joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c0b6ae
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x41c0b6e6
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.41c07a3b
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.41c07a13
jmp 0x41c0b6f2
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x41c0d4b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x41c0d4f2
call fcn.41c1c01e
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x41c0d4f2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x41c0d4e9
xor eax, eax
jmp 0x41c0d4fa
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.41c0d500
pop edi
pop esi
pop ebx
ret 4
Function at 0x41c0f201
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x41c2dbf0
call fcn.41bea8d4
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.41c1c01e
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x41c0f240
call fcn.41c1c01e
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41c0f24e
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x41c0f25c
or eax, 0xffffffff
jmp 0x41c0f344
mov ecx, esi
call fcn.41c0f177
mov dword [ebp - 0x14], eax
call fcn.41c0b1b6
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x41c0f293
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x41c0f293
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.41c0b16a
push dword [ebp - 0x14]
call fcn.41c0acb7
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.41c0ee92
cmp eax, edi
je 0x41c0f306
test byte [esi + 0x24], 0x10
je 0x41c0f2d4
push 4
mov ecx, esi
pop ebx
call fcn.41c0e01d
test ah, 1
je 0x41c0f2cc
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.41c0d707
cmp dword [esi + 0x1c], edi
je 0x41c0f306
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.41c0e1a9
jmp 0x41c0f306
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x41c0f31a
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x41c0f333
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x41c0f333
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.41c0f1b1
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x401060
Capabilities:
Bypass uac via icmluautil

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x407004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x230]
push esi
push edi
mov dword [ebp - 0x234], 0
mov ecx, 0x24
nop
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x401090
movups xmm0, xmmword [0x404270]
mov ax, word [0x4042a8]
lea edi, [ebp - 0x20c]
mov dword [ebp - 0x230], 0x24
add edi, 0xfffffffe
movups xmmword [ebp - 0x20c], xmm0
mov dword [ebp - 0x21c], 4
movups xmm0, xmmword [0x404280]
mov word [ebp - 0x1d4], ax
movups xmmword [ebp - 0x1fc], xmm0
movups xmm0, xmmword [0x404290]
movups xmmword [ebp - 0x1ec], xmm0
movq xmm0, qword [0x4042a0]
movq qword [ebp - 0x1dc], xmm0
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x401100
mov ecx, 0x13
lea eax, [ebp - 0x234]
mov esi, str.3E5FC7F9_9A51_4367_9063_A120244FBEC7
rep movsd dword es:[edi], dword [esi]
push eax
push 0x404408
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x20c]
movsw word es:[edi], word [esi]
push eax
call dword [sym.imp.ole32.dll_CoGetObject]
mov ecx, dword [ebp - 0x234]
mov dword [ebx], ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004027af
mov esp, ebp
pop ebp
ret
Function at 0x4014a0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, eax
test ebx, ebx
je 0x40151d
push esi
mov esi, ebx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4014b3
sub esi, ecx
sar esi, 1
push edi
lea eax, [esi*2 + 2]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x401517
push esi
push ebx
lea eax, [esi + 1]
push eax
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
add esp, 0x10
cmp word [edi], 0x22
jne 0x401517
cmp word [edi + esi*2 - 2], 0x22
jne 0x401517
xor eax, eax
mov word [edi + esi*2 - 2], ax
lea eax, [esi - 4]
push eax
lea eax, [edi + 2]
push eax
push edi
call dword [sym.imp.VCRUNTIME140.dll_memmove]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x401760
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
mov eax, dword [0x407004]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [str.C:WindowsSystem32kernel32.dll]
mov ax, word [0x4043d8]
push esi
movups xmmword [ebp - 0x194], xmm0
push edi
movups xmm0, xmmword [0x4043a8]
push 0x14e
mov word [ebp - 0x154], ax
lea eax, [ebp - 0x152]
movups xmmword [ebp - 0x184], xmm0
push 0
movups xmm0, xmmword [0x4043b8]
push eax
movups xmmword [ebp - 0x174], xmm0
movups xmm0, xmmword [0x4043c8]
movups xmmword [ebp - 0x164], xmm0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
push esi
call fcn.004027fd
add esp, 4
mov edi, eax
lea eax, [ebp - 0x194]
push edi
push esi
push 0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x40185a
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x1a0]
push eax
push 0x4043dc
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x40185a
cmp dword [ebp - 0x198], 0
je 0x40185a
mov eax, dword [ebp - 0x1a0]
mov ecx, dword [eax + 0x10]
mov eax, ecx
shr eax, 0x10
cmp eax, 0xa
jne 0x40185a
test cx, cx
jne 0x40185a
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004027af
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004027af
mov esp, ebp
pop ebp
ret
Function at 0x402690
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
movaps xmm1, xmmword [0x4057e0]
xor ecx, ecx
movd xmm0, ecx
lea eax, [ecx + 4]
pshufd xmm0, xmm0, 0
paddd xmm0, xmm1
movups xmmword [ebp + ecx*4 - 0x40], xmm0
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmm1
movups xmmword [ebp + ecx*4 - 0x30], xmm0
add ecx, 8
cmp ecx, 0x10
jl 0x4026b4
mov eax, dword [0x407400]
xor edi, edi
nop word [eax + eax]
mov ecx, eax
lea edx, [ebp - 0x40]
shl ecx, 0xd
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
xor eax, ecx
mov ecx, eax
shl ecx, 5
xor eax, ecx
mov ecx, eax
and ecx, 0xf
mov esi, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
mov ecx, dword [ebp + edi*4 - 0x40]
mov dword [edx], ecx
mov dword [ebp + edi*4 - 0x40], esi
inc edi
cmp edi, 0x10
jl 0x4026f0
push 0x4021d0
mov dword [0x407400], eax
call fcn.004020d0
add esp, 4
push 0x402260
call fcn.004020d0
add esp, 4
push 0x4022a0
call fcn.004020d0
add esp, 4
push 0x4023c0
call fcn.004020d0
add esp, 4
push 0x402400
call fcn.004020d0
add esp, 4
push 0x4024c0
call fcn.004020d0
add esp, 4
push 0x402560
call fcn.004020d0
add esp, 4
push 0x4025b0
call fcn.004020d0
add esp, 4
push 0x4025f0
call fcn.004020d0
add esp, 4
push 0x402640
call fcn.004020d0
add esp, 4
jmp 0x4026ab

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40d4b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x20
call fcn.004f6757
mov esi, eax
add esp, 4
mov dword [ebp - 4], esi
test esi, esi
jne 0x40d4dd
push str.spunpg_init:_Memory_allocation_failed__sp_
push 0x1f4
call dword [0x601ac8]
add esp, 8
cmp dword [0x5c9828], 0
jne 0x40d4f5
mov dword [0x5c9828], 1
call fcn.0040d9f0
mov edi, dword [ebp + 8]
push 0x5231b8
push dword [edi]
call fcn.0050638e
add esp, 8
mov dword [esi], eax
test eax, eax
jne 0x40d52d
call fcn.004f6c72
push dword [eax]
call fcn.004f6d4a
push eax
push dword [edi + 8]
push str.Cannot_open__s:__s_n
push 5
call dword [0x601ac8]
add esp, 0x14
mov ecx, dword [edi + 8]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d533
sub ecx, edx
lea eax, [ecx + 3]
push eax
call fcn.004f6757
mov ebx, eax
add esp, 4
mov dword [esi + 8], ebx
test ebx, ebx
jne 0x40d564
push str.spunpg_init:_Memory_allocation_failed__sp__dirname_
push 0x1f4
call dword [0x601ac8]
add esp, 8
mov ecx, dword [edi + 8]
mov edx, ebx
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x40d570
push 0x2e
push ebx
call fcn.004f2320
add esp, 8
test eax, eax
jne 0x40d59e
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d592
sub ecx, edx
lea eax, [ecx + ebx]
mov byte [eax], 0
lea ecx, [ebx - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x40d5a4
mov ax, word [0x523204]
mov word [ecx], ax
mov al, byte [0x523206]
push ebx
mov byte [ecx + 2], al
call fcn.004f6e95
add esp, 4
test eax, eax
je 0x40d5f4
call fcn.004f6c72
cmp dword [eax], 0x11
je 0x40d5f4
call fcn.004f6c72
push dword [eax]
call fcn.004f6d4a
push eax
push ebx
push str.Cannot_create__s:__s_n
push 5
call dword [0x601ac8]
add esp, 0x14
mov ecx, ebx
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d600
sub ecx, edx
lea eax, [ecx + 0xd]
push eax
call fcn.004f6757
mov ecx, ebx
mov edi, eax
add esp, 4
mov dword [esi + 0xc], edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d620
sub ecx, edx
lea eax, [ecx + 0xd]
push eax
call fcn.004f6757
mov esi, eax
add esp, 4
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], esi
test edi, edi
je 0x40d645
test esi, esi
jne 0x40d65b
push str.spunpg_init:_Memory_allocation_failed__sp__pngfile_
push 0x1f4
call dword [0x601ac8]
mov eax, dword [ebp - 4]
add esp, 8
push 0
push ebx
push str._s_sub_04d.png
push edi
mov dword [eax + 0x14], 0
call fcn.004071a0
push 0x2f
push ebx
call fcn.004f2320
add esp, 0x18
test eax, eax
jne 0x40d6a0
push 0x5c
push ebx
call fcn.004f2320
add esp, 8
test eax, eax
jne 0x40d6a0
nop
mov al, byte [edi]
lea edi, [edi + 1]
mov byte [esi], al
lea esi, [esi + 1]
test al, al
jne 0x40d690
jmp 0x40d6b2
push 0
inc eax
push eax
push str._s_sub_04d.png
push esi
call fcn.004071a0
add esp, 0x10
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov dword [eax + 0x18], 0x58
mov dword [eax + 0x1c], 0x2e
mov esp, ebp
pop ebp
ret
Function at 0x40f020
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x794
mov eax, dword [0x5c8eb4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x51b61c
push 0
call fcn.004f7459
push 0x602240
call fcn.0045b120
lea eax, [ebp - 0x794]
mov ecx, 0x1e4
mov esi, 0x602240
lea edi, [ebp - 0x794]
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.00470980
push ebx
push dword [ebp + 8]
push 0x602240
call fcn.0047f170
add esp, 0x1c
cmp eax, 2
jne 0x40f0c7
call fcn.00482d30
push str._This_help_screen_was_shown_because_there_were_no_input_files__n
push 2
call fcn.0048eb50
add esp, 8
sub esp, 0x790
mov ecx, 0x1e4
mov esi, 0x602240
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.0040e3d0
add esp, 0x790
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f01b3
mov esp, ebp
pop ebp
ret
cmp eax, 9
jne 0x40f0df
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f01b3
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x40f097
push eax
call fcn.004f72e5
int3

Function at 0x413d00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x20], 0
jne 0x413d4b
mov edx, dword [esi + 0x10]
push edi
mov edi, dword [esi + 0x14]
cmp edi, dword [esi + 0xc]
jb 0x413d35
ja 0x413d20
cmp edx, dword [esi + 8]
jb 0x413d35
mov eax, dword [esi + 0x24]
test eax, eax
je 0x413d2f
push dword [esi + 0x28]
call eax
add esp, 4
pop edi
xor al, al
pop esi
pop ebp
ret
mov ecx, dword [esi + 4]
mov al, byte [ecx + edx]
add edx, 1
mov dword [esi + 0x10], edx
adc edi, 0
mov dword [esi + 0x14], edi
pop edi
pop esi
pop ebp
ret
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x413d7c
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x413d7c
push dword [esi]
push ecx
push 1
push eax
call fcn.004f88b9
add esp, 0x10
mov dword [esi + 0x34], 0
add dword [esi + 8], eax
adc dword [esi + 0xc], 0
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
push dword [esi]
call fcn.004f850d
add esp, 4
test eax, eax
jne 0x413d9e
add dword [esi + 0x10], 1
push dword [esi]
adc dword [esi + 0x14], eax
call fcn.004f857f
add esp, 4
pop esi
pop ebp
ret
mov eax, dword [esi + 0x24]
test eax, eax
je 0x413db2
push dword [esi + 0x28]
call eax
add esp, 4
xor al, al
pop esi
pop ebp
ret
push 1
push 0
call fcn.00434d10
add esp, 8
test eax, eax
je 0x413dd8
push 0
push 1
call fcn.00434cf0
push str._BS__Attempt_to_overread_bitstream_n
call fcn.00434ca0
add esp, 0xc
xor al, al
pop esi
pop ebp
ret

Function at 0x414080
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x34]
test eax, eax
je 0x4140b3
push dword [esi]
push eax
push 1
push dword [esi + 0x2c]
call fcn.004f88b9
add esp, 0x10
mov dword [esi + 0x34], 0
add dword [esi + 8], eax
adc dword [esi + 0xc], 0
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
pop esi
pop ebp
ret
Function at 0x4141f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x41424b
cmp dword [esi + 0x20], 4
jne 0x414211
mov eax, dword [esi + 4]
test eax, eax
je 0x414211
push eax
call fcn.004f6752
add esp, 4
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x414242
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x414242
push dword [esi]
push ecx
push 1
push eax
call fcn.004f88b9
add esp, 0x10
mov dword [esi + 0x34], 0
add dword [esi + 8], eax
adc dword [esi + 0xc], 0
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
push esi
call fcn.004f6752
add esp, 4
pop esi
pop ebp
ret

Function at 0x414440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x20], 1
jbe 0x4144b5
mov eax, dword [ebx + 0x2c]
test eax, eax
je 0x41447e
mov ecx, dword [ebx + 0x34]
test ecx, ecx
je 0x41447e
push dword [ebx]
push ecx
push 1
push eax
call fcn.004f88b9
add esp, 0x10
mov dword [ebx + 0x34], 0
add dword [ebx + 8], eax
adc dword [ebx + 0xc], 0
add dword [ebx + 0x10], eax
adc dword [ebx + 0x14], 0
push esi
push edi
push dword [ebx]
call fcn.0044abb0
push 2
push 0
push 0
push dword [ebx]
mov edi, eax
mov esi, edx
call fcn.0044ab90
push dword [ebx]
call fcn.0044abb0
push 0
push esi
push edi
push dword [ebx]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], edx
call fcn.0044ab90
add esp, 0x28
pop edi
pop esi
mov edx, dword [ebx + 0xc]
mov eax, dword [ebx + 8]
pop ebx
pop ebp
ret
Function at 0x414680
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x10]
mov edx, ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
add edx, eax
mov ecx, dword [esi + 0x14]
mov dword [ebp - 4], eax
mov eax, 0
adc eax, ecx
cmp eax, dword [esi + 0xc]
jb 0x4146b6
ja case.default.0x4146de
cmp edx, dword [esi + 8]
jbe 0x4146b6
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x20]
mov eax, ecx
sub eax, 0
je 0x4146cc
sub eax, 2
je 0x4146cc
xor eax, eax
cmp dword [esi + 0x1c], eax
jmp 0x4146d2
xor eax, eax
cmp dword [esi + 0x1c], 8
sete al
test eax, eax
je 0x41473b
cmp ecx, 4
ja case.default.0x4146de
jmp dword [ecx*4 + 0x4147a4]
mov ecx, dword [esi + 4]
add ecx, dword [esi + 0x10]
push ebx
push ecx
push dword [ebp + 0xc]
call fcn.004f1320
add esp, 0xc
mov eax, ebx
add dword [esi + 0x10], ebx
adc dword [esi + 0x14], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x2c], 0
je 0x414716
push esi
call fcn.00414080
add esp, 4
push dword [esi]
push ebx
push 1
push dword [ebp + 0xc]
call fcn.004f7782
mov ecx, eax
add esp, 0x10
test ecx, ecx
js case.default.0x4146de
cdq
add dword [esi + 0x10], eax
mov eax, ecx
adc dword [esi + 0x14], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x414796
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], eax
push edi
dec ebx
mov edi, 8
mov dword [ebp + 0x10], ebx
xor ebx, ebx
dec edi
add ebx, ebx
cmp dword [esi + 0x1c], 8
jne 0x414770
push esi
call fcn.00413d00
movzx eax, al
add esp, 4
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 0
shl dword [esi + 0x18], 1
mov eax, dword [esi + 0x18]
inc dword [esi + 0x1c]
shr eax, 8
and eax, 1
or ebx, eax
test edi, edi
jne 0x414751
mov eax, dword [ebp + 8]
mov byte [eax], bl
inc eax
mov ebx, dword [ebp + 0x10]
mov dword [ebp + 8], eax
test ebx, ebx
jne 0x414746
pop edi
mov eax, dword [esi + 0x10]
sub eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x414be0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
jne 0x414bf2
xor eax, eax
pop esi
pop ebp
ret
cmp dword [esi + 0x20], 3
jne 0x414bed
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x414c23
push eax
push ecx
push 1
push dword [esi + 0x2c]
call fcn.004f88b9
add esp, 0x10
mov dword [esi + 0x34], 0
add dword [esi + 8], eax
adc dword [esi + 0xc], 0
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
push edi
mov edi, dword [ebp + 0xc]
push edi
push dword [esi + 0x2c]
call fcn.004f6762
add esp, 8
mov dword [esi + 0x2c], eax
test eax, eax
jne 0x414c43
pop edi
mov eax, 0xfffffffd
pop esi
pop ebp
ret
mov dword [esi + 0x30], edi
xor eax, eax
pop edi
mov dword [esi + 0x34], 0
pop esi
pop ebp
ret
Function at 0x434060
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov dl, byte [ecx]
movzx eax, dl
dec eax
cmp eax, 0xbf
ja case.0x43407e.5
movzx eax, byte [eax + 0x434268]
jmp dword [eax*4 + 0x4341d8]
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00448320
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00447fb0
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00447e90
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.0044bce0
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00448140
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00448470
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.004487c0
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00448920
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00448d70
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00449030
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00448b80
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.004f1070
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00447bd0
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00448b30
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00448f60
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00448be0
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00447ca0
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00447dc0
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00448190
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00448e60
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00448470
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.004484c0
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00448610
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00448a20
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00448be0
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00448c30
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00448f10
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.0044b2f0
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00448f60
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00448fd0
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.004490f0
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00449180
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00449240
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00448770
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00448690
cmp dl, 0xc0
jb 0x4341ce
cmp dl, 0xc6
ja 0x4341ce
xor eax, eax
pop ebp
ret
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00447f50

Function at 0x434ca0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
push dword [0x5c988c]
push dword [0x5c9888]
push dword [0x5c98b8]
call dword [0x5c6644]
add esp, 0x14
cmp dword [0x5c98bc], 0
je 0x434ce0
cmp dword [0x5c9888], 1
jne 0x434ce0
cmp dword [0x5c988c], 0x12
jne 0x434ce2
pop ebp
ret
push 1
call fcn.004f72e5
int3
Function at 0x44a940
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x44a974
push 2
push esi
call fcn.00434d10
add esp, 8
test eax, eax
je 0x44a96f
push esi
push 2
call fcn.00434cf0
push str.gf_delete_file_deletes_nothing___ignoring_n
call fcn.00434ca0
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret
mov dword [ebp + 8], esi
lea ecx, [esi + 1]
nop word [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x44a980
sub esi, ecx
push edi
push 2
lea eax, [esi + 1]
push eax
call fcn.004f6bee
mov edi, eax
add esp, 8
test edi, edi
je 0x44a9ce
lea eax, [ebp + 8]
push eax
push esi
push edi
call fcn.0044f930
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
mov esi, eax
call fcn.004f6752
add esp, 4
xor eax, eax
test esi, esi
mov ecx, 0xfffffffd
cmove eax, ecx
pop edi
pop esi
pop ebp
ret
pop edi
mov eax, 0xfffffffd
pop esi
pop ebp
ret

Function at 0x44abc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004f88b9
mov esi, eax
add esp, 0x10
cmp esi, edi
je 0x44ac20
lea eax, [ebp + 0x10]
push ebx
push eax
call fcn.004f6c85
push dword [ebp + 0x10]
call fcn.004f6d4a
push 1
push 0
mov ebx, eax
call fcn.00434d10
add esp, 0x10
test eax, eax
je 0x44ac1d
push 0
push 1
call fcn.00434cf0
push esi
push edi
push ebx
push str.Error_writing_data___s_:__d_blocks_to_write_but__d_blocks_written_n
call fcn.00434ca0
add esp, 0x18
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
ret