joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ab02
Capabilities:
Check mutex on windows

Disassembly:
push 0x10
mov eax, 0x412f5b
call fcn.00411e9a
mov edi, ecx
lea esi, [edi + 0x130]
push str.Unspecified_error___init.
mov ecx, esi
mov dword [ebp - 0x1c], esi
call fcn.00401a57
push dword [ebp + 8]
lea eax, [edi + 8]
mov ecx, eax
mov dword [ebp - 0x18], eax
call fcn.00404f31
test eax, eax
je 0x40ab7c
mov ecx, dword [edi + 0x12c]
sub ecx, 0x10
call fcn.00401bbc
add eax, 0x10
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea ecx, [ebp - 0x10]
push ebx
mov dword [ebp - 4], ebx
call fcn.00401a9c
push eax
push str.Error_reading_crash_info:__s
push esi
call fcn.00403bde
mov ecx, dword [ebp - 0x10]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.00401582
xor eax, eax
jmp 0x40ac41
push dword [ebp + 8]
lea esi, [edi + 0x1a8]
push 0x414e70
push esi
call fcn.00403bde
add esp, 0xc
call fcn.004015a8
push eax
lea ecx, [ebp - 0x10]
call fcn.00401b44
xor ebx, ebx
mov dword [ebp - 4], 1
push ebx
mov ecx, esi
call fcn.00401a9c
push eax
lea eax, [ebp - 0x10]
push str.LocalCrashRptEvent__s
push eax
call fcn.00403bde
mov esi, dword [ebp - 0x10]
add esp, 0xc
push esi
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edx, dword [edi + 0x10]
lea ecx, [ebp - 0x14]
push str.RTLReading
push str.Settings
mov dword [edi + 0x1ac], eax
call fcn.00402cc1
mov byte [ebp - 4], 2
push 0x415a74
push dword [ebp - 0x14]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 0x10
test eax, eax
jne 0x40ac0d
push 1
call dword [sym.imp.USER32.dll_SetProcessDefaultLayout]
cmp dword [edi + 0x5c], ebx
jne 0x40ac49
push 1
mov ecx, edi
call fcn.0040ac92
xor ebx, ebx
mov eax, str.Success.
inc ebx
mov ecx, dword [ebp - 0x1c]
push eax
call fcn.00401a57
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401582
lea ecx, [esi - 0x10]
call fcn.00401582
mov eax, ebx
call fcn.00411e68
ret 4
push 0x415a78
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40ac6a
mov eax, str.Another_CrashSender.exe_already_tries_to_resend_recent_reports.
jmp 0x40ac23
mov eax, dword [edi + 0xfc]
sub eax, dword [edi + 0xf8]
jne 0x40ac7f
mov eax, str.There_are_no_reports_for_us_to_send.
jmp 0x40ac23
mov ecx, dword [ebp - 0x18]
call fcn.00406d00
test eax, eax
jne 0x40ac1b
mov eax, str.Not_enough_time_elapsed_to_remind_user_about_recent_crash_reports.
jmp 0x40ac23

Function at 0x40ac92
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [esi + 0x18c], eax
xor eax, eax
push eax
push eax
push esi
push 0x40acd0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [esi + 0x140], eax
test eax, eax
pop esi
setne cl
mov eax, ecx
pop ebp
ret 4
Function at 0x40d42f
Capabilities:
Enumerate files on windows

Disassembly:
push 0x284
mov eax, 0x4134a8
call fcn.00411ecd
mov dword [ebp - 0x264], ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x278], esi
call fcn.004015a8
push eax
lea ecx, [ebp - 0x274]
call fcn.00401b44
xor edi, edi
lea eax, [ebp - 0x274]
mov dword [ebp - 4], edi
push dword [esi + 4]
push str.Looking_for_files_using_search_template:__s
push eax
call fcn.00403bde
mov eax, dword [ebp - 0x274]
add esp, 0xc
add eax, 0xfffffff0
push 1
push edi
push ecx
mov esi, esp
mov ecx, eax
mov dword [ebp - 0x270], esi
mov dword [ebp - 0x270], eax
call fcn.00401bbc
mov ecx, dword [ebp - 0x264]
add eax, 0x10
add ecx, 0x148
mov dword [esi], eax
call fcn.004040bd
mov esi, dword [ebp - 0x278]
lea eax, [ebp - 0x260]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x268], eax
cmp eax, 0xffffffff
jne 0x40d4fc
push 1
push edi
push ecx
mov ecx, esp
push str.Could_not_find_any_files_matching_the_search_template.
call fcn.004038c4
mov ecx, dword [ebp - 0x264]
lea ecx, [ecx + 0x148]
call fcn.004040bd
jmp 0x40d655
push 0x5c
lea ecx, [esi + 4]
call fcn.00403526
push eax
push edi
lea eax, [ebp - 0x26c]
push eax
lea ecx, [esi + 4]
call fcn.00403494
mov edi, dword [ebp - 0x264]
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x268]
lea ecx, [edi + 0x148]
call fcn.00404172
test al, al
jne 0x40d63d
test byte [ebp - 0x260], 0x10
jne 0x40d627
push 0x414bd8
lea edx, [ebp - 0x26c]
lea ecx, [ebp - 0x268]
call fcn.004033de
pop ecx
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x268]
call fcn.00403794
lea ecx, [ebp - 0x290]
call fcn.0040465d
lea eax, [ebp - 0x268]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x28c]
call fcn.00403827
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x290]
call fcn.00401a57
mov edi, dword [ebp - 0x278]
lea ecx, [ebp - 0x288]
lea eax, [edi + 8]
push eax
call fcn.00403827
mov eax, dword [edi + 0xc]
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x284], eax
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x280], eax
mov eax, dword [ebx + 4]
push ecx
cmp eax, dword [ebx + 8]
je 0x40d5ea
mov ecx, eax
call fcn.0040802f
add dword [ebx + 4], 0x18
jmp 0x40d5f2
push eax
mov ecx, ebx
call fcn.0040ddce
mov ecx, dword [ebp - 0x264]
lea eax, [ebp - 0x290]
push eax
call fcn.0040cf45
lea ecx, [ebp - 0x290]
call fcn.004063aa
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x268]
lea ecx, [ecx - 0x10]
call fcn.00401582
mov edi, dword [ebp - 0x264]
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40d527
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x26c]
lea ecx, [ecx - 0x10]
call fcn.00401582
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x270]
call fcn.00401582
mov eax, edi
call fcn.00411e7c
ret 8
Function at 0x40dc24
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0x234
mov eax, 0x413569
call fcn.00411ecd
call fcn.004015a8
push eax
lea ecx, [ebp - 0x240]
call fcn.00401b44
and dword [ebp - 4], 0
lea eax, [ebp - 0x240]
push 0x57b
push str.CrashSender_d.exe
push eax
call fcn.00403bde
add esp, 0xc
mov dword [ebp - 0x23c], 0x22c
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
lea eax, [ebp - 0x23c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov esi, dword [ebp - 0x240]
cmp eax, 1
jne 0x40dce9
jmp 0x40dcd6
lea eax, [ebp - 0x218]
push esi
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x40dcd6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x234], eax
je 0x40dcd6
push dword [ebp - 0x234]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
push 1
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x23c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x40dc92
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esi - 0x10]
call fcn.00401582
xor eax, eax
call fcn.00411e7c
ret

Function at 0x40fbd2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
call fcn.0040fa9a
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push ebx
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetc]
add esp, 0x10
cmp eax, 0xffffffff
jne 0x40fc0d
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
pop ecx
test eax, eax
je 0x40fc0d
push ebx
push ebx
jmp 0x40fc8b
push 2
push ebx
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push 0
cdq
push 0
push edi
mov ebx, eax
mov dword [ebp - 4], edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov edx, dword [ebp - 4]
mov ecx, ebx
and ecx, edx
add esp, 0x1c
cmp ecx, 0xffffffff
jne 0x40fc44
push 0
push 0
jmp 0x40fc8b
xor ecx, ecx
cmp edx, ecx
ja 0x40fc89
cmp ebx, 0xffffffff
jae 0x40fc89
mov eax, ebx
or eax, edx
jne 0x40fc5b
push ecx
push ecx
push 0xd
jmp 0x40fc8d
lea eax, [ebx + 1]
push eax
call fcn.00411335
push edi
push ebx
push 1
push eax
mov dword [esi + 0x50], eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x14
cmp eax, ebx
jne 0x40fc3e
mov eax, dword [esi + 0x50]
mov ecx, esi
mov byte [ebx + eax], 0
call fcn.0040fdb1
jmp 0x40fc96
push ecx
push ecx
push 5
push esi
call fcn.0040fcff
add esp, 0x10
mov eax, dword [esi + 0x38]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40ff40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx + 0x40], 0
je 0x40ff5f
push dword [ecx + 0x40]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
jmp 0x40ff9a
push esi
lea esi, [ecx + 0xd0]
mov eax, dword [esi + 0x1c]
mov ecx, esi
push edi
mov edi, dword [ebp + 0xc]
add eax, edi
push eax
call fcn.00410a62
mov ecx, dword [esi + 0x1c]
push edi
push dword [ebp + 8]
lea eax, [ecx + edi]
mov dword [esi + 0x1c], eax
mov eax, dword [esi]
lea esi, [ecx - 1]
add esi, eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [esi + edi], 0
pop edi
pop esi
pop ebp
ret 8
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d7a
nop
sub eax, 0x403d20
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x403400
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40ea40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call sub.MFC42.DLL_CWnd::CWnd
xor edi, edi
mov dword [esi + 0x98], 0x410c70
mov dword [esp + 0x14], edi
mov dword [esi + 0x9c], edi
lea ecx, [esi + 0xc0]
mov byte [esp + 0x14], 1
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0xd4]
mov byte [esp + 0x14], 2
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0xd8]
mov byte [esp + 0x14], 3
call fcn.00408d3e
mov edx, dword [esp + 0x28]
mov dword [esi + 0xa4], edi
mov ecx, 9
xor eax, eax
lea edi, [esi + 0x50]
mov dword [esi], 0x410bb0
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x28]
push eax
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x2c], 4
call fcn.004034c0
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x404e40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40ec22
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
call sub.MFC42.DLL_CDialogBar::CDialogBar
lea ebp, [esi + 0x144]
xor edi, edi
mov ecx, ebp
mov dword [esp + 0x30], edi
lea ebx, [esi + 0x104]
call sub.MFC42.DLL_CString::CString_2
mov dword [esi + 0x150], 0x410ea0
mov dword [esi + 0x154], edi
lea ecx, [esi + 0x160]
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CImageList::CImageList
lea ecx, [esi + 0xf4]
xor eax, eax
mov dword [esi], 0x410db0
mov dword [esi + 0x8c], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x148], edi
mov dword [esi + 0x14c], edi
mov dword [esi + 0x15c], edi
mov dword [esi + 0x158], edi
mov dword [ecx], eax
xor edx, edx
push 0x2713
mov dword [ecx + 4], eax
mov byte [esp + 0x34], 3
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
lea eax, [esi + 0xa4]
mov dword [esi + 0xa4], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
call fcn.0040a5e0
add esp, 4
mov ecx, ebp
push eax
call sub.MFC42.DLL_CString::operator
call sub.MFC42.DLL_AfxGetModuleState
mov ecx, dword [eax + 0xc]
mov ebp, dword [0x417998]
mov dword [esp + 0x10], ecx
call sub.MFC42.DLL_AfxGetModuleState
lea edx, [esp + 0x18]
push 0x4163e8
push edx
mov ecx, 0x417bd8
mov dword [eax + 0xc], ebp
call fcn.00406c90
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov ebp, dword [sym.imp.USER32.dll_SetRect]
push eax
push ecx
push edi
push edi
push ebx
call ebp
lea edx, [esp + 0x20]
push 0x4163c8
push edx
mov ecx, 0x417bd8
call fcn.00406c90
mov ecx, dword [eax]
mov dword [esp + 0x18], ecx
mov edx, dword [eax + 4]
mov eax, dword [ebx]
mov dword [esp + 0x1c], edx
lea ebx, [esi + 0x114]
push edx
lea edx, [eax - 2]
sub eax, ecx
push edx
sub eax, 2
push edi
push eax
push ebx
call ebp
lea eax, [esp + 0x20]
push 0x4163ac
push eax
mov ecx, 0x417bd8
call fcn.00406c90
mov ecx, dword [eax]
mov dword [esp + 0x18], ecx
mov edx, dword [eax + 4]
mov eax, dword [ebx]
mov dword [esp + 0x1c], edx
push edx
lea edx, [eax - 2]
sub eax, ecx
push edx
sub eax, 2
push edi
push eax
lea eax, [esi + 0x124]
push eax
call ebp
call sub.MFC42.DLL_AfxGetModuleState
mov ecx, dword [esp + 0x10]
pop edi
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x4077e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40ee56
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0x110
push esi
mov esi, dword [esp + 0x124]
push edi
push 0x17
push eax
mov edi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40791c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
lea ecx, [esp + 0x14]
call fcn.00408bfa
lea ecx, [esp + 8]
mov dword [esp + 0x120], 0
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esp + 0x134]
mov byte [esp + 0x120], 1
test eax, eax
jl 0x407879
mov ecx, dword [esp + 0x130]
push eax
push ecx
lea edx, [esp + 0x10]
push 0x4165d0
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0x10
jmp 0x40788a
mov eax, dword [esp + 0x130]
lea ecx, [esp + 8]
push eax
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0xc]
call fcn.00407940
push eax
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call sub.MFC42.DLL_CString::CString_1
mov ecx, edi
call fcn.004076e0
mov al, byte [esp + 0x18]
mov dword [esp + 0xc], 0
cmp al, 0x30
jne 0x4078d9
cmp byte [esp + 0x19], 0x78
jne 0x4078d9
lea eax, [esp + 0xc]
lea ecx, [esp + 0x18]
push eax
push 0x4165cc
push ecx
jmp 0x4078e8
lea edx, [esp + 0xc]
lea eax, [esp + 0x18]
push edx
push 0x4160c8
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
mov esi, dword [esp + 0x18]
add esp, 0xc
lea ecx, [esp + 8]
mov byte [esp + 0x120], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x120], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, esi
mov ecx, dword [esp + 0x118]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x11c
ret 0x10
Function at 0x40a250
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
push ebp
push esi
mov esi, dword [ebx + 0x10]
push edi
mov edi, dword [esp + 0x24]
mov ebp, dword [esi]
test ebp, ebp
je 0x40a28b
mov cl, byte [esi + 8]
mov eax, edi
and eax, 0xffff
xor edx, edx
shr eax, cl
div dword [esi + 4]
mov edx, dword [ebp + edx*4]
test edx, edx
je 0x40a28b
cmp word [edx + 4], di
je 0x40a2fc
mov edx, dword [edx]
test edx, edx
jne 0x40a27f
mov eax, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x18]
sub ecx, eax
cmp ecx, 1
jle 0x40a3c8
mov edx, dword [ebx + 0x14]
push ecx
add eax, edx
and edi, 0xffff
mov dword [esp + 0x20], eax
push eax
mov eax, dword [ebx + 8]
push edi
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
mov ebp, dword [ebx + 0x14]
mov cl, byte [esi + 8]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x1c]
add eax, ebp
mov ebp, dword [esi + 4]
mov dword [esp + 0x14], eax
mov eax, edi
shr eax, cl
xor edx, edx
mov ecx, dword [esi]
div ebp
test ecx, ecx
mov edi, edx
mov dword [esp + 0x10], edi
je 0x40a314
mov eax, dword [ecx + edi*4]
test eax, eax
je 0x40a310
mov dx, word [eax + 4]
cmp dx, word [esp + 0x24]
je 0x40a308
mov eax, dword [eax]
test eax, eax
jne 0x40a2e9
jmp 0x40a310
test edx, edx
je 0x40a28b
mov edx, dword [edx + 6]
jmp 0x40a3c4
test eax, eax
jne 0x40a3ac
test ecx, ecx
jne 0x40a343
lea edi, [ebp*4]
push edi
call sub.MFC42.DLL_operatornew
mov edx, eax
mov ecx, edi
mov dword [esi], edx
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x10]
mov dword [esi + 4], ebp
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x40a37d
mov eax, dword [esi + 0x18]
push 0xa
lea ecx, [esi + 0x14]
push eax
push ecx
call fcn.0040d120
mov ecx, dword [esi + 0x18]
add eax, 4
lea edx, [ecx + ecx*4]
dec ecx
test ecx, ecx
lea eax, [eax + edx*2 - 0xa]
jl 0x40a37d
mov edx, dword [esi + 0x10]
mov dword [eax], edx
mov dword [esi + 0x10], eax
test ecx, ecx
jle 0x40a37a
sub eax, 0xa
dec ecx
jns 0x40a36b
mov eax, dword [esi + 0x10]
mov dx, word [esp + 0x24]
mov ecx, dword [eax]
mov dword [esi + 0x10], ecx
mov ecx, dword [esi + 0xc]
inc ecx
mov dword [esi + 0xc], ecx
xor ecx, ecx
mov word [eax + 4], cx
mov dword [eax + 6], ecx
mov dword [eax], ecx
mov word [eax + 4], dx
mov ecx, dword [esi]
mov edx, dword [ecx + edi*4]
mov dword [eax], edx
mov ecx, dword [esi]
mov dword [ecx + edi*4], eax
mov edx, dword [esp + 0x14]
mov dword [eax + 6], edx
mov eax, dword [esp + 0x18]
mov ecx, dword [ebx + 0x1c]
mov edx, dword [esp + 0x1c]
inc eax
add ecx, eax
mov dword [ebx + 0x1c], ecx
test edx, edx
jne 0x40a3d7
pop edi
pop esi
pop ebp
mov eax, 0x417900
pop ebx
add esp, 0x10
ret 4
pop edi
pop esi
pop ebp
mov eax, edx
pop ebx
add esp, 0x10
ret 4
Function at 0x40b830
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40f02b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1a8
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x41770c
mov dword [ebp - 0x14], ecx
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
mov dword [ebp - 0x10], edi
je 0x40b9d3
push edi
call dword [sym.imp.MSVCRT.dll__fileno]
push eax
call dword [sym.imp.MSVCRT.dll__filelength]
mov ebx, eax
add esp, 8
test ebx, ebx
jge 0x40b89b
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor eax, eax
jmp 0x40b9d3
cmp ebx, 0x400
mov dword [ebp + 8], ebx
jl 0x40b8b4
push ebx
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov esi, eax
jmp 0x40b8c2
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.00409130
mov esi, esp
test esi, esi
jne 0x40b8d7
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor eax, eax
jmp 0x40b9d3
mov ecx, ebx
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x10]
push eax
push ebx
push 1
push esi
call dword [sym.imp.MSVCRT.dll_fread]
mov ecx, dword [ebp - 0x10]
mov edi, eax
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [ebp + 0xc]
add esp, 0x14
test eax, eax
je 0x40b9ad
mov ebx, dword [ebp + 8]
cmp ebx, 4
jl 0x40b950
mov eax, ebx
mov ecx, 0x18
cdq
idiv ecx
cmp edx, 4
jne 0x40b950
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea ecx, [eax + 0x17]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edi, [edx + edx*2]
shl edi, 3
lea ecx, [edi + 4]
cmp ecx, ebx
je 0x40b966
cmp ebx, 0x400
jl 0x40b962
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor eax, eax
jmp 0x40b9d3
mov edx, dword [ebp + 0xc]
push 3
push edx
lea ecx, [ebp - 0x1b4]
call fcn.0040d580
lea ebx, [esi + 4]
push edi
push ebx
lea ecx, [ebp - 0x1b4]
mov dword [ebp - 4], 0
call fcn.0040d6e0
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
push eax
push ecx
mov ecx, dword [ebp - 0x14]
push ebx
call fcn.0040bab0
mov edi, eax
mov eax, dword [ebp + 8]
cmp eax, 0x400
jl 0x40b9d1
jmp 0x40b9c7
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
push edx
push edi
push esi
call fcn.0040bab0
mov edi, eax
mov eax, dword [ebp + 8]
cmp eax, 0x400
jl 0x40b9d1
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x1c0]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40dd30
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x108]
push edi
mov dword [esp + 0x14], ecx
xor edx, edx
xor eax, eax
mov al, byte [edx + str.80_]
mov ecx, eax
and eax, 7
sar ecx, 3
mov bl, byte [eax*2 + 0x412f44]
mov cl, byte [ecx + esi]
test bl, cl
setne al
mov byte [esp + edx + 0x50], al
inc edx
cmp edx, 0x38
jl 0x40dd47
mov eax, 0x1e
xor ebx, ebx
mov dword [esp + 0x10], eax
cmp word [esp + 0x110], 1
je 0x40dd89
lea eax, [ebx + ebx]
lea edi, [esp + eax*4 + 0x8c]
lea ebp, [esp + eax*4 + 0x88]
xor eax, eax
xor ecx, ecx
mov cl, byte [ebx + 0x412fec]
mov dword [edi], 0
mov esi, ecx
mov dword [ebp], 0
mov edx, esi
cmp edx, 0x1c
jge 0x40ddbd
mov cl, byte [esp + edx + 0x50]
jmp 0x40ddc1
mov cl, byte [esp + edx + 0x34]
mov byte [esp + eax + 0x18], cl
inc eax
inc edx
cmp eax, 0x1c
jl 0x40ddb2
mov eax, 0x1c
lea edx, [esi + 0x1c]
cmp edx, 0x38
jge 0x40dddf
mov cl, byte [esp + edx + 0x50]
jmp 0x40dde3
mov cl, byte [esp + edx + 0x34]
mov byte [esp + eax + 0x18], cl
inc eax
inc edx
cmp eax, 0x38
jl 0x40ddd4
xor edx, edx
mov eax, 0x412f54
xor ecx, ecx
mov cl, byte [edx + 0x412ffc]
cmp byte [esp + ecx + 0x18], 0
je 0x40de0e
mov ecx, dword [eax]
mov esi, dword [ebp]
or esi, ecx
mov dword [ebp], esi
xor ecx, ecx
mov cl, byte [edx + 0x413014]
cmp byte [esp + ecx + 0x18], 0
je 0x40de25
mov ecx, dword [eax]
mov esi, dword [edi]
or esi, ecx
mov dword [edi], esi
add eax, 4
inc edx
cmp eax, str.80_
jl 0x40ddf5
mov eax, dword [esp + 0x10]
inc ebx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x40dd7b
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x88]
push edx
call fcn.0040e050
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf8
ret 8