joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4027ef
Capabilities:
Move file
Set console window title

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x64464c]
mov ecx, dword [0x6444e8]
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x402880
mov edi, dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov ebx, ecx
mov dword [ebp - 4], eax
cmp dword [0x64464c], 0x5d
jne 0x402872
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_HeapSize]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileValidData]
push 0x4023a0
push 0x4023cc
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push 0x4023fc
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push esi
push 0x402400
call edi
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push esi
push 0x402430
call edi
push ebx
call fcn.0040267f
add ebx, 8
dec dword [ebp - 4]
jne 0x402815
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40289f
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x40
push 0x1000
push dword [0x64464c]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x6444e8], eax
ret
Function at 0x40351b
Capabilities:
Get common file path
Get disk information
Get hostname

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12e4
call fcn.0040ac00
push esi
xor esi, esi
cmp dword [0x64464c], 0xc
push edi
jne 0x403575
lea eax, [ebp - 0xae4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.GDI32.dll_GetFontUnicodeRanges]
call dword [sym.imp.WINHTTP.dll_WinHttpCheckPlatform]
push esi
call fcn.00403c26
push esi
call fcn.00403926
push esi
call fcn.004035f0
push esi
call fcn.0040377e
push esi
call fcn.00403768
add esp, 0x14
mov eax, dword [0x42eccc]
mov dword [0x64464c], eax
mov edi, 0x9adc8
cmp dword [0x64464c], 0x15
jne 0x4035d0
push esi
lea eax, [ebp - 0x6e4]
push eax
push 0x402488
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
push esi
push esi
push esi
lea eax, [ebp - 0x2e4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x12e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x4024e0
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
dec edi
jne 0x403584
call fcn.004025e0
mov eax, 0xb2d3b
add dword [0x64464c], eax
call fcn.004028ba
pop edi
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x4072e6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x427638]
jne 0x4072f0
repz ret
jmp fcn.00409c09
Function at 0x4097c7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406d1d
and dword [ebp - 4], 0
cmp dword [0x42f4f4], 0
mov ebx, eax
jne 0x409878
push 0x401994
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409929
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401988
push edi
call esi
test eax, eax
je 0x409929
push eax
call fcn.00406cab
mov dword [esp], 0x401978
push edi
mov dword [0x42f4f4], eax
call esi
push eax
call fcn.00406cab
mov dword [esp], 0x401964
push edi
mov dword [0x42f4f8], eax
call esi
push eax
call fcn.00406cab
mov dword [esp], 0x401948
push edi
mov dword [0x42f4fc], eax
call esi
push eax
call fcn.00406cab
pop ecx
mov dword [0x42f504], eax
test eax, eax
je 0x409878
push 0x401930
push edi
call esi
push eax
call fcn.00406cab
pop ecx
mov dword [0x42f500], eax
mov eax, dword [0x42f500]
cmp eax, ebx
je 0x4098d0
cmp dword [0x42f504], ebx
je 0x4098d0
push eax
call fcn.00406d26
push dword [0x42f504]
mov esi, eax
call fcn.00406d26
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4098d0
test edi, edi
je 0x4098d0
call esi
test eax, eax
je 0x4098c7
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4098c7
test byte [ebp - 0xc], 1
jne 0x4098d0
or dword [ebp + 0x10], 0x200000
jmp 0x409909
mov eax, dword [0x42f4f8]
cmp eax, ebx
je 0x409909
push eax
call fcn.00406d26
pop ecx
test eax, eax
je 0x409909
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409909
mov eax, dword [0x42f4fc]
cmp eax, ebx
je 0x409909
push eax
call fcn.00406d26
pop ecx
test eax, eax
je 0x409909
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42f4f4]
call fcn.00406d26
pop ecx
test eax, eax
je 0x409929
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40992b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4015e2
Capabilities:
Delete file
Move file

Disassembly:
xor eax, eax
push eax
call fcn.0041abc0
mov edx, dword [esp + 8]
lea ecx, [esp]
call fcn.0040f060
push 4
push 0
push dword [esp + 8]
call sub.KERNEL32.dll_MoveFileExW
xor eax, eax
push dword [esp]
call fcn.0041ad10
add esp, 4
ret 4

Function at 0x406785
Capabilities:
Check mutex on windows

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
call fcn.0041abc0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov edx, dword [esp]
mov ebp, dword [edx]
push dword [ebp + 8]
call fcn.0040fdf0
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
cmp ebx, 1
jne 0x4067fe
mov edx, dword [esp]
mov ebp, dword [edx]
mov edx, dword [ebp + 0xc]
push edx
call fcn.0041ab10
pop edx
push eax
push edx
call fcn.0041ac20
lea eax, [esp + 0xc]
push eax
call fcn.0041ac80
push dword [esp + 8]
push 1
push 0
call sub.KERNEL32.dll_CreateMutexW
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
jne 0x4067fe
push 0xb7
call sub.KERNEL32.dll_ExitProcess
xor eax, eax
push dword [esp + 8]
call fcn.0041ad10
add esp, 0xc
pop ebx
pop ebp
ret 4

Function at 0x4071e1
Capabilities:
Get disk size

Disassembly:
push ebx
mov edx, 8
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4071e7
call fcn.0041abc0
mov edx, dword [esp + 0x28]
lea ecx, [esp]
call fcn.0040f060
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 4]
call fcn.0040f060
mov dword [esp + 8], 0xffffffff
mov dword [esp + 0xc], 0xffffffff
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0xc]
call sub.KERNEL32.dll_GetDiskFreeSpaceExW
and eax, eax
je 0x407303
push edx
call fcn.0041ab10
pop edx
push eax
push edx
call fcn.0041ab10
pop edx
push eax
push dword [esp + 0xc]
call fcn.00410040
call fcn.0041ab50
mov edx, 0x41e310
mov ecx, dword [esp]
push ecx
call fcn.0040f180
pop ecx
add ecx, eax
call fcn.0040f1c0
je 0x40728a
push dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], eax
pop dword [esp + 0x10]
jmp 0x4072fe
mov edx, 0x41e30c
mov ecx, dword [esp]
push ecx
call fcn.0040f180
pop ecx
add ecx, eax
call fcn.0040f1c0
je 0x4072b4
push dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
pop dword [esp + 0x10]
jmp 0x4072fe
mov edx, 0x41e314
mov ecx, dword [esp]
push ecx
call fcn.0040f180
pop ecx
add ecx, eax
call fcn.0040f1c0
je 0x4072ee
push dword [esp + 0x20]
push dword [esp + 0x20]
lea eax, [esp + 0x1c]
mov edx, dword [eax]
sub dword [esp], edx
mov edx, dword [eax + 4]
sbb dword [esp + 4], edx
pop dword [esp + 0x10]
pop dword [esp + 0x10]
jmp 0x4072fe
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], 0xffffffff
call fcn.0040f1b0
lea eax, [esp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
jmp 0x407312
push edx
push dword [esp + 8]
call fcn.0041ad10
push dword [esp + 4]
call fcn.0041ad10
pop edx
add esp, 0x20
pop ebx
ret 8
Function at 0x409ad0
Capabilities:
Get common file path

Disassembly:
push ebp
push ebx
mov edx, 8
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x409ad7
call fcn.0041abc0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov edx, dword [esp]
mov ebp, dword [edx]
push dword [ebp + 0x10c]
call fcn.0040fdf0
mov dword [esp + 4], eax
push dword [ebp + 0x110]
call fcn.0040fdf0
push edx
push eax
fild qword [esp]
fstp qword [esp]
pop dword [esp + 0xc]
pop dword [esp + 0xc]
mov ebx, dword [esp + 4]
cmp ebx, 1
jne 0x409bd7
push edx
call fcn.0041ab10
pop edx
push eax
push edx
call fcn.0041ab10
pop edx
push eax
push 0x104
call fcn.0040fff0
lea eax, [esp + 0x14]
push eax
call fcn.0041ac80
push 0x104
push dword [esp + 0x14]
call sub.KERNEL32.dll_GetSystemDirectoryW
push edx
call fcn.0041ab10
pop edx
push eax
push edx
call fcn.0041ab10
pop edx
push eax
push 1
push 1
mov eax, 0x41e028
push eax
mov eax, str.WindowsSystem32
push eax
push dword [esp + 0x28]
call fcn.0040fa50
lea eax, [esp + 0x18]
push eax
call fcn.0041ac80
mov eax, 0x41e310
push eax
push dword [esp + 0x18]
call fcn.004071e1
push edx
push eax
pop dword [esp + 0x1c]
pop dword [esp + 0x1c]
push dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
pop edx
mov dword [esp - 8], eax
mov dword [esp - 4], edx
fild qword [esp - 8]
fld qword [esp + 8]
fcompp
fnstsw ax
test ah, 0x41
jne 0x409bd7
call fcn.00402b0b
xor eax, eax
push dword [esp + 0x14]
call fcn.0041ad10
push dword [esp + 0x10]
call fcn.0041ad10
add esp, 0x20
pop ebx
pop ebp
ret 4

Function at 0x40a7d0
Capabilities:
Get disk information

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.0041abc0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov edx, dword [esp]
mov ebp, dword [edx]
push dword [ebp + 0x48]
call fcn.0040fdf0
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
cmp ebx, 1
jne 0x40a835
mov edx, dword [esp]
mov ebp, dword [edx]
push dword [ebp + 0x4c]
call fcn.0040fdf0
mov dword [esp + 8], eax
push 0
call sub.KERNEL32.dll_GetDriveTypeW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
cmp ebx, dword [esp + 8]
jne 0x40a82b
jmp 0x40a837
push 0
call sub.KERNEL32.dll_ExitProcess
xor eax, eax
add esp, 0x10
pop ebx
pop ebp
ret 4
Function at 0x40c6af
Capabilities:
Query environment variable

Disassembly:
xor eax, eax
push eax
push eax
call fcn.0041abc0
push dword [esp + 0x10]
call fcn.0040f1b0
mov edx, dword [esp + 0xc]
lea ecx, [esp]
call fcn.0040f060
push edx
call fcn.0041ab10
pop edx
push eax
push edx
call fcn.0041ab10
pop edx
push eax
push 0x104
call fcn.0040fff0
lea eax, [esp + 8]
push eax
call fcn.0041ac80
push 0x104
mov eax, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
and eax, eax
je 0x40c729
mov edx, dword [esp + 4]
push edx
call fcn.0041ab10
pop edx
push eax
push edx
call fcn.0041ac20
pop eax
push eax
call fcn.0040f180
pop edx
add eax, edx
jmp 0x40c752
mov edx, 0x41e028
push edx
call fcn.0041ab10
pop edx
push eax
push edx
call fcn.0041ac20
pop eax
push eax
call fcn.0040f180
pop edx
add eax, edx
jmp 0x40c752
push dword [esp + 4]
call fcn.0041ad10
push dword [esp]
call fcn.0041ad10
add esp, 8
ret 4

Function at 0x40ccfd
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
call fcn.0041abc0
push dword [esp + 8]
call fcn.0041a5d0
push eax
call fcn.0041a670
mov dword [0x420814], eax
push dword [esp + 8]
call fcn.0041a5d0
push eax
push dword [0x420814]
push dword [esp + 0x10]
call fcn.0041a5f0
push 0
push 0
push 0
lea eax, [0x40134f]
push eax
push 0
push 0
call sub.KERNEL32.dll_CreateThread
mov dword [esp], eax
push 0xffffffff
push dword [esp + 4]
call sub.KERNEL32.dll_WaitForSingleObject
xor eax, eax
add esp, 4
ret 4
Function at 0x40f630
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
je 0x40f6c8
push edi
push 0x4212e0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x420940]
test edi, edi
je 0x40f69c
push ebx
push esi
lea ebx, [edi + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40f695
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
push ebx
push 0x420940
call fcn.0041a178
pop ecx
pop ecx
jmp 0x40f697
mov edi, dword [edi]
test edi, edi
jne 0x40f66c
pop ebx
mov eax, dword [0x41fe1c]
mov esi, eax
inc eax
push 0x10
push 0x420940
mov dword [0x41fe1c], eax
call fcn.0041a1b8
pop ecx
pop ecx
push 0x4212e0
mov dword [eax], ebp
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8

Function at 0x40f76b
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
push 0
push edi
call fcn.0040f5e4
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebx, 0x4212e0
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x420940]
jmp 0x40f79c
cmp dword [esi + 0xc], edi
je 0x40f7a2
mov esi, dword [esi]
test esi, esi
jne 0x40f795
jmp 0x40f7ba
add esi, 8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0x420940
call fcn.0041a178
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
ret 4
Function at 0x40f82f
Capabilities:
Check os version

Disassembly:
sub esp, 0x350
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x114
xor ebx, ebx
mov esi, 0xc8
and dword [esp + 0x10], ebx
xor edi, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40f9a5
mov eax, dword [esp + 0x24]
dec eax
je 0x40f988
dec eax
jne 0x40f9a5
lea eax, [esp + 0x128]
xor ebp, ebp
push eax
call fcn.0040f7e8
pop ecx
test eax, eax
je 0x40f8e6
mov ebx, dword [esp + 0x12c]
mov edi, dword [esp + 0x130]
mov eax, dword [esp + 0x134]
cmp byte [esp + 0x242], 1
jne 0x40f8a9
xor ebp, ebp
inc ebp
sub ebx, 3
je 0x40f984
dec ebx
je 0x40f980
dec ebx
je 0x40f95f
dec ebx
je 0x40f919
sub ebx, 4
jne 0x40f9a5
test edi, edi
jne 0x40f9a5
cmp eax, 0x55f0
sbb esi, esi
and esi, 0xfffffff6
add esi, 0x78
jmp 0x40f9a5
lea eax, [esp + 0x244]
mov dword [esp + 0x244], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, dword [esp + 0x10]
je 0x40f8a9
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
cmp byte [esp + 0x35e], 1
jmp 0x40f8a4
sub edi, 0
je 0x40f951
dec edi
je 0x40f943
dec edi
je 0x40f935
dec edi
jne 0x40f9a5
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x69
jmp 0x40f9a5
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x5f
jmp 0x40f9a5
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x55
jmp 0x40f9a5
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
jmp 0x40f9a5
sub edi, 0
je 0x40f97c
dec edi
je 0x40f978
dec edi
jne 0x40f9a5
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x40f9a5
push 0x3c
jmp 0x40f9a4
push 0x32
jmp 0x40f9a4
push 0x14
jmp 0x40f9a4
push 5
jmp 0x40f9a4
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40f9a2
cmp eax, 0xa
je 0x40f99e
cmp eax, 0x5a
jne 0x40f9a5
push 0x28
jmp 0x40f9a4
push 0x1e
jmp 0x40f9a4
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret
Function at 0x410f78
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x421308]
call fcn.00419928
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x411078
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x410fce
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x410fc6
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x41100e
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x411050
push 0x22
pop edx
cmp cx, dx
je 0x411000
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x410ff0
xor ecx, ecx
cmp word [eax], cx
je 0x411050
mov ecx, eax
add eax, 2
jmp 0x411052
test dx, dx
je 0x411058
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x411000
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x411046
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x411050
cmp cx, dx
je 0x411043
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x411033
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x411018
jmp 0x411000
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x41105a
xor edx, edx
cmp dword [ebp], ebx
jne 0x411063
test edi, edi
jne 0x411080
test edx, edx
je 0x411068
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x410fbc
test edi, edi
jne 0x411091
mov eax, ebx
jmp 0x411095
test esi, esi
je 0x411091
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x411095
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x4111a5
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebp
push esi
push edi
push dword [esp + 0x38]
xor esi, esi
mov dword [esp + 0x10], esi
call fcn.0041bbb0
mov edi, dword [esp + 0x34]
mov dword [esp + 0x10], eax
lea eax, [edi + 0x18]
push eax
push esi
push dword [0x4207c0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
je 0x4112a4
push ebx
mov ebx, dword [esp + 0x30]
lea eax, [edi + 0x18]
push esi
push dword [ebx + 0x18]
push eax
push ebp
push edi
push dword [esp + 0x48]
call fcn.00411694
mov esi, eax
add esp, 0x18
test esi, esi
je 0x411208
cmp esi, edi
jge 0x411208
mov dword [esp + 0x34], ebp
jmp 0x41120a
mov esi, edi
push dword [esp + 0x14]
call sub.MSVCRT.dll_strlen
mov word [esp + 0x2c], ax
mov eax, edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
cdq
mov dword [esp + 0x1c], eax
mov eax, esi
pop ecx
mov dword [esp + 0x1c], edx
cdq
push 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x40]
push eax
push 0x12
lea eax, [esp + 0x24]
mov dword [esp + 0x30], edx
push eax
push dword [ebx]
call edi
cmp dword [esp + 0x3c], 0x12
jne 0x411289
push 0
lea eax, [esp + 0x40]
push eax
movsx eax, word [esp + 0x30]
push eax
push dword [esp + 0x20]
push dword [ebx]
call edi
movsx eax, word [esp + 0x28]
cmp eax, dword [esp + 0x3c]
jne 0x411289
push 0
lea eax, [esp + 0x40]
push eax
push esi
push dword [esp + 0x40]
push dword [ebx]
call edi
cmp esi, dword [esp + 0x3c]
jne 0x411289
xor esi, esi
inc esi
jmp 0x41128d
mov esi, dword [esp + 0x10]
push ebx
call fcn.004118ae
pop ecx
push ebp
push 0
push dword [0x4207c0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebx
push dword [esp + 0x10]
call fcn.0041bba0
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x1c
ret 0x10
Function at 0x4114df
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
or dword [esp], 0xffffffff
xor edx, edx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
mov esi, edx
test edi, edi
je 0x411516
cmp word [edi], dx
je 0x411516
push edi
call fcn.0041bbb0
mov ebp, dword [esp + 0x20]
mov edi, eax
push edi
push ebp
call fcn.004118f3
pop ecx
pop ecx
mov esi, eax
xor edx, edx
jmp 0x41152c
mov ebp, dword [esp + 0x20]
cmp dword [ebp + 8], edx
je 0x411641
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 4]
mov esi, dword [eax + ecx*4]
test esi, esi
je 0x411641
cmp dword [esp + 0x30], 0
je 0x411550
push dword [esi]
push edx
push dword [0x4207c0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov eax, dword [esi]
jmp 0x411558
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x14], eax
test ebx, ebx
je 0x411645
cdq
cmp edx, dword [esi + 4]
jl 0x411645
jg 0x411578
cmp eax, dword [esi]
jb 0x411645
push 0
lea eax, [esi + 0x14]
push eax
push dword [esi + 0x10]
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 8]
cmp eax, dword [esi]
jne 0x4115ca
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 4]
jne 0x4115ca
push 0
lea eax, [esp + 0x30]
push eax
push dword [esi]
push ebx
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebp, dword [esp + 0x2c]
mov eax, ebp
cdq
cmp dword [esi], eax
jne 0x411645
cmp dword [esi + 4], edx
jne 0x411645
mov dword [esp + 0x10], ebp
jmp 0x411649
push dword [esi + 8]
push 0
push dword [0x4207c0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x411645
push 0
lea ecx, [esp + 0x30]
push ecx
push dword [esi + 8]
push eax
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x2c]
cdq
cmp dword [esi + 8], eax
jne 0x411629
cmp dword [esi + 0xc], edx
jne 0x411629
push dword [esp + 0x14]
push ebx
push dword [esp + 0x20]
call fcn.00411b54
cdq
add esp, 0xc
cmp eax, dword [esi]
jne 0x411629
cmp edx, dword [esi + 4]
jne 0x411629
mov ebp, dword [esi]
mov dword [esp + 0x10], ebp
jmp 0x41162d
mov ebp, dword [esp + 0x10]
push dword [esp + 0x18]
push 0
push dword [0x4207c0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x411649
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x10]
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x411675
cmp ebp, 0xffffffff
jne 0x41166f
test ebx, ebx
je 0x411669
push ebx
push 0
push dword [0x4207c0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov ebx, eax
jmp 0x41167b
mov eax, dword [esi]
mov dword [ecx], eax
jmp 0x411679
mov ebx, dword [esp + 0x10]
xor eax, eax
test edi, edi
je 0x41168a
cmp word [edi], ax
je 0x41168a
push edi
call fcn.0041bba0
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0xc
ret
Function at 0x411933
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x38
push ebx
push ebp
push esi
mov esi, dword [esp + 0x48]
xor ebx, ebx
push 0x40
pop ebp
cmp dword [esi + 4], ebx
jne 0x411ab6
push edi
push 0x100
push ebx
push dword [0x4207c0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push ebx
push ebx
push 4
pop edi
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [esi + 0x14], 0x706c7a31
lea eax, [esp + 0x4c]
push 0
push eax
jne 0x4119c8
push 0x18
lea eax, [esp + 0x3c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x4c], 0x18
jne 0x411ab5
mov eax, dword [esp + 0x30]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x28], eax
mov ax, word [esp + 0x40]
mov word [esp + 0x2c], ax
jmp 0x4119e2
push 0x12
lea eax, [esp + 0x28]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x4c], 0x12
jne 0x411ab5
cmp dword [esi + 0xc], ebp
jl 0x411a04
add ebp, 0x40
mov eax, ebp
shl eax, 2
push eax
push dword [esi + 4]
push 8
push dword [0x4207c0]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [esi + 4], eax
movsx eax, word [esp + 0x2c]
add eax, 0x19
push eax
push 0
push dword [0x4207c0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [esp + 0x1c]
mov edx, eax
push 0
lea eax, [esp + 0x50]
mov dword [esp + 0x14], edx
push eax
mov dword [edx], ecx
mov ecx, dword [esp + 0x28]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x2c]
mov dword [edx + 8], ecx
mov ecx, dword [esp + 0x30]
mov dword [edx + 0xc], ecx
movsx eax, word [esp + 0x34]
push eax
lea eax, [edx + 0x18]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
movsx eax, word [esp + 0x2c]
xor ecx, ecx
mov edx, dword [esp + 0x10]
mov byte [eax + edx + 0x18], cl
cmp dword [esi + 0x14], 0x706c7a31
movsx eax, word [esp + 0x2c]
jne 0x411a77
add eax, 0x18
jmp 0x411a7a
add eax, 0x12
add edi, eax
mov dword [edx + 0x10], edi
adc ebx, ecx
mov dword [edx + 0x14], ebx
mov ecx, dword [esi + 0xc]
add edi, dword [esp + 0x24]
mov eax, dword [esi + 4]
adc ebx, dword [esp + 0x28]
push 1
mov dword [eax + ecx*4], edx
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
inc dword [esi + 0xc]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x1c], ecx
push ecx
jmp 0x41196a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret