
call fcn.004564ce
mov esi, eax
add esp, 0x10
test esi, esi
je 0x456718
push dword [ebp + 8]
mov ecx, esi
call dword [0x46b2fc]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x456720
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4cee00
push 0x4cedf8
push str.FlsSetValue
push 0x22
call fcn.004564ce
mov esi, eax
add esp, 0x10
test esi, esi
je 0x45675a
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x46b2fc]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4603a2
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4e01d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.004548e0
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.004548e0
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x460419
cmp word [ecx], dx
je 0x460419
mov eax, dword [0x4cf9bc]
push edi
dec eax
push eax
push 0x4cf8a8
call fcn.00460341
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x46048c
cmp word [eax], dx
je 0x46048c
mov eax, dword [edi]
test eax, eax
je 0x46043d
cmp word [eax], dx
je 0x46043d
lea eax, [ebp - 0x10]
push eax
call fcn.0045fd24
jmp 0x460446
lea eax, [ebp - 0x10]
push eax
call fcn.0045fdbf
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x4604b6
mov eax, dword [0x4cf8a4]
push dword [ebp - 0x14]
dec eax
push eax
push 0x4cf598
call fcn.00460341
add esp, 0xc
test al, al
je 0x4604b6
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x460481
cmp word [eax], di
je 0x460481
lea eax, [ebp - 0x10]
push eax
call fcn.0045fd24
pop ecx
jmp 0x4604b8
lea eax, [ebp - 0x10]
push eax
call fcn.0045fdbf
jmp 0x46047e
mov eax, dword [edi]
test eax, eax
je 0x4604a3
cmp word [eax], dx
je 0x4604a3
lea eax, [ebp - 0x10]
push eax
call fcn.0045fcd9
pop ecx
jmp 0x4604b6
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x460581
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.004601c6
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x460581
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x460581
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x460581
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x46050e
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.004568fc
test ebx, ebx
je 0x46057c
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.004568fc
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x460581
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x460581
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.004646fa
add esp, 0x10
xor eax, eax
inc eax
jmp 0x460583
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043db84
leave
ret
Function at 0x464d75
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00464cf1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x464ee4
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x464ee4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x464e99
jg 0x464dd1
test eax, eax
je 0x464e8f
push 1
push 0x1000
call fcn.004561cc
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x464df4
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x464e86
push 0x8000
push ebx
call fcn.004517f9
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x464e1d
jg 0x464e18
cmp ecx, 0x1000
jb 0x464e1d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004578b3
add esp, 0x10
cmp eax, 0xffffffff
je 0x464e62
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x464e18
jl 0x464e49
test ecx, ecx
jne 0x464e0a
push dword [ebp - 0xc]
push ebx
call fcn.004517f9
push esi
call fcn.00454bcb
add esp, 0xc
xor ebx, ebx
jmp 0x464ef2
cmp byte [edi + 0x24], 0
je 0x464e79
cmp dword [edi + 0x20], 5
jne 0x464e79
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x464e84
mov ebx, dword [edi + 0x18]
jmp 0x464e86
xor ebx, ebx
push esi
call fcn.00454bcb
pop ecx
jmp 0x464ef2
test ecx, ecx
jg 0x464e5b
jl 0x464e99
test eax, eax
jae 0x464e5b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0045907f
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x464eb9
cmp byte [edi + 0x1c], 0
je 0x464e5b
jmp 0x464eea
push ebx
call fcn.0045e29d
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x464e5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x464ef2
cmp byte [edi + 0x1c], 0
je 0x464eef
mov ebx, dword [edi + 0x18]
jmp 0x464ef2
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0045907f
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4658f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x46591d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x46591d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x408510
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4241e5
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x431080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], vtable.webview::detail::reg_key.0
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionThemesPersonalize
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
cmove ebx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 0
test ebx, ebx
jne 0x408588
xor bl, bl
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], edi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push edi
push edi
push edi
push str.AppsUseLightTheme
push dword [ebp - 0x18]
mov dword [ebp - 0x14], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4085be
cmp eax, 0xea
jne 0x4085fd
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4085db
lea ecx, [ebp - 0xd]
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401900
mov edi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x14]
push eax
push esi
push 0
push 0
push str.AppsUseLightTheme
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4085fd
mov eax, ebx
sub eax, esi
cmovne ebx, esi
sub ebx, esi
cmp ebx, 4
jae 0x408635
test esi, esi
je 0x40862e
sub edi, esi
mov eax, esi
cmp edi, 0x1000
jb 0x408624
mov esi, dword [eax - 4]
add edi, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40867f
push edi
push esi
call fcn.0040c8e4
add esp, 8
mov ebx, 1
jmp 0x40865d
mov ebx, dword [esi]
sub edi, esi
mov eax, esi
cmp edi, 0x1000
jb 0x408653
mov esi, dword [eax - 4]
add edi, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40867f
push edi
push esi
call fcn.0040c8e4
add esp, 8
push dword [ebp - 0x18]
test ebx, ebx
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0041132f
int3
Function at 0x409810
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x431080]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x409840
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0040cc31
add esp, 0x30
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40987d
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x40987d
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0040cc31
add esp, 0x30
ret 4
cmp dword [esi + 0x4c], 0
je 0x409985
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x4098a5
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4098d9
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.00411b1d
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0040cc31
add esp, 0x30
ret 4
lea eax, [esp + 0x10]
mov byte [esp + 0xc], bl
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1d]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x409940
sub eax, 1
je 0x409940
sub eax, 2
jne 0x409985
push dword [esi + 0x4c]
push dword [esp + 0x10]
call fcn.00401820
add esp, 8
or ecx, 0xffffffff
test al, al
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0040cc31
add esp, 0x30
ret 4
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x18]
sub edi, eax
je 0x40995f
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00412494
add esp, 0x10
cmp edi, eax
jne 0x409985
lea ecx, [esp + 0xc]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [esp + 0x14], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0040cc31
add esp, 0x30
ret 4
mov ecx, dword [esp + 0x38]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040cc31
add esp, 0x30
ret 4
Function at 0x40ab10
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
mov ebx, ecx
push esi
mov esi, dword [esp + 0x14]
test eax, eax
jg 0x40ab31
jl 0x40ab27
test esi, esi
jne 0x40ab31
pop esi
xor eax, eax
xor edx, edx
pop ebx
pop ecx
ret 0xc
cmp dword [ebx + 0x38], 0
push ebp
push edi
mov edi, esi
je 0x40abe4
mov ebp, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
nop dword [eax]
mov ecx, ebx
call fcn.004051a0
mov esi, eax
mov eax, edx
mov dword [esp + 0x10], eax
test eax, eax
jl 0x40aba1
jg 0x40ab69
test esi, esi
je 0x40aba1
cmp ebp, eax
jg 0x40ab79
jl 0x40ab73
cmp edi, esi
jae 0x40ab79
mov esi, edi
mov dword [esp + 0x10], ebp
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push dword [esp + 0x20]
call fcn.0040dec0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
sub edi, esi
sbb ebp, dword [esp + 0x10]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x18]
jmp 0x40abc0
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x40abd0
mov eax, dword [esp + 0x18]
add edi, 0xffffffff
mov esi, 1
adc ebp, 0xffffffff
mov byte [eax], cl
add eax, esi
mov dword [esp + 0x18], eax
test ebp, ebp
jg 0x40ab50
jl 0x40abd0
test edi, edi
jne 0x40ab50
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
sub eax, edi
pop edi
sbb edx, ebp
pop ebp
pop esi
pop ebx
pop ecx
ret 0xc
mov eax, dword [ebx + 0x1c]
mov ebp, dword [esp + 0x18]
mov edx, dword [eax]
test edx, edx
je 0x40ac29
mov eax, dword [ebx + 0x2c]
lea ecx, [ebx + 0x2c]
mov dword [esp + 0x10], ecx
mov eax, dword [eax]
test eax, eax
je 0x40ac30
mov edi, dword [esp + 0x1c]
cmp eax, edi
cmovb esi, eax
push esi
push edx
push ebp
call fcn.0040dec0
mov eax, dword [ebx + 0x2c]
add ebp, esi
sub edi, esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0x1c]
jmp 0x40ac30
lea eax, [ebx + 0x2c]
mov dword [esp + 0x10], eax
cmp dword [ebx + 0x4c], 0
je 0x40ac99
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x40ac5a
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov dword [eax], edx
cmp edi, 0xfff
jbe 0x40ac84
push dword [ebx + 0x4c]
push 0xfff
push 1
push ebp
call fcn.00411e0d
add esp, 0x10
add ebp, eax
sub edi, eax
cmp eax, 0xfff
jne 0x40ac99
cmp edi, eax
ja 0x40ac62
test edi, edi
je 0x40ac99
push dword [ebx + 0x4c]
push edi
push 1
push ebp
call fcn.00411e0d
add esp, 0x10
sub edi, eax
mov edx, dword [esp + 0x20]
sub esi, edi
pop edi
pop ebp
mov eax, esi
sbb edx, 0
pop esi
pop ebx
pop ecx
ret 0xc
Function at 0x40ad90
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov dword [esp + 0x10], ebp
cmp dword [ebp + 0x38], 0
je 0x40ae68
mov edx, dword [esp + 0x30]
mov ebx, edx
mov ecx, dword [esp + 0x2c]
mov edi, ecx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x28], eax
test edx, edx
jl 0x40ae58
jg 0x40add0
test ecx, ecx
je 0x40ae58
nop dword [eax]
mov ecx, ebp
call fcn.004053c0
mov ebp, edx
mov esi, eax
test ebp, ebp
jl 0x40ae1e
jg 0x40ade5
test esi, esi
je 0x40ae1e
cmp ebx, ebp
jg 0x40adf3
jl 0x40adef
cmp edi, esi
jae 0x40adf3
mov esi, edi
mov ebp, ebx
mov eax, dword [esp + 0x28]
push esi
push eax
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x20]
push dword [eax]
call fcn.0040dec0
add esp, 0xc
sub edi, esi
sbb ebx, ebp
mov ebp, dword [esp + 0x10]
mov eax, dword [ebp + 0x30]
sub dword [eax], esi
mov eax, dword [ebp + 0x20]
add dword [eax], esi
jmp 0x40ae42
mov ebp, dword [esp + 0x10]
mov ecx, ebp
mov eax, dword [esp + 0x28]
mov edx, dword [ebp]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x40ae50
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x28], esi
test ebx, ebx
jg 0x40add0
jl 0x40ae50
test edi, edi
jne 0x40add0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
sub ecx, edi
pop edi
pop esi
pop ebp
sbb edx, ebx
mov eax, ecx
pop ebx
add esp, 0x14
ret 0xc
mov eax, dword [ebp + 0x20]
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov dword [esp + 0x1c], esi
mov ecx, dword [eax]
lea eax, [ebp + 0x30]
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x40ae92
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x40ae98
xor ecx, ecx
mov dword [esp + 0x14], eax
mov eax, ecx
cdq
mov dword [esp + 0x2c], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x40af00
jg 0x40aeaf
test esi, esi
je 0x40af00
test ecx, ecx
jl 0x40aefa
jg 0x40aeb9
test eax, eax
je 0x40aefa
cmp edi, ecx
jg 0x40aecd
jl 0x40aec3
cmp esi, eax
jae 0x40aecd
mov eax, esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x10], edi
mov ebx, dword [esp + 0x28]
push eax
push ebx
push dword [esp + 0x20]
call fcn.0040dec0
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [esp + 0x2c]
add ebx, ecx
sub esi, ecx
mov eax, dword [eax]
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebp + 0x20]
add dword [eax], ecx
jmp 0x40af04
mov ebx, dword [esp + 0x28]
jmp 0x40af0e
mov ebx, dword [esp + 0x28]
test edi, edi
jl 0x40af27
jg 0x40af0e
test esi, esi
je 0x40af27
mov eax, dword [ebp + 0x4c]
test eax, eax
je 0x40af27
push eax
push esi
push 1
push ebx
call fcn.00412494
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
Function at 0x40d30a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40d349
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40d349
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40d349
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40d349
cmp dword [ecx + 0x74], 0xe
jbe 0x40d349
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x418c1c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00418a92

Function at 0x4234b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4234dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4234dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret