joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cdf6
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 4], 0
cmp dword [0x43d063], 0
je 0x40cf9f
cmp dword [ebp + 0xc], 0x20
jne 0x40ce3c
cmp dword [0x44b710], 1
jne 0x40cf9f
push 0
call sub.USER32.dll_SetCursor
mov dword [ebp - 4], 1
mov eax, 1
jmp 0x40cf9f
cmp dword [ebp + 0xc], 6
jne 0x40ce6d
and dword [ebp + 0x10], 0xffff
cmp dword [ebp + 0x10], 0
jne 0x40ce5e
mov dword [0x44b6f8], 0
jmp 0x40cf9f
mov dword [0x44b6f8], 1
jmp 0x40cf9f
cmp dword [ebp + 0xc], 0x112
jne 0x40ce9b
and dword [ebp + 0x10], 0xfff0
cmp dword [ebp + 0x10], 0xf140
jne 0x40cf9f
mov dword [ebp - 4], 1
mov eax, 0
jmp 0x40cf9f
cmp dword [ebp + 0xc], 0x100
je 0x40cebf
cmp dword [ebp + 0xc], 0x201
je 0x40cebf
cmp dword [ebp + 0xc], 0x204
je 0x40cebf
cmp dword [ebp + 0xc], 0x207
jne 0x40cef9
cmp dword [0x44b710], 1
jne 0x40cf9f
push 0
push 0x3f2
push 0x111
push dword [0x43b160]
call sub.USER32.dll_SendMessageA
call fcn.0040d230
mov dword [ebp - 4], 1
mov eax, 0
jmp 0x40cf9f
cmp dword [ebp + 0xc], 0x200
jne 0x40cf8f
cmp dword [0x44b710], 1
jne 0x40cf9f
cmp dword [0x44b704], 0
jne 0x40cf44
push 0x44b708
call sub.USER32.dll_GetCursorPos
mov dword [0x44b704], 1
push dword [0x44b708]
pop dword [ebp - 0xc]
push dword [0x44b70c]
pop dword [ebp - 8]
jmp 0x40cf4d
lea eax, [ebp - 0xc]
push eax
call sub.USER32.dll_GetCursorPos
mov eax, dword [ebp - 0xc]
cmp eax, dword [0x44b708]
jne 0x40cf65
mov eax, dword [ebp - 8]
cmp eax, dword [0x44b70c]
jne 0x40cf65
jmp 0x40cf8d
push 0
push 0x3f2
push 0x111
push dword [0x43b160]
call sub.USER32.dll_SendMessageA
call fcn.0040d230
mov dword [ebp - 4], 1
mov eax, 0
jmp 0x40cf9f
cmp dword [ebp + 0xc], 0x10
jne 0x40cf9f
mov dword [0x44b6f8], 0
mov ebx, dword [ebp + 0x18]
push dword [ebp - 4]
pop dword [ebx]
pop ebx
leave
ret 0x14
Function at 0x40d74d
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push esi
push edi
push ecx
cmp dword [0x43d0df], 0
je 0x40d764
pop ecx
pop edi
pop esi
leave
ret
cmp dword [0x43d0d3], 0
je 0x40d8b4
mov eax, dword [0x43d0d3]
dec eax
push eax
call fcn.0040ec9e
mov edi, eax
mov eax, dword [edi + 8]
mov edx, 0
div dword [edi + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi]
add eax, dword [edi + 8]
add eax, edi
mov esi, eax
mov dword [ebp - 4], esi
mov ecx, dword [edi + 4]
mov dword [ebp - 0xc], 0
cmp ecx, 0
jbe 0x40d7c8
sub esi, dword [ebp - 8]
cmp dword [esi + 0x2c], 0
jne 0x40d7b4
inc dword [ebp - 0xc]
cmp dword [esi + 0x38], 0x28
jne 0x40d7c6
cmp dword [0x43d0f7], 0
jne 0x40d7c6
dec dword [ebp - 0xc]
loop 0x40d7a8
push dword [ebp - 0xc]
pop dword [0x43d0e3]
cmp dword [0x43d0e3], 0
jbe 0x40d8b4
mov eax, 0x58
mul dword [0x43d0e3]
mov dword [ebp - 0xc], eax
push 0x40
push 0x1000
push dword [ebp - 0xc]
push 0
call sub.KERNEL32.dll_VirtualAlloc
mov dword [0x43d0df], eax
cmp dword [0x43d0df], 0
je 0x40d8b4
mov edi, dword [ebp - 4]
mov esi, dword [0x43d0df]
add esi, dword [ebp - 0xc]
mov ecx, dword [0x43d0e3]
mov dword [ebp - 0xc], 1
sub edi, dword [ebp - 8]
cmp dword [edi + 0x2c], 0
je 0x40d833
jmp 0x40d828
cmp dword [edi + 0x38], 0x28
jne 0x40d844
cmp dword [0x43d0f7], 0
jne 0x40d844
jmp 0x40d828
sub esi, 0x58
push dword [ebp - 0xc]
pop dword [esi]
inc dword [ebp - 0xc]
mov byte [esi + 0x18], 1
mov eax, dword [edi + 0x1c]
mov byte [esi + 0x25], al
mov eax, dword [edi + 0x20]
mov byte [esi + 0x27], al
mov eax, dword [edi + 0x2c]
mov byte [esi + 0x26], al
lea eax, [esi + 0x34]
mov dword [esi + 0x2c], eax
push dword [edi + 0x14]
pop dword [esi + 0x34]
push dword [edi + 4]
pop dword [esi + 0x38]
push dword [edi + 8]
pop dword [esi + 0x3c]
push dword [edi + 0xc]
pop dword [esi + 0x40]
push dword [edi + 0x10]
pop dword [esi + 0x54]
push dword [edi + 0x30]
pop dword [esi + 0x50]
push dword [edi + 0x34]
pop dword [esi + 0x4c]
push dword [edi + 0x18]
pop dword [esi + 0x19]
push dword [edi + 0x24]
pop dword [esi + 0x1d]
push dword [edi + 0x28]
pop dword [esi + 0x21]
push dword [edi + 0x38]
pop dword [esi + 4]
dec ecx
jne 0x40d828
pop ecx
pop edi
pop esi
leave
ret
Function at 0x40edc6
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], 0
cmp dword [ebp + 0x18], 1
je 0x40eddf
cmp dword [ebp + 0x18], 2
jne 0x40ede4
mov eax, dword [ebp + 8]
jmp 0x40edfe
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x40ee10
mov dword [ebp - 0xc], 1
je 0x40ee9c
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0x18], 2
jne 0x40ee27
push dword [ebp + 0xc]
pop dword [ebp - 0x18]
push dword [ebp + 0x10]
pop dword [ebp - 0x10]
jmp 0x40ee5f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0x14]
call sub.KERNEL32.dll_FindResourceA
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp + 0x14]
call sub.KERNEL32.dll_SizeofResource
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push dword [ebp + 0x14]
call sub.KERNEL32.dll_LoadResource
mov dword [ebp - 8], eax
push dword [ebp - 8]
call sub.KERNEL32.dll_LockResource
mov dword [ebp - 0x18], eax
push 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call sub.KERNEL32.dll_WriteFile
or eax, eax
jne 0x40ee7e
mov dword [ebp - 0xc], 1
push dword [ebp - 0x14]
call sub.KERNEL32.dll_CloseHandle
cmp dword [ebp + 0x18], 2
je 0x40ee9c
push dword [ebp - 8]
call sub.KERNEL32.dll_CloseHandle
push dword [ebp - 4]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0xc]
leave
ret 0x14

Function at 0x40eea3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
call fcn.0040ecbb
mov dword [ebp - 8], eax
push dword [ebp + 0xc]
call fcn.0040ec9e
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
or eax, eax
jne 0x40eee5
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
leave
ret 8
Function at 0x412cd9
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff990
push edx
lea eax, [ebp - 0x654]
push eax
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
mov dword [ebp - 0x670], eax
lea eax, [ebp - 0x550]
push eax
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
mov dword [ebp - 0x4c], 0x4c
mov eax, dword [0x43b160]
mov dword [ebp - 0x48], eax
push 0x400
push 0x44cd9f
call sub.KERNEL32.dll_RtlZeroMemory
push str.EXE_file
call sub.KERNEL32.dll_lstrlenA
mov dword [ebp - 0x66c], eax
inc dword [ebp - 0x66c]
push dword [ebp - 0x66c]
push 0x44cd9f
push str.EXE_file
call fcn.0042b270
mov eax, dword [ebp - 0x66c]
add eax, 0x44cd9f
mov dword [ebp - 0x66c], eax
push 6
push dword [ebp - 0x66c]
push str..exe
call fcn.0042b270
mov dword [ebp - 0x40], 0x44cd9f
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x32
mov dword [ebp - 0x34], 1
push 0x43b18c
call sub.KERNEL32.dll_lstrlenA
mov ebx, 0
jmp 0x412dab
mov bl, byte [eax + 0x43b18c]
dec eax
cmp eax, 0
jbe 0x412db5
cmp bl, 0x5c
jne 0x412da4
add eax, 2
add eax, 0x43b18c
push eax
lea eax, [ebp - 0x150]
push eax
call sub.KERNEL32.dll_lstrcpyA
lea eax, [ebp - 0x150]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0x104
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x550]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], str.Save_EXE_Book:
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x18], 0x806
mov word [ebp - 0x14], 0
mov word [ebp - 0x12], 0
lea eax, [ebp - 0x668]
mov byte [eax], 0
push 0x43c60f
push eax
call fcn.0042b220
lea eax, [ebp - 0x668]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x4c]
push eax
call sub.comdlg32.dll_GetSaveFileNameA
cmp eax, 1
jne 0x412e7c
push 0x400
lea eax, [ebp - 0x550]
push eax
call sub.KERNEL32.dll_RtlZeroMemory
push dword [ebp - 0x670]
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x550]
push eax
call fcn.00416539
push 0
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x550]
push eax
call sub.KERNEL32.dll_CopyFileA
pop edx
leave
ret
Function at 0x414503
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb98
push 0x104
lea eax, [ebp - 0x158]
push eax
call sub.KERNEL32.dll_RtlZeroMemory
push dword [ebp + 0xc]
lea eax, [ebp - 0x158]
push eax
call sub.KERNEL32.dll_lstrcatA
push 0x436c6c
push 0
push str.dnlbook
push 0x104
lea eax, [ebp - 0x158]
push eax
call fcn.0040b344
cmp eax, 0xffffffff
je 0x414611
mov dword [ebp - 0x468], eax
push dword [ebp + 8]
push dword [ebp - 0x468]
call fcn.0040eea3
or eax, eax
jne 0x414606
push 0x104
lea eax, [ebp - 0x25c]
push eax
call sub.KERNEL32.dll_GetWindowsDirectoryA
push str.dbplugin.exe
lea eax, [ebp - 0x25c]
push eax
call sub.KERNEL32.dll_lstrcatA
cmp dword [ebp + 0x10], 0
jne 0x4145a9
push 0x436c7f
lea eax, [ebp - 0x464]
push eax
call sub.KERNEL32.dll_lstrcpyA
jmp 0x4145ba
push 0x436c82
lea eax, [ebp - 0x464]
push eax
call sub.KERNEL32.dll_lstrcpyA
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x464]
push eax
call sub.KERNEL32.dll_lstrcatA
push 0x44
lea eax, [ebp - 0x44]
push eax
call sub.KERNEL32.dll_RtlZeroMemory
mov dword [ebp - 0x44], 0x44
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x25c]
push eax
call sub.KERNEL32.dll_CreateProcessA
push dword [ebp - 0x468]
call sub.KERNEL32.dll_CloseHandle
leave
ret 0xc

Function at 0x414615
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_RtlZeroMemory
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.KERNEL32.dll_GetTempPathA
test eax, eax
je 0x41467c
push str.dnadwb
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
cmp dword [ebp + 8], 0
je 0x414672
dec dword [ebp + 8]
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call fcn.00414503
jmp 0x41467c
push 0x43b498
call sub.KERNEL32.dll_DeleteFileA
leave
ret 8
Function at 0x41635b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ecx
push ebx
push 0x400
push 0x44cd9f
call sub.KERNEL32.dll_RtlZeroMemory
lea eax, [ebp - 0x108]
push eax
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
push eax
lea eax, [ebp - 0x108]
push eax
push 0x44cd9f
call fcn.00416539
mov dword [ebp - 4], 0x44cd9f
push dword [ebp - 4]
call sub.KERNEL32.dll_lstrlenA
mov dword [ebp - 8], eax
push 0x100
lea eax, [ebp - 0x108]
push eax
call sub.KERNEL32.dll_RtlZeroMemory
push dword [ebp - 8]
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 4]
call fcn.0042b270
mov eax, 1
jmp 0x4163e6
push 0x43b5ad
push dword [ebp - 4]
push 1
call fcn.0042b118
add dword [ebp - 4], eax
or eax, eax
jne 0x4163d4
mov byte [0x44b8c0], 0
push dword [ebp - 4]
push 0x44b8c0
call fcn.0042b220
cmp dword [0x43b937], 1
jne 0x416416
push dword [0x44b850]
push 0
call fcn.0040a161
jmp 0x416424
push str.This_email_attachment_has_been_sent_to_you_by_a_person_using_a_SendMail_facility_inside_the_DigitalWebBook._r_n_r_nPlease_refer_to_the_From:_line_in_the_header_of_this_e_mail_to_identify_the_sender._Please_note_that_if_you_can_not_view_the_attached_file_you_should_download_the_DigitalWebBook_plug_in_viewer_from_www.DigitalWebBooks.com_plugin._When_prompted__either_Open_or_Run_from_current_location._The_plug_in_viewer_will_be_automatically_installed_on_opening._Click_on_the_close_button_to_exit._r_n_r_nOnce_you_have_downloaded_the_152k_plug_in_viewer_which_will_take_approximately_30_seconds_on_a_56k_modem_you_will_be_able_to_view_DigitalWebBooks_in_the_.dnl_format._r_n_r_nEnjoy_the_DigitalWebBook_experience.
push 0x34
push 1
call fcn.00409e7d
mov dword [ebp - 4], eax
push 0x43b5b2
push 0x44b5fc
call fcn.0040a608
push 0x43b5b2
push 0x44b5fc
call fcn.0040a608
push dword [ebp - 4]
push 0x44b5fc
call fcn.0040a608
cmp dword [0x43d04b], 0
je 0x41646a
push 0
push dword [0x43d04b]
call fcn.0040a161
jmp 0x416470
lea eax, [0x43bf22]
mov dword [ebp - 8], eax
push 0x43b5a9
push 0x44b5f0
call fcn.0040a608
push 0x43b5d0
push 0x44b5f0
call fcn.0040a608
push 0x43b5a9
push 0x44b5f0
call fcn.0040a608
push dword [ebp - 8]
push 0x44b5f0
call fcn.0040a608
mov dword [ebp - 4], 0
mov dword [ebp - 8], 1
cmp dword [0x44b60c], 0
je 0x4164d0
push dword [0x44b608]
pop dword [ebp - 4]
inc dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp - 4]
push 0x44b8c0
lea eax, [ebp - 0x108]
push eax
push 0x44b940
push 0x44b940
push dword [0x44b5fc]
push dword [0x44b5f0]
push 1
push dword [ebp - 8]
call fcn.00416696
or eax, eax
je 0x416535
jmp 0x41650b
push eax
push 0x416508
push 0x44d59f
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push 0x44d59f
push 0x44d59f
push dword [0x43b160]
call sub.USER32.dll_MessageBoxA
pop ebx
pop ecx
leave
ret
Function at 0x4177dc
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
cmp dword [0x43b5fb], 0
jne 0x417844
push dword [0x43ba3f]
call sub.GDI32.dll_CreateCompatibleDC
mov dword [0x43b5fb], eax
cmp eax, 0
je 0x4179c5
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [0x43ba3f]
call sub.GDI32.dll_CreateCompatibleBitmap
or eax, eax
jne 0x417833
push dword [0x43b5fb]
call sub.GDI32.dll_DeleteDC
mov dword [0x43b5fb], 0
jmp 0x4179c5
push eax
push dword [0x43b5fb]
call sub.GDI32.dll_SelectObject
mov dword [0x43b5ff], eax
cmp dword [0x43b603], 1
jne 0x41791b
lea eax, [ebp - 0x20]
push eax
push dword [0x43b160]
call sub.USER32.dll_GetWindowRect
mov eax, dword [ebp - 0x20]
sub dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
sub dword [ebp - 0x14], eax
push 0
call fcn.0040d947
mov dword [0x43d10f], 1
mov dword [0x43d0eb], 1
push 1
push 1
push 1
push 0
push 0
push dword [0x43b160]
call sub.USER32.dll_MoveWindow
mov dword [0x43d0eb], 0
mov dword [0x43d10f], 0
cmp dword [0x43b74e], 1
jne 0x4178dd
lea eax, [ebp - 0x30]
push eax
push dword [0x44b72c]
call sub.USER32.dll_GetWindowRect
push 0
push 1
push 1
push 0
push 0
push dword [0x44b72c]
call sub.USER32.dll_MoveWindow
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
add eax, dword [ebp + 0x10]
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
add eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
push 0x4179c9
call sub.USER32.dll_EnumWindows
cmp dword [0x43b687], 1
jne 0x41791b
mov dword [0x43b687], 0
leave
ret 0x10
cmp dword [0x44d607], 5
jbe 0x41792e
push 0xc8
call sub.KERNEL32.dll_Sleep
push 0xcc0020
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x43ba3f]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
push 0
push dword [0x43b5fb]
call sub.GDI32.dll_BitBlt
cmp dword [0x43b603], 1
jne 0x4179c5
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [0x43b160]
call sub.USER32.dll_MoveWindow
cmp dword [0x43b74e], 1
jne 0x4179a4
mov eax, dword [ebp - 0x30]
sub dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x2c]
sub dword [ebp - 0x24], eax
push 1
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push dword [0x44b72c]
call sub.USER32.dll_MoveWindow
push dword [0x43ba8d]
call fcn.00417545
cmp eax, 1
jne 0x4179bb
push 0
call fcn.004182fe
mov dword [0x43b687], 0
leave
ret 0x10
Function at 0x418d11
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push edi
push esi
push edx
mov edi, dword [ebp + 8]
cmp dword [ebp + 0x14], 3
jne 0x418d2c
mov dword [ebp - 4], 0x3c
jmp 0x418d33
mov dword [ebp - 4], 0x20
push 0x40
push 0x1000
push dword [ebp - 4]
push 0
call sub.KERNEL32.dll_VirtualAlloc
or eax, eax
je 0x418d97
mov esi, eax
push dword [ebp + 0xc]
pop dword [esi + 8]
push dword [ebp + 0x14]
pop dword [esi + 0x10]
push dword [ebp + 0x10]
pop dword [esi + 0x14]
push dword [ebp + 0xc]
push esi
call fcn.0041bc44
mov dword [esi + 0xc], eax
cmp dword [ebp + 0x14], 3
jne 0x418d73
lea edx, [edi + 0xc]
jmp 0x418d76
lea edx, [edi + 0x18]
cmp dword [edx + 4], 0
jne 0x418d80
mov dword [edx], esi
jmp 0x418d8f
mov eax, esi
mov esi, dword [edx + 4]
mov dword [esi], eax
mov esi, eax
push dword [edx + 4]
pop dword [esi + 4]
mov dword [edx + 4], esi
inc dword [edx + 8]
mov eax, esi
pop edx
pop esi
pop edi
leave
ret 0x10

Function at 0x418d9e
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push edi
push esi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x18]
add eax, 0x3e8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [edi + 0x18], eax
jg 0x418e75
mov eax, dword [edi]
cmp eax, dword [edi + 4]
jg 0x418e75
push 0x40
push 0x1000
push 0x2c
push 0
call sub.KERNEL32.dll_VirtualAlloc
or eax, eax
je 0x418e6e
mov esi, eax
push esi
push dword [edi]
call fcn.00418b79
or eax, eax
jne 0x418e00
push 0x8000
push 0
push esi
call sub.KERNEL32.dll_VirtualFree
jmp 0x418e6e
cmp dword [edi + 0xc], 0
jne 0x418e0b
mov dword [edi + 8], esi
jmp 0x418e1a
mov eax, esi
mov esi, dword [edi + 0xc]
mov dword [esi], eax
mov esi, eax
push dword [edi + 0xc]
pop dword [esi + 4]
mov dword [edi + 0xc], esi
inc dword [edi + 0x10]
push dword [edi]
pop dword [esi + 8]
push 0x4199e0
push dword [esi + 0x18]
call fcn.00419c1e
mov dword [esi + 0x18], eax
lea eax, [esi + 0x18]
push eax
call fcn.00419063
push 0x419d4d
push dword [esi + 0xc]
call fcn.00419c71
or eax, eax
je 0x418e52
mov dword [esi + 0xc], eax
lea eax, [esi + 0xc]
push eax
call fcn.00419063
push esi
call fcn.004198a0
push esi
call fcn.00419178
push esi
push edi
call fcn.00418e7b
inc dword [edi]
jmp 0x418db4
pop esi
pop edi
leave
ret 4
Function at 0x418e7b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push edi
push esi
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x28], 0
jbe 0x418f13
cmp dword [esi + 0x24], 0
je 0x418f13
push dword [edi + 0x18]
pop dword [ebp - 8]
mov eax, dword [esi + 0x28]
add dword [edi + 0x18], eax
cmp dword [edi + 0x14], 0
jne 0x418eb3
push dword [esi + 0x24]
pop dword [edi + 0x14]
jmp 0x418f0d
mov eax, dword [edi + 0x18]
inc eax
push 0x40
push 0x1000
push eax
push 0
call sub.KERNEL32.dll_VirtualAlloc
or eax, eax
je 0x418f0d
mov dword [ebp - 4], eax
cmp dword [edi + 0x14], 0
je 0x418eed
push dword [edi + 0x14]
push dword [ebp - 4]
call sub.KERNEL32.dll_lstrcpyA
push 0x8000
push 0
push dword [edi + 0x14]
call sub.KERNEL32.dll_VirtualFree
push dword [ebp - 4]
pop dword [edi + 0x14]
push dword [esi + 0x24]
push dword [edi + 0x14]
call sub.KERNEL32.dll_lstrcatA
push 0x8000
push 0
push dword [esi + 0x24]
call sub.KERNEL32.dll_VirtualFree
push dword [ebp - 8]
pop dword [esi + 0x24]
pop esi
pop edi
leave
ret 8

Function at 0x418f19
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push edi
push esi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 8]
mov dword [ebp - 4], 0
mov eax, dword [edi + 0x1c]
dec eax
jmp 0x418f39
mov dword [ebp - 4], esi
mov esi, dword [esi]
or esi, esi
je 0x418f42
cmp eax, dword [esi + 0x24]
ja 0x418f34
or esi, esi
jne 0x418f55
cmp dword [ebp - 4], 0
je 0x418f55
mov esi, dword [ebp - 4]
push dword [esi + 4]
pop dword [ebp - 4]
cmp dword [ebp - 4], 0
je 0x418fff
or esi, esi
je 0x418fff
mov dword [ebp - 8], esi
push dword [esi + 0x24]
pop dword [ebp - 0x10]
mov eax, dword [edi + 0x18]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
inc eax
push 0x40
push 0x1000
push eax
push 0
call sub.KERNEL32.dll_VirtualAlloc
or eax, eax
je 0x418fff
mov dword [ebp - 0x18], eax
mov eax, dword [edi + 0x14]
add eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0x18]
call sub.KERNEL32.dll_lstrcpyA
push 0x8000
push 0
push dword [edi + 0x14]
call sub.KERNEL32.dll_VirtualFree
push dword [ebp - 0x18]
pop dword [edi + 0x14]
push dword [ebp - 0x14]
pop dword [edi + 0x18]
mov eax, dword [ebp - 0x10]
sub dword [edi + 0x1c], eax
mov esi, dword [ebp - 4]
jmp 0x418fe1
push dword [esi + 4]
pop dword [ebp - 0xc]
push esi
call fcn.004190b8
push 0x8000
push 0
push esi
call sub.KERNEL32.dll_VirtualFree
mov esi, dword [ebp - 0xc]
or esi, esi
jne 0x418fc5
mov esi, dword [ebp - 8]
mov dword [edi + 8], esi
mov eax, dword [ebp - 0x10]
jmp 0x418ffb
push dword [esi]
pop dword [ebp - 0xc]
sub dword [esi + 0x24], eax
mov esi, dword [ebp - 0xc]
or esi, esi
jne 0x418ff0
pop esi
pop edi
leave
ret 4
Function at 0x4192a4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push edi
push esi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
push dword [esi + 0x1c]
pop dword [ebp - 4]
push dword [edi + 0x14]
pop dword [ebp - 0xc]
mov eax, dword [esi + 0x24]
and eax, 1
je 0x419339
mov eax, dword [esi + 0x20]
inc eax
push 0x40
push 0x1000
push eax
push 0
call sub.KERNEL32.dll_VirtualAlloc
or eax, eax
jne 0x4192f0
jmp 0x41938e
mov dword [ebp - 8], eax
push eax
push dword [ebp - 4]
push eax
call sub.KERNEL32.dll_lstrcatA
pop dword [ebp - 4]
push dword [ebp - 4]
call sub.USER32.dll_CharLowerA
mov eax, dword [edi + 0x18]
inc eax
push 0x40
push 0x1000
push eax
push 0
call sub.KERNEL32.dll_VirtualAlloc
or eax, eax
jne 0x419321
jmp 0x41938e
mov dword [ebp - 0x10], eax
push eax
push dword [ebp - 0xc]
push eax
call sub.KERNEL32.dll_lstrcatA
pop dword [ebp - 0xc]
push dword [ebp - 0xc]
call sub.USER32.dll_CharLowerA
mov eax, dword [edi + 0x18]
sub eax, dword [esi + 0x20]
js 0x41938e
inc eax
mov dword [ebp - 0x14], eax
jmp 0x419389
mov eax, dword [edi + 0x1c]
dec eax
add eax, dword [ebp - 0xc]
push dword [ebp - 4]
push eax
push 1
call fcn.0040b661
cmp eax, 0
jbe 0x41937f
push eax
add eax, dword [esi + 0x20]
push dword [edi + 0x1c]
pop dword [ebp - 0x18]
add dword [edi + 0x1c], eax
pop eax
add eax, dword [ebp - 0x18]
dec eax
dec eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004193f4
jmp 0x419386
mov eax, dword [edi + 0x18]
inc eax
mov dword [edi + 0x1c], eax
mov eax, dword [ebp - 0x14]
cmp dword [edi + 0x1c], eax
jbe 0x419347
cmp dword [ebp - 8], 0
je 0x4193a3
push 0x8000
push 0
push dword [ebp - 8]
call sub.KERNEL32.dll_VirtualFree
cmp dword [ebp - 0x10], 0
je 0x4193b8
push 0x8000
push 0
push dword [ebp - 0x10]
call sub.KERNEL32.dll_VirtualFree
pop esi
pop edi
leave
ret 8