joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424d10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446a00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.00425760
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x320]
mov eax, dword [ebp + 8]
cmp dword [edx + eax*4], 0
je 0x424dbb
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x320]
mov eax, dword [ebp + 8]
mov ecx, dword [edx + eax*4]
mov edx, dword [ecx + 0x34]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x320]
mov edx, dword [ebp + 8]
mov eax, dword [ecx + edx*4]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0
je 0x424d95
push 1
mov ecx, dword [ebp - 0x1c]
call fcn.00425d70
mov dword [ebp - 0x30], eax
jmp 0x424d9c
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x320]
mov ecx, dword [ebp + 8]
mov dword [eax + ecx*4], 0
push 0
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x178
call fcn.0042f418
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0
je 0x424de5
mov ecx, dword [ebp - 0x20]
call fcn.00421ca0
mov dword [ebp - 0x24], eax
jmp 0x424dec
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x320]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov dword [eax + ecx*4], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x48], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov dword [edx + 0x150], eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x44], 1
mov edx, dword [ebp + 0x14]
and edx, 1
je 0x424e41
mov dword [ebp - 0x28], 1
jmp 0x424e48
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x31c]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00421d90
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x50], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x54], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x58], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x5c], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x60], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42c590
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
cmp dword [ebp + 0x14], 0
jge 0x42c5c6
push 0x447b50
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042c300
add esp, 8
push eax
call fcn.0042e81b
add esp, 8
mov dword [ebp - 4], eax
jmp 0x42c5e7
push 0x447b58
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0042c300
add esp, 8
push eax
call fcn.0042e81b
add esp, 8
mov dword [ebp - 4], eax
lea ecx, [ebp - 8]
push ecx
call fcn.0042c380
add esp, 4
cmp dword [ebp - 4], 0
jne 0x42c5fe
or eax, 0xffffffff
jmp 0x42c64a
cmp dword [ebp + 0x14], 0
jl 0x42c616
push 0
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.0042e105
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 1
mov eax, dword [ebp + 0xc]
push eax
call fcn.0042e6dd
add esp, 0x10
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042dc95
add esp, 4
mov edx, dword [ebp - 8]
push edx
call fcn.0042e8fa
add esp, 4
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x42cc30
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042c300
add esp, 8
push eax
call fcn.0043343f
add esp, 4
mov dword [ebp - 8], eax
lea edx, [ebp - 4]
push edx
call fcn.0042c380
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x42ccd0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042c300
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 8], eax
lea edx, [ebp - 4]
push edx
call fcn.0042c380
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x42cd10
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042c300
add esp, 8
mov dword [ebp - 8], 0
mov edx, dword [ebp + 0x10]
and edx, 1
je 0x42cd48
mov eax, dword [ebp - 8]
or eax, 0x10
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
and ecx, 2
je 0x42cd59
mov edx, dword [ebp - 8]
or edx, 6
mov dword [ebp - 8], edx
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x278]
push eax
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0042c300
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
push eax
call fcn.0042e8fa
add esp, 4
cmp dword [ebp - 0x10], 0xffffffff
jne 0x42cd9a
xor eax, eax
jmp 0x42cede
mov ecx, 1
test ecx, ecx
je 0x42ced1
mov edx, dword [ebp - 0x278]
and edx, dword [ebp - 8]
jbe 0x42cdbb
mov dword [ebp - 0x20], 1
jmp 0x42cdc2
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x10]
and ecx, 4
jne 0x42cdec
cmp dword [ebp - 0x18], 0
jne 0x42cddf
mov dword [ebp - 0x24], 1
jmp 0x42cde6
mov dword [ebp - 0x24], 0
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0
je 0x42ceb5
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xc], 1
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.0042c3a0
add esp, 8
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x42ce27
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
cmp eax, 0x2e
jne 0x42ce79
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp - 4]
movsx eax, byte [edx + ecx]
test eax, eax
jne 0x42ce4c
mov dword [ebp - 0xc], 0
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp - 4]
movsx eax, byte [edx + ecx]
cmp eax, 0x2e
jne 0x42ce79
mov ecx, 1
shl ecx, 1
mov edx, dword [ebp - 4]
movsx eax, byte [edx + ecx]
test eax, eax
jne 0x42ce79
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
je 0x42cea9
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040ef80
add esp, 8
push 0x447b60
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040ef80
add esp, 8
lea edx, [ebp - 4]
push edx
call fcn.0042c420
add esp, 4
lea eax, [ebp - 0x278]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x42cecc
jmp 0x42ced1
jmp 0x42cd9a
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x441f67
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x457ce0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00440033
mov dword [ebp - 0x14], eax
cmp dword [0x45afec], esi
jne 0x44205a
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x441fe7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x44213a
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x44213a
push 0x450288
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44213a
push eax
call ebx
push 0x450294
push edi
mov dword [0x45afec], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x45aff0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x45aff4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x45affc], eax
test eax, eax
je 0x442057
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x45aff8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x44207f
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x442072
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x442094
push 4
pop eax
jmp 0x44213c
cmp dword [ebp - 0x14], esi
je 0x442094
push dword [0x45afec]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x442079
mov eax, dword [0x45aff8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4420f2
cmp dword [0x45affc], edi
je 0x4420f2
push eax
call ebx
push dword [0x45affc]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4420f2
test eax, eax
je 0x4420f2
call ecx
test eax, eax
je 0x4420e7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4420e7
test byte [ebp - 8], 1
jne 0x4420f2
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x442122
mov eax, dword [0x45aff0]
cmp eax, edi
je 0x44211f
push eax
call ebx
test eax, eax
je 0x44211f
call eax
mov esi, eax
test esi, esi
je 0x44211f
mov eax, dword [0x45aff4]
cmp eax, edi
je 0x44211f
push eax
call ebx
test eax, eax
je 0x44211f
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x45afec]
call ebx
test eax, eax
je 0x44213a
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x44213c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00434ee2
mov esp, ebp
pop ebp
ret
Function at 0x4011b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x430020]
lea eax, [ebp - 4]
cmp dword [ebp + 0xc], ecx
push 0
cmovb ecx, dword [ebp + 0xc]
push eax
push ecx
push dword [ebp + 8]
push dword [0x430004]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4011f9
push str.Error_occurred_while_reading_from_COM_port
push 0xf7
push str.rx_data
push eax
call fcn.00401c10
add esp, 0x10
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
test eax, eax
je 0x401205
mov dword [eax], ecx
push ecx
push str.Received__d_bytes
push 0x127
push str.rx_data
push 1
call fcn.00401c10
mov eax, dword [ebp - 4]
add esp, 0x14
add dword [0x43000c], eax
cmp dword [0x430038], 1
jle 0x401243
push dword [0x430028]
push eax
push dword [ebp + 8]
call fcn.00402660
add esp, 0xc
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x401250
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
push edi
push str.Transmitting__d_bytes
push 0xcc
push str.tx_data
push 1
call fcn.00401c10
mov ebx, dword [ebp + 8]
add esp, 0x14
cmp dword [0x430038], 1
jle 0x401291
push dword [0x430028]
push edi
push ebx
call fcn.00402660
add esp, 0xc
test edi, edi
je 0x4012c6
mov ecx, dword [0x430024]
mov eax, edi
sub eax, esi
cmp eax, ecx
push 0
cmovb ecx, eax
lea eax, [ebp + 0xc]
push eax
push ecx
lea eax, [esi + ebx]
push eax
push dword [0x430004]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4012f6
add esi, dword [ebp + 0xc]
cmp esi, edi
jb 0x401295
mov eax, dword [0x430008]
add eax, esi
push eax
push str.Total_bytes_sent_so_far:__d
push 0xec
push str.tx_data
push 1
mov dword [0x430008], eax
call fcn.00401c10
add esp, 0x14
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret
push str.Error_occurred_while_writing_to_COM_port
push 0xd6
push str.tx_data
push 0
call fcn.00401c10
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x403300
Capabilities:
Create directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x858
mov eax, dword [0x430074]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x430040]
xor ecx, ecx
cmp dword [0x430054], 0xffffffff
xorps xmm0, xmm0
mov edx, dword [0x430044]
push ebx
mov ebx, dword [0x43003c]
mov dword [ebp - 0x82c], eax
mov eax, 1
push esi
mov dword [ebp - 0x844], ecx
mov dword [ebp - 0x818], ecx
mov dword [ebp - 0x850], ecx
cmovne ecx, eax
push edi
movlpd qword [ebp - 0x834], xmm0
or edi, 0xffffffff
mov esi, dword [ebp - 0x834]
xor eax, eax
mov dword [ebp - 0x820], ecx
mov ecx, dword [ebp - 0x830]
mov dword [ebp - 0x84c], 4
mov dword [ebp - 0x81c], ebx
mov dword [ebp - 0x810], edx
mov dword [ebp - 0x814], 0
mov dword [ebp - 0x824], eax
mov dword [0x430048], eax
mov dword [ebp - 0x80c], ecx
mov dword [ebp - 0x808], esi
lea esp, [esp]
jmp dword [eax*4 + 0x404774]
Function at 0x404bd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [0x43003c]
push esi
push edi
push dword [0x430050]
call fcn.004023b0
mov esi, eax
add esp, 4
xor edi, edi
cmp esi, 0xffffffff
jne 0x404c16
push str.Could_not_get_file_info.
push 0x48b
push str.start_image_transfer
push 0
call fcn.00401c10
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x10]
push 0
push eax
push str.start_image_transfer:_Offset__ld
push 0x496
push str.start_image_transfer
push 1
mov dword [ebp - 4], eax
call fcn.00401c10
push 0
push dword [ebp - 4]
push str.start_image_transfer:_Offset_0x_X
push 0x497
push str.start_image_transfer
push 1
call fcn.00401c10
xor eax, eax
push eax
push ebx
push str.start_image_transfer:_Length__ld
push 0x498
push str.start_image_transfer
push 1
call fcn.00401c10
add esp, 0x48
xor eax, eax
push eax
push ebx
push str.start_image_transfer:_Length_0x_X
push 0x499
push str.start_image_transfer
push 1
call fcn.00401c10
add esp, 0x18
test ebx, ebx
jne 0x404c95
xor eax, eax
je 0x404cbd
cmp esi, 1
jne 0x404d08
push dword [0x430050]
call fcn.00402310
add esp, 4
mov edx, ebx
add edx, dword [ebp - 4]
mov ecx, edi
adc ecx, ecx
test ecx, ecx
ja 0x404cbb
jb 0x404d08
cmp edx, eax
jbe 0x404d08
xor eax, eax
push eax
push ebx
push str.Invalid_length__ld_bytes_request_to_be_transmitted
push 0x4a0
push str.start_image_transfer
push 0
call fcn.00401c10
push dword [0x430050]
call fcn.00402310
push eax
push 0
push dword [ebp - 4]
push str.File_offset__ld__file_size__d
push 0x4a1
push str.start_image_transfer
push 0
call fcn.00401c10
add esp, 0x38
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push dword [ebp - 4]
push dword [0x430050]
call fcn.004074a2
add esp, 0xc
test ebx, ebx
je 0x404d64
nop
mov eax, ebx
mov esi, 0x100000
sub eax, edi
cmp eax, esi
cmovb esi, eax
push esi
push dword [0x430040]
push dword [0x430050]
call fcn.004174cd
add esp, 0xc
test eax, eax
js 0x404dab
cmp eax, esi
jne 0x404d85
push esi
push dword [0x430040]
call fcn.00401250
add esp, 8
test eax, eax
je 0x404d76
add edi, esi
cmp edi, ebx
jb 0x404d20
add dword [0x43004c], ebx
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.Tx_Sahara_Image_Failed
push 0x4b7
jmp 0x404bfe
xor ecx, ecx
push ecx
push ebx
push eax
push str.Read__d_bytes__but_was_asked_for__ld_bytes
push 0x4b1
push str.start_image_transfer
push ecx
call fcn.00401c10
add esp, 0x1c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00406015
push dword [eax]
call fcn.00405e60
push eax
push str.file_read_failed:__s
push 0x4ad
push str.start_image_transfer
push 0
call fcn.00401c10
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404de0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [0x43003c]
push esi
push edi
push dword [0x430050]
mov dword [ebp - 4], ebx
call fcn.004023b0
mov esi, eax
add esp, 4
xor edi, edi
cmp esi, 0xffffffff
jne 0x404e2b
push str.Could_not_get_file_info.
push 0x44a
push str.start_image_transfer_64bit
push 0
call fcn.00401c10
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x10]
mov eax, dword [ebp - 4]
mov ebx, dword [ebx + 0x18]
push edx
push ecx
mov eax, dword [eax + 0x1c]
push str.start_image_transfer_64bit:_Offset__ld
push 0x454
push str.start_image_transfer_64bit
push 1
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
call fcn.00401c10
push dword [ebp - 0xc]
push dword [ebp - 8]
push str.start_image_transfer_64bit:_Offset_0x_X
push 0x455
push str.start_image_transfer_64bit
push 1
call fcn.00401c10
push dword [ebp - 4]
push ebx
push str.start_image_transfer_64bit:_Length__ld
push 0x456
push str.start_image_transfer_64bit
push 1
call fcn.00401c10
add esp, 0x48
push dword [ebp - 4]
push ebx
push str.start_image_transfer_64bit:_Length_0x_X
push 0x457
push str.start_image_transfer_64bit
push 1
call fcn.00401c10
add esp, 0x18
test ebx, ebx
jne 0x404ebc
mov eax, dword [ebp - 4]
test eax, eax
je 0x404ee7
cmp esi, 1
jne 0x404f33
push dword [0x430050]
call fcn.00402310
mov ecx, dword [ebp - 4]
add esp, 4
mov edx, ebx
add edx, dword [ebp - 8]
adc ecx, dword [ebp - 0xc]
test ecx, ecx
ja 0x404ee4
jb 0x404f33
cmp edx, eax
jbe 0x404f33
mov eax, dword [ebp - 4]
push eax
push ebx
push str.Invalid_length__ld_bytes_request_to_be_transmitted
push 0x45e
push str.start_image_transfer_64bit
push 0
call fcn.00401c10
push dword [0x430050]
call fcn.00402310
push eax
push dword [ebp - 0xc]
push dword [ebp - 8]
push str.File_offset__ld__file_size__d
push 0x45f
push str.start_image_transfer_64bit
push 0
call fcn.00401c10
add esp, 0x38
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push dword [ebp - 8]
push dword [0x430050]
call fcn.004074a2
add esp, 0xc
test ebx, ebx
je 0x404f94
lea ebx, [ebx]
mov eax, ebx
mov esi, 0x100000
sub eax, edi
cmp eax, esi
cmovb esi, eax
push esi
push dword [0x430040]
push dword [0x430050]
call fcn.004174cd
add esp, 0xc
test eax, eax
js 0x404fdc
cmp eax, esi
jne 0x404fb5
push esi
push dword [0x430040]
call fcn.00401250
add esp, 8
test eax, eax
je 0x404fa6
add edi, esi
cmp edi, ebx
jb 0x404f50
add dword [0x43004c], ebx
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.Tx_Sahara_Image_Failed
push 0x475
jmp 0x404e13
push dword [ebp - 4]
push ebx
push eax
push str.Read__d_bytes__but_was_asked_for__ld_bytes
push 0x46f
push str.start_image_transfer_64bit
push 0
call fcn.00401c10
add esp, 0x1c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00406015
push dword [eax]
call fcn.00405e60
push eax
push str.file_read_failed:__s
push 0x46b
push str.start_image_transfer_64bit
push 0
call fcn.00401c10
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4182fb
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x430074]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040b41a
mov dword [ebp - 0x14], eax
cmp dword [0x4327a4], esi
jne 0x4183ee
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x41837b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4184ce
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4184ce
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4184ce
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4327a4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4327a8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4327ac], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4327b4], eax
test eax, eax
je 0x4183eb
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4327b0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x418413
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x418406
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x418428
push 4
pop eax
jmp 0x4184d0
cmp dword [ebp - 0x14], esi
je 0x418428
push dword [0x4327a4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x41840d
mov eax, dword [0x4327b0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x418486
cmp dword [0x4327b4], edi
je 0x418486
push eax
call ebx
push dword [0x4327b4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x418486
test eax, eax
je 0x418486
call ecx
test eax, eax
je 0x41847b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41847b
test byte [ebp - 8], 1
jne 0x418486
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4184b6
mov eax, dword [0x4327a8]
cmp eax, edi
je 0x4184b3
push eax
call ebx
test eax, eax
je 0x4184b3
call eax
mov esi, eax
test esi, esi
je 0x4184b3
mov eax, dword [0x4327ac]
cmp eax, edi
je 0x4184b3
push eax
call ebx
test eax, eax
je 0x4184b3
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4327a4]
call ebx
test eax, eax
je 0x4184ce
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4184d0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004052f3
mov esp, ebp
pop ebp
ret
Function at 0x1eb67e8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1eb67f2
pushal
call 0x1eb67f8
pop ebp
sub ebp, 0x10
sub ebp, 0x1ab67e8
jmp 0x1eb680e
mov eax, 0x1ab67e8
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b5
mov edx, 0x87817c9
xor byte [eax], dl
inc eax
dec ecx
jne 0x1eb6825
jmp 0x1eb6838
inc edx
add al, 0x42
inc eax
cmc
leave
leave
leave
dec eax
or byte [ecx], dh
leave
leave
leave
retf 0x7104