joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404db0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4858af
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.0044abc5
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x404e3b
push eax
push esi
call fcn.0044b10c
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.0044ae10
int3

Function at 0x4056c0
Capabilities:
Check for time delay via gettickcount
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
call ebx
mov esi, dword [ebp + 0xc]
mov dword [ebp + 8], eax
test esi, esi
jle 0x405709
nop
mov eax, dword [ebp - 4]
push 0
push esi
push edi
push dword [eax + 0x60]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x405714
sub esi, eax
add edi, eax
call ebx
sub eax, dword [ebp + 8]
cmp eax, 0x7530
ja 0x405714
test esi, esi
jg 0x4056e0
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x405720
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, 1
lea edi, [ebp - 1]
call ebx
mov dword [ebp - 0xc], eax
nop
mov eax, dword [ebp - 8]
push 0
push esi
push edi
push dword [eax + 0x60]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x4057b7
sub esi, eax
add edi, eax
call ebx
sub eax, dword [ebp - 0xc]
cmp eax, 0x7530
ja 0x4057b7
test esi, esi
jg 0x405740
cmp byte [ebp - 1], 0x3a
jne 0x405732
mov esi, 1
lea edi, [ebp - 1]
call ebx
mov dword [ebp - 0xc], eax
nop dword [eax + eax]
mov eax, dword [ebp - 8]
push 0
push esi
push edi
push dword [eax + 0x60]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x4057b7
sub esi, eax
add edi, eax
call ebx
sub eax, dword [ebp - 0xc]
cmp eax, 0x7530
ja 0x4057b7
test esi, esi
jg 0x405780
cmp byte [ebp - 1], 0x20
jne 0x405732
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4057c0
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, ecx
push ebx
push esi
push edi
cmp byte [eax + 0x68], 0
mov dword [ebp - 8], eax
je 0x405867
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
nop
mov esi, 1
lea edi, [ebp - 1]
call ebx
mov dword [ebp - 0xc], eax
nop dword [eax]
mov eax, dword [ebp - 8]
push 0
push esi
push edi
push dword [eax + 0x60]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x405867
sub esi, eax
add edi, eax
call ebx
sub eax, dword [ebp - 0xc]
cmp eax, 0x7530
ja 0x405867
test esi, esi
jg 0x4057f0
cmp byte [ebp - 1], 0x3e
jne 0x4057e0
mov esi, 1
lea edi, [ebp - 1]
call ebx
mov dword [ebp - 0xc], eax
nop dword [eax + eax]
mov eax, dword [ebp - 8]
push 0
push esi
push edi
push dword [eax + 0x60]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x405867
sub esi, eax
add edi, eax
call ebx
sub eax, dword [ebp - 0xc]
cmp eax, 0x7530
ja 0x405867
test esi, esi
jg 0x405830
cmp byte [ebp - 1], 0x20
jne 0x4057e0
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405870
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ebx, [ebp + 8]
mov dword [ebp - 4], ecx
mov esi, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push 0
push esi
push ebx
push dword [eax + 0x60]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x405973
sub esi, eax
add ebx, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
cmp eax, 0x7530
ja 0x405973
test esi, esi
jg 0x405890
mov edx, dword [edi + 0x10]
mov ecx, dword [ebp + 8]
cmp ecx, edx
ja 0x4058e1
mov dword [edi + 0x10], ecx
mov eax, edi
cmp dword [edi + 0x14], 0x10
jb 0x4058db
mov eax, dword [edi]
mov byte [eax + ecx], 0
jmp 0x405923
mov esi, dword [edi + 0x14]
mov ebx, ecx
mov eax, esi
sub ebx, edx
sub eax, edx
cmp ebx, eax
ja 0x405911
mov dword [edi + 0x10], ecx
mov eax, edi
cmp esi, 0x10
jb 0x4058fc
mov eax, dword [edi]
push ebx
lea esi, [eax + edx]
push 0
push esi
call fcn.004620e0
add esp, 0xc
mov byte [esi + ebx], 0
jmp 0x405923
push 0
push ebx
mov byte [ebp - 8], 0
mov ecx, edi
push dword [ebp - 8]
push ebx
call fcn.00409920
cmp dword [edi + 0x14], 0x10
jb 0x40592b
mov edi, dword [edi]
mov esi, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov dword [ebp - 8], eax
test esi, esi
jle 0x405968
nop dword [eax]
mov eax, dword [ebp - 4]
push 0
push esi
push edi
push dword [eax + 0x60]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x405973
sub esi, eax
add edi, eax
call ebx
sub eax, dword [ebp - 8]
cmp eax, 0x7530
ja 0x405973
test esi, esi
jg 0x405940
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x405980
Capabilities:
Check for time delay via gettickcount
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 4], ecx
lea edi, [ebp + 8]
lea eax, [ebx + 0x10]
mov esi, 4
mov dword [ebp - 0xc], eax
mov eax, dword [eax]
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
nop dword [eax + eax]
mov eax, dword [ebp - 4]
push 0
push esi
push edi
push dword [eax + 0x60]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x4059fc
sub esi, eax
add edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
cmp eax, 0x7530
ja 0x4059fc
test esi, esi
jg 0x4059b0
cmp dword [ebx + 0x14], 0x10
jb 0x4059e5
mov ebx, dword [ebx]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
push dword [eax]
push ebx
call fcn.004056c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x406160
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
cmp esi, eax
je 0x406187
cmp dword [eax + 0x14], 0x10
mov ecx, eax
jb 0x40617c
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
mov ecx, esi
call fcn.00408980
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 0x18]
cmp ecx, eax
je 0x4061a4
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x40619b
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.00408980
mov eax, dword [ebp + 0x10]
lea ecx, [esi + 0x30]
cmp ecx, eax
je 0x4061c1
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x4061b8
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.00408980
mov eax, dword [ebp + 0x14]
lea ecx, [esi + 0x48]
cmp ecx, eax
je 0x4061de
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x4061d5
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.00408980
push esi
lea ecx, [ebp - 0x18]
call fcn.00408430
cmp dword [ebp - 8], 2
jae 0x40623b
mov edx, dword [ebp - 4]
cmp edx, 0x10
jb 0x406221
mov ecx, dword [ebp - 0x18]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406217
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4062e4
push edx
push ecx
call fcn.00460334
add esp, 8
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x40622b
mov eax, dword [esi]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x406298
or eax, 0xffffffff
jmp 0x40629f
cmp dword [ebp - 4], 0x10
lea eax, [ebp - 0x18]
mov edi, dword [sym.imp.WS2_32.dll_inet_addr]
cmovae eax, dword [ebp - 0x18]
push eax
call edi
mov edx, dword [ebp - 4]
cmp eax, 0xffffffff
setne bl
cmp edx, 0x10
jb 0x406285
mov ecx, dword [ebp - 0x18]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40627b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4062e4
push edx
push ecx
call fcn.00460334
add esp, 8
test bl, bl
je 0x406221
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x406293
mov eax, dword [esi]
push eax
call edi
jmp 0x40629f
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, esi
mov dword [esi + 0x64], eax
call fcn.004062f0
mov edi, eax
test edi, edi
jne 0x4062b8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esi + 0x60]
cmp eax, 0xffffffff
je 0x4062d9
push 2
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
push dword [esi + 0x60]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 0x60], 0xffffffff
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.00465850
int3
Function at 0x406be0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x194
lea eax, [esp + 4]
push esi
mov esi, ecx
push 0x190
push 0
push eax
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x18], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0xf
mov dword [esi + 0x30], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0xf
mov dword [esi + 0x48], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0xf
mov dword [esi + 0x94], 0
call fcn.004620e0
add esp, 0xc
lea eax, [esp + 8]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [esi + 0x60], 0xffffffff
mov eax, esi
mov byte [esi + 0x68], 0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40adb0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x485cce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
call fcn.0040ab20
mov dword [ebp - 4], 0
mov eax, esi
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x14], 1
jb 0x40ae02
mov eax, dword [esi]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x40ae72
xor ecx, ecx
mov edx, 2
mul edx
push ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046056e
add esp, 4
mov ebx, eax
cmp dword [esi + 0x14], 8
jb 0x40ae38
mov esi, dword [esi]
push dword [ebp - 0x10]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
inc eax
cmp eax, dword [ebp - 0x10]
jne 0x40ae68
mov ecx, ebx
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ae50
sub ecx, edx
sar ecx, 1
push ecx
push ebx
mov ecx, edi
call fcn.00408820
push ebx
call fcn.004600ae
add esp, 4
pop ebx
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x40eee0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x486106
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 8]
je 0x40ef80
push esi
mov esi, dword [ebp + 8]
lea ecx, [edi + 0xc]
mov dword [edi], vtable.CFileToUpdate.0
mov dword [ebp - 0x10], edi
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
lea eax, [esi + 0xc]
push eax
call fcn.0040ab20
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x2c]
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], ecx
lea ecx, [edi + 0x34]
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
lea eax, [esi + 0x34]
push eax
call fcn.0040ab20
lea eax, [esi + 0x4c]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0x4c]
call fcn.0040ab20
lea eax, [esi + 0x64]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x64]
call fcn.0040ab20
sub dword [ebx + 4], 0xffffff80
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push dword [ebp + 8]
push edi
call fcn.0040f340
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x41dc60
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x487405
push eax
mov dword fs:[0], esp
push esi
push edi
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 1
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [eax]
test eax, eax
je 0x41dc95
push eax
call esi
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x41dca1
push eax
call esi
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x41dcaf
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x14]
cmp dword [eax + 0x10], 0
je 0x41dcc7
cmp dword [eax + 0x14], 8
jb 0x41dcc0
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
push 0x3b0
lea eax, [ebp + 0x30]
mov ecx, edi
push eax
lea eax, [ebp + 0x18]
push eax
push 0xffffffffffffffff
call fcn.00414c00
mov eax, dword [edi + 0x61c]
mov ecx, 2
mov edx, dword [ebp + 0x2c]
cmp eax, ecx
cmovl eax, ecx
mov dword [edi + 0x61c], eax
mov eax, dword [ebp + 0x48]
mov esi, dword [eax]
cmp edx, 8
jb 0x41dd30
mov ecx, dword [ebp + 0x18]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41dd26
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41dd8e
push edx
push ecx
call fcn.00460334
add esp, 8
mov edx, dword [ebp + 0x44]
xor eax, eax
mov dword [ebp + 0x28], 0
mov dword [ebp + 0x2c], 7
mov word [ebp + 0x18], ax
cmp edx, 8
jb 0x41dd7a
mov ecx, dword [ebp + 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41dd70
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41dd8e
push edx
push ecx
call fcn.00460334
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 0x44
call fcn.00465850
int3
Function at 0x42a7f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4858f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov eax, ecx
push esi
push edi
push 8
mov dword [ebp - 0x10], eax
mov dword [eax], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.004600b3
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.0044b00c
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
pop edi
pop esi
mov dword [edx], 0
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x430910
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, 0xffff
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp ax, di
jne 0x430931
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push ebx
mov ecx, dword [eax]
test ecx, ecx
je 0x430965
mov edx, dword [esi + 0x30]
mov ebx, dword [edx]
lea eax, [ecx + ebx*2]
cmp ecx, eax
jae 0x430965
lea ecx, [ebx - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
pop ebx
mov ax, di
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x430a25
mov ebx, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [ebx], eax
jne 0x43098f
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov eax, dword [esi + 0x1c]
sar edx, 1
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x43099c
push dword [esi + 0x4c]
push edi
jmp 0x4309d8
movzx eax, di
mov dword [ebp - 4], eax
lea eax, [ebp + 8]
mov edx, dword [ecx]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 2]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x4309f8
sub eax, 1
je 0x4309f8
sub eax, 2
jne 0x430a25
push dword [esi + 0x4c]
push dword [ebp - 4]
call fcn.0046b120
mov ecx, 0xffff
add esp, 8
cmp ax, cx
movzx eax, di
jne 0x430a2a
pop ebx
pop edi
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x28]
sub ebx, eax
je 0x430a15
push dword [esi + 0x4c]
push ebx
push 1
push eax
call fcn.0046bb3f
add esp, 0x10
cmp ebx, eax
jne 0x430a25
lea eax, [ebp - 4]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 8], eax
jne 0x430959
mov eax, 0xffff
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x430e50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x430ee6
cmp byte [esi + 0x3e], 0
je 0x430ee6
mov eax, dword [esi]
push edi
push 0xffff
call dword [eax + 0xc]
mov ecx, 0xffff
cmp cx, ax
je 0x430ede
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x430eb0
sub eax, 1
je 0x430eb4
sub eax, 2
jne 0x430ede
mov byte [esi + 0x3e], al
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3e], 0
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x430ed1
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0046bb3f
add esp, 0x10
cmp edi, eax
jne 0x430ede
cmp byte [esi + 0x3e], 0
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x434e80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 8], edx
push esi
mov esi, ecx
test eax, eax
jne 0x434ea6
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov eax, esi
mov dword [esi], 1
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 4]
mov dword [ebp - 4], 0
mov ecx, eax
call fcn.00434e10
test eax, eax
je 0x434ed2
mov dword [esi], eax
mov eax, esi
mov dword [esi + 8], 0
mov dword [esi + 4], 0
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov edi, dword [ebp - 4]
lea eax, [edi + 2]
push eax
call fcn.0047018e
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x434efe
pop edi
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov eax, esi
pop ebx
mov dword [esi], 3
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
push edi
push 1
push ebx
call fcn.004700d4
add esp, 0x10
cmp eax, edi
je 0x434f37
push ebx
call fcn.00464973
add esp, 4
mov dword [esi + 8], 0
mov dword [esi], 2
mov eax, esi
mov dword [esi + 4], 0
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov edx, edi
mov ecx, ebx
call fcn.00431ea0
mov ecx, eax
cmp ecx, 2
je 0x434f4c
cmp ecx, 3
jne 0x434f5a
shr edi, 1
xor edx, edx
lea eax, [edi + edi]
mov word [eax + ebx], dx
lea edi, [eax + 2]
push dword [ebp + 0x14]
mov eax, dword [ebp - 8]
mov edx, eax
sub esp, 8
push ecx
push ecx
push edi
push ebx
push eax
mov ecx, esi
call fcn.00434c20
add esp, 0x20
mov eax, esi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43a330
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x43a416
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x43a405
jg 0x43a370
test edx, edx
je 0x43a405
nop dword [eax]
call fcn.004087c0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x43a3c4
jg 0x43a387
test esi, esi
je 0x43a3c4
cmp ebx, eax
jg 0x43a397
jl 0x43a391
cmp edi, esi
jae 0x43a397
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.00461b60
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x43a3e9
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x43a3ff
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x43a370
jl 0x43a3ff
test edi, edi
jne 0x43a370
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x43a438
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x43a43a
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x43a4b8
jg 0x43a44d
test esi, esi
je 0x43a4b8
test eax, eax
jl 0x43a49c
jg 0x43a457
test ebx, ebx
je 0x43a49c
cmp edi, eax
jg 0x43a467
jl 0x43a461
cmp esi, ebx
jae 0x43a467
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.00461b60
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x43a4b8
jg 0x43a49f
test esi, esi
je 0x43a4b8
jmp 0x43a49f
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x43a4b8
push eax
push esi
push 1
push edx
call fcn.0046bb3f
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc