joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x4c5517]
shl eax, 2
mov dword [0x4c551b], eax
push edx
push 0
call sub.kernel32.dll_GetModuleHandleA_1
mov edx, eax
call fcn.004b95bc
pop edx
call fcn.004b9520
call fcn.004b95fc
push 0
call fcn.004ba8d4
pop ecx
push 0x4c54c0
push 0
call sub.kernel32.dll_GetModuleHandleA_1
mov dword [0x4c551f], eax
push 0
jmp fcn.004bfe60
Function at 0x404358
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
mov dword [ebp - 4], edx
mov dword [ebp - 0x3c], eax
mov eax, 0x4c78a4
call fcn.004b9cc0
mov dword [ebp - 0x1c], 1
lea edx, [ebp - 4]
lea eax, [ebp - 4]
call fcn.004c3ca0
inc dword [ebp - 0x1c]
mov word [ebp - 0x28], 8
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 4]
call fcn.004042bc
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x40], eax
cmp eax, 0xffffffff
je 0x404409
push 0
push dword [ebp - 0x40]
call sub.kernel32.dll_GetFileSize_1
mov dword [0x4dea24], eax
push 0
lea edx, [ebp - 0x44]
push edx
push dword [0x4dea24]
push 0x4dda24
push dword [ebp - 0x40]
call sub.kernel32.dll_ReadFile_1
push dword [ebp - 0x40]
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x3c]
call fcn.0040456c
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x3c]
call fcn.00403d64
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ecx + 0x36c]
call sym.Project1.exe__THexEditor_SetModified_qqro
jmp 0x40454e
mov dl, byte [0x4dea28]
sub dl, 0x30
je 0x404426
dec dl
je 0x404472
sub dl, 7
je 0x4044be
jmp 0x404507
push 0x10
mov word [ebp - 0x28], 0x14
lea eax, [ebp - 8]
call fcn.0040165c
mov edx, eax
inc dword [ebp - 0x1c]
mov ecx, dword [0x4dd5c8]
mov eax, dword [ecx]
call fcn.00483d64
lea eax, [ebp - 8]
call fcn.004042bc
push eax
push 0x4c5d9b
push 0
call sub.USER32.dll_MessageBoxA_1
dec dword [ebp - 0x1c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004c3e54
jmp 0x40454e
push 0x10
mov word [ebp - 0x28], 0x20
lea eax, [ebp - 0xc]
call fcn.0040165c
mov edx, eax
inc dword [ebp - 0x1c]
mov ecx, dword [0x4dd5c8]
mov eax, dword [ecx]
call fcn.00483d64
lea eax, [ebp - 0xc]
call fcn.004042bc
push eax
push 0x4c5dae
push 0
call sub.USER32.dll_MessageBoxA_1
dec dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004c3e54
jmp 0x40454e
push 0x10
mov word [ebp - 0x28], 0x2c
lea eax, [ebp - 0x10]
call fcn.0040165c
mov edx, eax
inc dword [ebp - 0x1c]
mov ecx, dword [0x4dd5c8]
mov eax, dword [ecx]
call fcn.00483d64
lea eax, [ebp - 0x10]
call fcn.004042bc
push eax
push 0x4c5dc4
push 0
call sub.USER32.dll_MessageBoxA_1
dec dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004c3e54
jmp 0x40454e
push 0x10
mov word [ebp - 0x28], 0x38
lea eax, [ebp - 0x14]
call fcn.0040165c
mov edx, eax
inc dword [ebp - 0x1c]
mov ecx, dword [0x4dd5c8]
mov eax, dword [ecx]
call fcn.00483d64
lea eax, [ebp - 0x14]
call fcn.004042bc
push eax
push 0x4c5dd4
push 0
call sub.USER32.dll_MessageBoxA_1
dec dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004c3e54
dec dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004c3e54
mov ecx, dword [ebp - 0x38]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40c0cc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], eax
mov eax, 0x4c9900
call fcn.004b9cc0
mov word [ebp - 0x20], 8
lea eax, [ebp - 4]
call fcn.0040165c
mov edx, eax
inc dword [ebp - 0x14]
mov ecx, dword [sym.Project1.exe__Form1]
mov eax, dword [ecx + 0x350]
call fcn.00488c94
lea eax, [ebp - 4]
call fcn.004042bc
mov edx, eax
mov eax, dword [ebp - 0x34]
call fcn.0040c220
dec dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004c3e54
mov ecx, dword [ebp - 0x34]
mov eax, dword [ecx + 0x350]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
je 0x40c210
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
mov word [ebp - 0x20], 0x14
lea eax, [ebp - 8]
call fcn.0040165c
mov edx, eax
inc dword [ebp - 0x14]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ecx + 0x350]
call fcn.00488c94
lea eax, [ebp - 8]
call fcn.004042bc
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x3c], eax
cmp eax, 0xffffffff
setne dl
and edx, 1
push edx
dec dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004c3e54
pop ecx
test cl, cl
je 0x40c210
xor edx, edx
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0x36c]
call sym.Project1.exe__THexEditor_SetModified_qqro
push 0
lea edx, [ebp - 0x40]
push edx
push dword [0x4dea24]
push 0x4dda24
push dword [ebp - 0x3c]
call sub.kernel32.dll_WriteFile_1
push dword [ebp - 0x3c]
call sub.kernel32.dll_CloseHandle_1
mov word [ebp - 0x20], 0x20
lea eax, [ebp - 0xc]
call fcn.0040165c
mov edx, eax
inc dword [ebp - 0x14]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ecx + 0x350]
call fcn.00488c94
lea edx, [ebp - 0xc]
mov edx, dword [edx]
mov eax, dword [ebp - 0x34]
call fcn.00403d64
dec dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004c3e54
mov ecx, dword [ebp - 0x30]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x41319c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
movsx eax, byte [0x4c5664]
cmp eax, 0x30
jne 0x4131cb
push 0
push 0x4dec34
push 1
lea edx, [ebp - 5]
push edx
push dword [0x4dea64]
call sub.RT_USB.DLL_FT_W32_ReadFile_1
jmp 0x4131e3
push 0
push 0x4dec34
push 1
lea ecx, [ebp - 5]
push ecx
push dword [0x4dea64]
call sub.kernel32.dll_ReadFile_1
cmp dword [0x4dec34], 0
jne 0x4131f6
mov eax, 1
jmp 0x4133aa
cmp byte [ebp - 5], 0xd1
je 0x413206
mov eax, 1
jmp 0x4133aa
mov dl, byte [ebp - 5]
mov byte [ebp - 7], dl
movsx ecx, byte [0x4c5664]
cmp ecx, 0x30
jne 0x413232
push 0
push 0x4dec34
push 1
lea eax, [ebp - 6]
push eax
push dword [0x4dea64]
call sub.RT_USB.DLL_FT_W32_ReadFile_1
jmp 0x41324a
push 0
push 0x4dec34
push 1
lea edx, [ebp - 6]
push edx
push dword [0x4dea64]
call sub.kernel32.dll_ReadFile_1
cmp dword [0x4dec34], 0
jne 0x41325d
mov eax, 1
jmp 0x4133aa
mov dl, byte [ebp - 6]
xor byte [ebp - 7], dl
mov cl, byte [ebp - 6]
add cl, 0xfc
mov byte [0x4dead6], cl
movsx eax, byte [0x4c5664]
cmp eax, 0x30
jne 0x413296
push 0
push 0x4dec34
push 1
push 0x4dead5
push dword [0x4dea64]
call sub.RT_USB.DLL_FT_W32_ReadFile_1
jmp 0x4132af
push 0
push 0x4dec34
push 1
push 0x4dead5
push dword [0x4dea64]
call sub.kernel32.dll_ReadFile_1
cmp dword [0x4dec34], 0
jne 0x4132c2
mov eax, 1
jmp 0x4133aa
mov dl, byte [0x4dead5]
xor byte [ebp - 7], dl
add byte [ebp - 6], 0xfe
mov byte [ebp - 8], 2
mov cl, byte [ebp - 8]
cmp cl, byte [ebp - 6]
jae 0x413352
movsx eax, byte [0x4c5664]
cmp eax, 0x30
jne 0x413309
push 0
push 0x4dec34
push 1
xor edx, edx
mov dl, byte [ebp - 8]
add edx, 0x4dead5
push edx
push dword [0x4dea64]
call sub.RT_USB.DLL_FT_W32_ReadFile_1
jmp 0x413329
push 0
push 0x4dec34
push 1
xor ecx, ecx
mov cl, byte [ebp - 8]
add ecx, 0x4dead5
push ecx
push dword [0x4dea64]
call sub.kernel32.dll_ReadFile_1
cmp dword [0x4dec34], 0
jne 0x413339
mov eax, 1
jmp 0x4133aa
xor edx, edx
mov dl, byte [ebp - 8]
mov cl, byte [edx + 0x4dead5]
xor byte [ebp - 7], cl
inc byte [ebp - 8]
mov al, byte [ebp - 8]
cmp al, byte [ebp - 6]
jb 0x4132db
movsx edx, byte [0x4c5664]
cmp edx, 0x30
jne 0x413378
push 0
push 0x4dec34
push 1
lea ecx, [ebp - 5]
push ecx
push dword [0x4dea64]
call sub.RT_USB.DLL_FT_W32_ReadFile_1
jmp 0x413390
push 0
push 0x4dec34
push 1
lea eax, [ebp - 5]
push eax
push dword [0x4dea64]
call sub.kernel32.dll_ReadFile_1
cmp dword [0x4dec34], 0
jne 0x4133a8
mov dl, byte [ebp - 5]
cmp dl, byte [ebp - 7]
je 0x4133a8
mov eax, 1
jmp 0x4133aa
xor eax, eax
pop ecx
pop ecx
pop ebp
ret
Function at 0x41a5d8
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 4], eax
mov eax, dword [0x4cf24e]
mov dword [ebp - 0x10], eax
mov edx, dword [0x4cf252]
mov dword [ebp - 0x14], edx
cmp byte [0x4dec72], 0
je 0x41a611
push 4
push 0x80
lea ecx, [ebp - 0x14]
mov dl, 0x23
mov eax, dword [ebp - 4]
call fcn.0041a9f0
jmp 0x41a625
push 4
push 0x80
lea ecx, [ebp - 0x10]
mov dl, 0x23
mov eax, dword [ebp - 4]
call fcn.0041a9f0
mov eax, dword [ebp - 4]
call fcn.0041ad44
test eax, eax
je 0x41a638
mov al, 3
jmp 0x41a6f5
mov dl, byte [0x4dead8]
mov byte [ebp - 0x16], dl
mov cl, byte [0x4dead7]
mov byte [ebp - 0x15], cl
push 0
push 0x80
push 4
push 0
push 1
push 0xc0000000
push 0x4cf452
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x41a6f3
push 0
push dword [ebp - 8]
call sub.kernel32.dll_GetFileSize_1
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x19], 0
xor edx, edx
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0xc]
jae 0x41a6d6
push 0
push 0x4dec34
push 2
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
call sub.kernel32.dll_ReadFile_1
push 2
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x16]
push ecx
call fcn.004b9b4c
add esp, 0xc
test eax, eax
jne 0x41a6c7
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle_1
mov al, 0xf
jmp 0x41a6f5
add dword [ebp - 0x20], 2
inc byte [ebp - 0x19]
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0xc]
jb 0x41a690
push 0
push 0x4dec34
push 2
lea ecx, [ebp - 0x16]
push ecx
push dword [ebp - 8]
call sub.kernel32.dll_WriteFile_1
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41ad44
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
movsx eax, byte [0x4c5664]
cmp eax, 0x30
jne 0x41ad73
push 0
push 0x4dec34
push 1
lea edx, [ebp - 6]
push edx
push dword [0x4dea64]
call sub.RT_USB.DLL_FT_W32_ReadFile_1
jmp 0x41ad8b
push 0
push 0x4dec34
push 1
lea ecx, [ebp - 6]
push ecx
push dword [0x4dea64]
call sub.kernel32.dll_ReadFile_1
cmp dword [0x4dec34], 0
jne 0x41ad9e
mov eax, 1
jmp 0x41afa6
mov dl, byte [ebp - 6]
mov byte [ebp - 7], dl
test byte [ebp - 6], 0xc0
je 0x41ae5c
movsx ecx, byte [0x4c5664]
cmp ecx, 0x30
jne 0x41add4
push 0
push 0x4dec34
push 1
lea eax, [ebp - 5]
push eax
push dword [0x4dea64]
call sub.RT_USB.DLL_FT_W32_ReadFile_1
jmp 0x41adec
push 0
push 0x4dec34
push 1
lea edx, [ebp - 5]
push edx
push dword [0x4dea64]
call sub.kernel32.dll_ReadFile_1
cmp dword [0x4dec34], 0
jne 0x41adff
mov eax, 1
jmp 0x41afa6
mov dl, byte [ebp - 5]
add byte [ebp - 7], dl
movsx ecx, byte [0x4c5664]
cmp ecx, 0x30
jne 0x41ae2b
push 0
push 0x4dec34
push 1
lea eax, [ebp - 5]
push eax
push dword [0x4dea64]
call sub.RT_USB.DLL_FT_W32_ReadFile_1
jmp 0x41ae43
push 0
push 0x4dec34
push 1
lea edx, [ebp - 5]
push edx
push dword [0x4dea64]
call sub.kernel32.dll_ReadFile_1
cmp dword [0x4dec34], 0
jne 0x41ae56
mov eax, 1
jmp 0x41afa6
mov dl, byte [ebp - 5]
add byte [ebp - 7], dl
and byte [ebp - 6], 0x3f
mov cl, byte [ebp - 6]
add cl, 0xff
mov byte [0x4dead6], cl
movsx eax, byte [0x4c5664]
cmp eax, 0x30
jne 0x41ae93
push 0
push 0x4dec34
push 1
push 0x4dead5
push dword [0x4dea64]
call sub.RT_USB.DLL_FT_W32_ReadFile_1
jmp 0x41aeac
push 0
push 0x4dec34
push 1
push 0x4dead5
push dword [0x4dea64]
call sub.kernel32.dll_ReadFile_1
cmp dword [0x4dec34], 0
jne 0x41aebf
mov eax, 1
jmp 0x41afa6
mov dl, byte [0x4dead5]
add byte [ebp - 7], dl
inc byte [ebp - 6]
mov byte [ebp - 8], 2
mov cl, byte [ebp - 8]
cmp cl, byte [ebp - 6]
jae 0x41af4e
movsx eax, byte [0x4c5664]
cmp eax, 0x30
jne 0x41af05
push 0
push 0x4dec34
push 1
xor edx, edx
mov dl, byte [ebp - 8]
add edx, 0x4dead5
push edx
push dword [0x4dea64]
call sub.RT_USB.DLL_FT_W32_ReadFile_1
jmp 0x41af25
push 0
push 0x4dec34
push 1
xor ecx, ecx
mov cl, byte [ebp - 8]
add ecx, 0x4dead5
push ecx
push dword [0x4dea64]
call sub.kernel32.dll_ReadFile_1
cmp dword [0x4dec34], 0
jne 0x41af35
mov eax, 1
jmp 0x41afa6
xor edx, edx
mov dl, byte [ebp - 8]
mov cl, byte [edx + 0x4dead5]
add byte [ebp - 7], cl
inc byte [ebp - 8]
mov al, byte [ebp - 8]
cmp al, byte [ebp - 6]
jb 0x41aed7
movsx edx, byte [0x4c5664]
cmp edx, 0x30
jne 0x41af74
push 0
push 0x4dec34
push 1
lea ecx, [ebp - 5]
push ecx
push dword [0x4dea64]
call sub.RT_USB.DLL_FT_W32_ReadFile_1
jmp 0x41af8c
push 0
push 0x4dec34
push 1
lea eax, [ebp - 5]
push eax
push dword [0x4dea64]
call sub.kernel32.dll_ReadFile_1
cmp dword [0x4dec34], 0
jne 0x41afa4
mov dl, byte [ebp - 5]
cmp dl, byte [ebp - 7]
je 0x41afa4
mov eax, 1
jmp 0x41afa6
xor eax, eax
pop ecx
pop ecx
pop ebp
ret
Function at 0x41d5d0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 4], eax
mov eax, dword [0x4d058a]
mov dword [ebp - 0xc], eax
mov al, byte [0x4d058e]
mov byte [ebp - 8], al
mov edx, dword [0x4d058f]
mov dword [ebp - 0x10], edx
mov byte [ebp - 0x11], 0x70
push 5
lea ecx, [ebp - 0xc]
mov dl, 0x2b
mov eax, dword [ebp - 4]
call fcn.0041d2bc
test eax, eax
je 0x41d612
mov al, 4
jmp 0x41d797
mov eax, dword [ebp - 4]
call fcn.0041ceec
test eax, eax
je 0x41d625
mov al, 3
jmp 0x41d797
cmp byte [0x4dead5], 9
je 0x41d635
mov al, 6
jmp 0x41d797
push 4
lea ecx, [ebp - 0x10]
mov dl, 0x1a
mov eax, dword [ebp - 4]
call fcn.0041d2bc
test eax, eax
je 0x41d64f
mov al, 4
jmp 0x41d797
movsx edx, byte [0x4c5664]
cmp edx, 0x30
jne 0x41d68e
push 0
push 0x4dec34
push 1
lea ecx, [ebp - 0x11]
push ecx
push dword [0x4dea64]
call sub.RT_USB.DLL_FT_W32_WriteFile_1
push 0
push 0x4dec34
push 1
push 0x4dead5
push dword [0x4dea64]
call sub.RT_USB.DLL_FT_W32_ReadFile_1
jmp 0x41d6bf
push 0
push 0x4dec34
push 1
lea eax, [ebp - 0x11]
push eax
push dword [0x4dea64]
call sub.kernel32.dll_WriteFile_1
push 0
push 0x4dec34
push 1
push 0x4dead5
push dword [0x4dea64]
call sub.kernel32.dll_ReadFile_1
mov eax, dword [ebp - 4]
call fcn.0041d79c
test eax, eax
je 0x41d6d2
mov al, 3
jmp 0x41d797
movsx edx, byte [0x4c5664]
cmp edx, 0x30
jne 0x41d712
push 0
push 0x4dec34
push 1
push 0x4dec98
push dword [0x4dea64]
call sub.RT_USB.DLL_FT_W32_WriteFile_1
push 0
push 0x4dec34
push 1
push 0x4dead5
push dword [0x4dea64]
call sub.RT_USB.DLL_FT_W32_ReadFile_1
jmp 0x41d744
push 0
push 0x4dec34
push 1
push 0x4dec98
push dword [0x4dea64]
call sub.kernel32.dll_WriteFile_1
push 0
push 0x4dec34
push 1
push 0x4dead5
push dword [0x4dea64]
call sub.kernel32.dll_ReadFile_1
movsx ecx, byte [0x4c5664]
cmp ecx, 0x30
jne 0x41d76a
push 0
push 0x4dec34
push 1
lea eax, [ebp - 0x11]
push eax
push dword [0x4dea64]
call sub.RT_USB.DLL_FT_W32_ReadFile_1
jmp 0x41d782
push 0
push 0x4dec34
push 1
lea edx, [ebp - 0x11]
push edx
push dword [0x4dea64]
call sub.kernel32.dll_ReadFile_1
cmp dword [0x4dec34], 0
je 0x41d791
cmp byte [ebp - 0x11], 0x71
je 0x41d795
mov al, 5
jmp 0x41d797
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41d79c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
movsx eax, byte [0x4c5664]
cmp eax, 0x30
jne 0x41d7cb
push 0
push 0x4dec34
push 1
lea edx, [ebp - 5]
push edx
push dword [0x4dea64]
call sub.RT_USB.DLL_FT_W32_ReadFile_1
jmp 0x41d7e3
push 0
push 0x4dec34
push 1
lea ecx, [ebp - 5]
push ecx
push dword [0x4dea64]
call sub.kernel32.dll_ReadFile_1
cmp dword [0x4dec34], 0
jne 0x41d7f6
mov eax, 1
jmp 0x41d94b
mov dl, byte [ebp - 5]
mov byte [0x4dec98], dl
mov cl, byte [ebp - 5]
add cl, 0xfe
mov byte [0x4dead6], cl
movsx eax, byte [0x4c5664]
cmp eax, 0x30
jne 0x41d832
push 0
push 0x4dec34
push 1
push 0x4dead5
push dword [0x4dea64]
call sub.RT_USB.DLL_FT_W32_ReadFile_1
jmp 0x41d84b
push 0
push 0x4dec34
push 1
push 0x4dead5
push dword [0x4dea64]
call sub.kernel32.dll_ReadFile_1
cmp dword [0x4dec34], 0
jne 0x41d85e
mov eax, 1
jmp 0x41d94b
mov dl, byte [0x4dead5]
xor byte [0x4dec98], dl
mov byte [ebp - 6], 2
mov cl, byte [ebp - 6]
cmp cl, byte [ebp - 5]
jae 0x41d8f0
movsx eax, byte [0x4c5664]
cmp eax, 0x30
jne 0x41d8a4
push 0
push 0x4dec34
push 1
xor edx, edx
mov dl, byte [ebp - 6]
add edx, 0x4dead5
push edx
push dword [0x4dea64]
call sub.RT_USB.DLL_FT_W32_ReadFile_1
jmp 0x41d8c4
push 0
push 0x4dec34
push 1
xor ecx, ecx
mov cl, byte [ebp - 6]
add ecx, 0x4dead5
push ecx
push dword [0x4dea64]
call sub.kernel32.dll_ReadFile_1
cmp dword [0x4dec34], 0
jne 0x41d8d4
mov eax, 1
jmp 0x41d94b
xor edx, edx
mov dl, byte [ebp - 6]
mov cl, byte [edx + 0x4dead5]
xor byte [0x4dec98], cl
inc byte [ebp - 6]
mov al, byte [ebp - 6]
cmp al, byte [ebp - 5]
jb 0x41d876
movsx edx, byte [0x4c5664]
cmp edx, 0x30
jne 0x41d916
push 0
push 0x4dec34
push 1
lea ecx, [ebp - 5]
push ecx
push dword [0x4dea64]
call sub.RT_USB.DLL_FT_W32_ReadFile_1
jmp 0x41d92e
push 0
push 0x4dec34
push 1
lea eax, [ebp - 5]
push eax
push dword [0x4dea64]
call sub.kernel32.dll_ReadFile_1
cmp dword [0x4dec34], 0
jne 0x41d949
mov dl, byte [ebp - 5]
cmp dl, byte [0x4dec98]
je 0x41d949
mov eax, 1
jmp 0x41d94b
xor eax, eax
pop ecx
pop ecx
pop ebp
ret
Function at 0x41d950
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
add byte [ebp + 8], 2
movsx eax, byte [0x4c5664]
cmp eax, 0x30
jne 0x41d9a1
push 0
push 0x4dec34
push 1
lea edx, [ebp + 8]
push edx
push dword [0x4dea64]
call sub.RT_USB.DLL_FT_W32_WriteFile_1
push 0
push 0x4dec34
push 1
lea ecx, [ebp - 0xd]
push ecx
push dword [0x4dea64]
call sub.RT_USB.DLL_FT_W32_ReadFile_1
jmp 0x41d9d1
push 0
push 0x4dec34
push 1
lea eax, [ebp + 8]
push eax
push dword [0x4dea64]
call sub.kernel32.dll_WriteFile_1
push 0
push 0x4dec34
push 1
lea edx, [ebp - 0xd]
push edx
push dword [0x4dea64]
call sub.kernel32.dll_ReadFile_1
mov cl, byte [ebp + 8]
mov byte [ebp - 0xe], cl
movsx eax, byte [0x4c5664]
cmp eax, 0x30
jne 0x41da15
push 0
push 0x4dec34
push 1
lea edx, [ebp - 5]
push edx
push dword [0x4dea64]
call sub.RT_USB.DLL_FT_W32_WriteFile_1
push 0
push 0x4dec34
push 1
lea ecx, [ebp - 0xd]
push ecx
push dword [0x4dea64]
call sub.RT_USB.DLL_FT_W32_ReadFile_1
jmp 0x41da45
push 0
push 0x4dec34
push 1
lea eax, [ebp - 5]
push eax
push dword [0x4dea64]
call sub.kernel32.dll_WriteFile_1
push 0
push 0x4dec34
push 1
lea edx, [ebp - 0xd]
push edx
push dword [0x4dea64]
call sub.kernel32.dll_ReadFile_1
mov cl, byte [ebp - 5]
xor byte [ebp - 0xe], cl
mov byte [ebp - 0xf], 2
mov al, byte [ebp - 0xf]
cmp al, byte [ebp + 8]
jae 0x41dae1
movsx edx, byte [0x4c5664]
cmp edx, 0x30
jne 0x41da98
push 0
push 0x4dec34
push 1
push dword [ebp - 0xc]
push dword [0x4dea64]
call sub.RT_USB.DLL_FT_W32_WriteFile_1
push 0
push 0x4dec34
push 1
lea ecx, [ebp - 0xd]
push ecx
push dword [0x4dea64]
call sub.RT_USB.DLL_FT_W32_ReadFile_1
jmp 0x41dac7
push 0
push 0x4dec34
push 1
push dword [ebp - 0xc]
push dword [0x4dea64]
call sub.kernel32.dll_WriteFile_1
push 0
push 0x4dec34
push 1
lea eax, [ebp - 0xd]
push eax
push dword [0x4dea64]
call sub.kernel32.dll_ReadFile_1
mov edx, dword [ebp - 0xc]
mov cl, byte [edx]
xor byte [ebp - 0xe], cl
inc dword [ebp - 0xc]
inc byte [ebp - 0xf]
mov al, byte [ebp - 0xf]
cmp al, byte [ebp + 8]
jb 0x41da5b
movsx edx, byte [0x4c5664]
cmp edx, 0x30
jne 0x41db1f
push 0
push 0x4dec34
push 1
lea ecx, [ebp - 0xe]
push ecx
push dword [0x4dea64]
call sub.RT_USB.DLL_FT_W32_WriteFile_1
push 0
push 0x4dec34
push 1
lea eax, [ebp - 0xd]
push eax
push dword [0x4dea64]
call sub.RT_USB.DLL_FT_W32_ReadFile_1
jmp 0x41db4f
push 0
push 0x4dec34
push 1
lea edx, [ebp - 0xe]
push edx
push dword [0x4dea64]
call sub.kernel32.dll_WriteFile_1
push 0
push 0x4dec34
push 1
lea ecx, [ebp - 0xd]
push ecx
push dword [0x4dea64]
call sub.kernel32.dll_ReadFile_1
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x420e10
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x420ef0
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call sym.Project1.exe__Fgint_FGIntToBase2String_qqrrx12Fgint_TFGIntr17System_AnsiString
mov byte [ebp - 0xe], 4
mov eax, dword [ebp - 0x14]
call fcn.004b7238
cmp eax, 0x1cc
jge 0x420e55
mov byte [ebp - 0xe], 7
mov eax, dword [ebp - 0x14]
call fcn.004b7238
cmp eax, 0x12c
jge 0x420e68
mov byte [ebp - 0xe], 0xd
mov eax, dword [ebp - 0x14]
call fcn.004b7238
cmp eax, 0x104
jge 0x420e7b
mov byte [ebp - 0xe], 0x13
mov eax, dword [ebp - 0x14]
call fcn.004b7238
cmp eax, 0xc8
jge 0x420e8e
mov byte [ebp - 0xe], 0x1d
mov eax, dword [ebp - 0x14]
call fcn.004b7238
cmp eax, 0xa0
jge 0x420ea1
mov byte [ebp - 0xe], 0x25
mov byte [ebp - 0xd], 0
jmp 0x420ed4
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 0xe]
call sym.Project1.exe__Ecgfp_ECPrimeSearch_qqrr12Fgint_TFGIntuc
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0xd]
push eax
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
call sym.Project1.exe__Ecgfp_ConstructCurveAndPoint_qqrr12Fgint_TFGIntit1t1t1t1r14Ecgfp_TECPointro
cmp byte [ebp - 0xd], 0
je 0x420ea7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420ef7
lea eax, [ebp - 0x14]
call fcn.004b6fb8
ret

Function at 0x4273e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, edx
dec eax
test eax, eax
jb 0x42740e
inc eax
xor edx, edx
mov dl, byte [ebx]
mov esi, dword [ecx]
and esi, 0xff
xor edx, esi
mov edx, dword [edx*4 + 0x4d362c]
mov esi, dword [ecx]
shr esi, 8
xor edx, esi
mov dword [ecx], edx
inc ebx
dec eax
jne 0x4273ec
pop esi
pop ebx
ret