joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001cf62
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
cmp byte [0x100269c0], al
je 0x1001cf99
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cffd
push 0x103
push eax
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x107]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.1001091f
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.1001091f
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.1001091f
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ddeb
leave
ret 0x10

Function at 0x1001d00e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001d03a
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001d06b
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001d069
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.1001091f
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001d06b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1001ddeb
leave
ret 8

Function at 0x1001d106
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
mov eax, dword [ebp + 8]
je 0x1001d12e
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001d148
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.1001091f
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.1001ddeb
leave
ret 4

Function at 0x1001ddeb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100268b0]
jne 0x1001ddf5
repz ret
jmp fcn.1001e62c
Function at 0x5c044c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmc
not eax
ror dh, 4
adc dh, 0x7d
push eax
sub dh, 0x27
mov cl, byte [eax + edi]
cmp di, ax
add cl, cl
pop eax
bswap ax
setb dh
lea eax, [ecx*8 + 0x23f1907]
lea eax, [edx + 0x1dac2b9e]
bswap ax
lea eax, [ebx + edx*4 + 0x400]
pushal
pushal
push dword [esp + 4]
pushfd
lea esp, [esp + 0x4c]
call fcn.005f61e9
jmp 0x5c1e59
pushal
push 0x646b749c
push eax
adc dl, dl
call fcn.0051ad23
add byte [eax], al
push ebx
je 0x5c1ec0
arpl word [edx + 0x6f], si
insb byte es:[edi], dx
insb byte es:[edi], dx
push eax
outsd dx, dword [esi]
jae fcn.005c1e76
aam 0xe9
mov ch, 0x43
add eax, dword [eax]

Function at 0x5c0ef8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp eax, edx
jmp 0x5f5df2
mov eax, dword [esp + 0x3c]
jmp 0x5c21eb
push dword [esp + 4]
mov byte [esp], 0x49
push eax
lea esp, [esp + 0x48]
ja 0x5f5c48
call fcn.005c34f5
mov edi, dword [edi + ecx*4]
bt bp, 1
test edi, edi
pushal
lea esp, [esp + 0x30]
je 0x517161
test al, ah
add eax, edi
test ch, 0xc8
pushal
push ebx
jmp 0x5be7f6
rcl al, 4
test ch, ch
add edi, 1
shl al, cl
mov al, byte [edi]
push ecx
test al, al
mov word [esp], bx
call fcn.005bf126
add byte [eax], al
push edx
jae 0x5ecfaf
insd dword es:[edi], dx
push esp
push 0x64616572
add byte [eax], al
add byte [ebx + 0x79], dl
jae 0x5ecf9b
inc ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ebx + 0x74], dx
jb 0x5ecfbc
outsb dx, byte [esi]
dec esp
outsb dx, byte gs:[esi]
add byte [edx - 0x13], al
jmp 0x97b3347b
insd dword es:[edi], dx
invalid
fisub word [ebx]
cmp bh, ch
invalid
movsd dword es:[edi], dword [esi]
mov ch, 0x88
invalid
pushal
pushfd
lea esp, [esp + 0x48]
jb 0x51716c
pushfd
cmp bh, 0xf5
cmp ch, bh
test ax, 0x3cfe
cmp eax, dword [ebp - 0x10]
mov byte [esp], 0x96
lea esp, [esp + 4]
jae 0x51716c
movzx bx, al
shr di, cl
add edi, edx
mov ebx, eax
adc cl, al
movsx cx, al
mov edi, eax
movzx cx, al
bt di, 3
bt bp, ax
or cx, 0x1a4d
mov ecx, 0x104
push 0xebed1600
mov word [esp], sp
pushfd
call fcn.005ed20e
lea esp, [esp + 8]
jne 0x5f63a2
add eax, 0xdafd5dad
pushfd
xor edx, edx
cmc
ror eax, cl
mov eax, edx
add esp, 4
not al
jmp 0x5ecf1c
Function at 0x5c1a1c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x34]
jle 0x5c2137
jb 0x51716c
jmp 0x5f610f
pushfd
pushfd
pushfd
lea esp, [esp + 0xc]
jb 0x51716c
clc
call fcn.0051787d
add byte [eax], al
inc edi
je 0x5c21a0
jb 0x5c21c1
jo 0x5c2195
add byte [eax], al
add byte [edx + 0x65], al
imul ebp, dword [bp + 0x50], 0x746e6961
add byte [ecx + 0xfffe3], al
and ebx, 0xfff
bt esi, 3
clc
invalid
add esi, ebp
invalid
inc esp
and al, 0x34
je 0x5c21c6
cmp dl, al
cmp al, 0
jae 0x5c2232
insb byte es:[edi], dx
inc ebx
push eax
add byte [eax], al
add byte [edi + 0x65], al
je 0x5c2211
insb byte es:[edi], dx
popal
jae 0x5c2245
dec esp
outsd dx, dword [esi]
outsb dx, byte [esi]
inc ecx
add byte [eax], al
add byte [ebx + 0x65], dl
je 0x5c2234
imul esp, dword [ebp + 0x77], 0x74726f70
dec edi
jb 0x5c224f
inc ebp
js 0x5c21eb
xor byte [edi], cl
test byte [ecx + 0x4f], cl
cmc
inc dword [eax - 0x3a0907ff]
enter 0x5360, 0xffffffffffffffe9
rol ch, 1
invalid
dec ebp
outsb dx, byte gs:[esi]
jne fcn.005c2233
add byte [esi - 0x18], dl
jecxz 0x5c222e
invalid
push 0x27b41e27
pushfd
jmp 0x5f7381
cmp eax, dword [ebp - 0x10]
call fcn.005bb681
add byte [eax], al
inc edi
je 0x5f73e2
jns 0x5f7404
je 0x5f73f8
insd dword es:[edi], dx
inc esp
popaw
jne 0x5f7406
je 0x5f73e8
inc ebx
dec ecx
inc esp
add byte [esi - 0x2f], ah
out 1, eax
dec ebp
cld
add di, 0x49b1
bswap bx
xchg di, bx
rcl di, 0xe
sub ecx, 8
inc di
stc
bsf bx, sp
shr ecx, 1
cmp al, 0x5b
mov edi, dword [esi]
sub bh, ah
add edi, dword [ebp + 0x10]
cmp ecx, ebp
add esi, 8
and bx, 0xa1a5
shld bx, cx, cl
mov bx, word [esi]
push 0x566de628
shr ebx, 0xc
push 0xb0afb78c
cmc
jmp 0x5f73f0
mov al, 0xf5
push 0x76a1d0ce
cmp al, al
cmp ebx, 1
mov byte [esp], 0xec
rol byte [ebx + 0x4c601fb], 0x24
in al, dx
push ebx
lea esp, [esp + 0x10]
je 0x5bb6eb
cmp ebx, 0x5dd946c6
sti
mov byte [esi - 0x27], 0x5d
inc esi
fstp dword [ebp + 0x66]
bt ebp, ebp
bt bp, bp
cmp ebx, 2
call fcn.005c0940
add byte [eax], al
inc ebx
jb 0x5f747f
popal
je 0x5f7482
dec ecx
arpl word [edi + 0x6e], bp
add byte [eax], al
add byte [edi + 0x6c], al
outsd dx, dword [esi]
bound esp, qword [ecx + 0x6c]
inc ecx
inc ecx
je 0x5f749f
insd dword es:[edi], dx
inc ecx
add byte [edx], ah
mov ecx, 0x64765966
push esp
daa
fisub dword [ebp + 0x1a66297]
mov edi, 0xf25d5252
inc esi
ret
jmp dword [ecx + 0x18]
invalid
sbb dword [ebp + 0x32af1e6f], ecx
xor dl, byte [0x94a688c5]
push 0x1d
pop edi
jle 0x5f7466
stosb byte es:[edi], al
aas
sub dword [ecx + ebx*8 + 0x41c38041], ebx
retf
fxch st(7)
insb byte es:[edi], dx
xchg esi, eax
fdiv st(0)
or ebp, dword [ebx + 0x37]
push cs
ljmp 0x4e73
Function at 0x4018c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp fcn.0040ca2f

Function at 0x401970
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401989
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4019c4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4019c0
lea ebx, [ebx]
cmp esi, eax
jae 0x4019c4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4019b0
cmp esi, eax
jb 0x4019ca
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x402690
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x43b726
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
mov eax, dword [0x44f690]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
push edi
mov eax, dword [0x44f690]
xor eax, esp
push eax
lea eax, [esp + 0x118]
mov dword fs:[0], eax
push 0xfe
lea eax, [esp + 0x19]
push 0
mov dword [esp + 0x128], 1
push eax
mov byte [esp + 0x20], 0
call fcn.00428e90
push str.ver.ini
lea ecx, [esp + 0x138]
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.00401730
add esp, 0x18
mov byte [esp + 0x120], 2
mov eax, dword [esp + 0x10]
push eax
push 0xff
lea ecx, [esp + 0x1c]
push ecx
push 0x441ddb
push str.version
push str.option
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x10]
call fcn.00401b80
lea ebx, [esp + 0xc]
mov byte [esp + 0x120], 3
call fcn.00404b20
mov edi, eax
call fcn.00404ba0
mov eax, dword [esp + 0x12c]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x402772
push 0x80004005
call fcn.00402050
push eax
mov eax, dword [esp + 0x10]
push eax
call fcn.00426fe9
add esp, 8
test eax, eax
sete al
test al, al
mov byte [esp + 0x120], 2
mov eax, dword [esp + 0xc]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4027b2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x120], 1
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4027da
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x120], 0
mov eax, dword [esp + 0x128]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402805
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x120], 0xffffffff
mov eax, dword [esp + 0x12c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402833
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.0042648c
add esp, 0x118
ret
Function at 0x404550
Capabilities:
Create process on windows
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x43b950
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
push ebx
push esi
push edi
mov eax, dword [0x44f690]
xor eax, esp
push eax
lea eax, [esp + 0x7c]
mov dword fs:[0], eax
mov dword [esp + 0x84], 0
mov eax, dword [esp + 0x94]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov esi, esp
push eax
call fcn.00401c80
add eax, 0x10
mov dword [esi], eax
mov eax, dword [esp + 0x98]
add esp, 4
push eax
lea edi, [esp + 0x1c]
call fcn.004023b0
add esp, 8
mov edx, dword [esp + 0xa0]
mov bl, 1
mov byte [esp + 0x84], bl
mov ecx, dword [esp + 0xa4]
push ecx
push edx
sub esp, 0x14
mov eax, esp
mov dword [esp + 0xc0], esp
push eax
lea ecx, [esp + 0xac]
call fcn.00401580
mov byte [esp + 0xa0], 2
mov eax, dword [esp + 0x30]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0xc0], esp
mov esi, esp
push eax
call fcn.00401c80
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov byte [esp + 0xa4], bl
call fcn.00403b80
push str.loader.exe
mov ecx, edi
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.00401730
add esp, 0xc
mov bl, 3
mov byte [esp + 0x84], bl
mov eax, dword [esp + 0x94]
push 0x441df0
push eax
call fcn.00426fe9
add esp, 8
test eax, eax
sete al
test al, al
je 0x404677
push str.zuhao.exe
mov ecx, edi
push ecx
lea edx, [esp + 0xac]
push edx
call fcn.00401730
add esp, 0xc
mov byte [esp + 0x84], 4
jmp 0x4046b7
mov ecx, dword [esp + 0x94]
push 0x441e0c
push ecx
call fcn.00426fe9
add esp, 8
test eax, eax
sete al
test al, al
je 0x4046eb
push str.loadpc.exe
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0xac]
push eax
call fcn.00401730
add esp, 0xc
mov byte [esp + 0x84], 5
push eax
lea ecx, [esp + 0x1c]
call fcn.00405670
mov byte [esp + 0x84], bl
mov eax, dword [esp + 0xa4]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4046eb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x44
lea ecx, [esp + 0x30]
push 0
push ecx
call fcn.00428e90
mov ecx, dword [esp + 0x20]
add esp, 0xc
xor eax, eax
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x30]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push edx
mov dword [esp + 0x54], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4078f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x4078f7
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x4079d4
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x443470]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x443470]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x443470]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x443470]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x443470]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x443470]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x443470]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x443470]
inc ecx
sub edx, 8
sub esi, 1
jne 0x407910
pop edi
test edx, edx
je 0x4079fb
jmp 0x4079e0
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x443470]
inc ecx
sub edx, 1
jne 0x4079e0
not eax
pop esi
ret

Function at 0x407a00
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x443470]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x443470]
mov dword [edx + 8], ecx
ret

Function at 0x407a50
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x443470]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x443470]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret

Function at 0x408160
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ebx
imul esi, dword [esp + 8]
cmp byte [edi], 0
je 0x408192
mov ecx, dword [edi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x408188
mov byte [edi + 8], 1
mov eax, dword [esp + 8]
xor edx, edx
div ebx
pop esi
ret
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi + 0x18]
push ebp
lea ebp, [ecx + esi]
cmp ebp, eax
pop ebp
jbe 0x4081a5
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x14]
push esi
add eax, ecx
push eax
push edx
call fcn.0042c520
add dword [edi + 0x1c], esi
mov eax, esi
add esp, 0xc
xor edx, edx
div ebx
pop esi
ret
Function at 0x4081c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
cmp byte [esi], 0
push edi
mov edi, 1
je 0x4081f3
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push edi
lea ecx, [esp + 0x13]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4081ed
mov byte [esi + 8], 1
mov edi, dword [esp + 8]
jmp 0x40821f
mov eax, dword [esi + 0x18]
push ebx
mov ebx, dword [esi + 0x1c]
lea ecx, [ebx + 1]
cmp ecx, eax
jbe 0x408205
sub eax, ebx
mov edi, eax
mov edx, dword [esi + 0x14]
push edi
add edx, ebx
push edx
lea eax, [esp + 0x13]
push eax
call fcn.0042c520
add esp, 0xc
add ebx, edi
mov dword [esi + 0x1c], ebx
pop ebx
cmp edi, 1
pop edi
jne 0x408236
movzx ecx, byte [esp + 3]
mov edx, dword [esp + 0xc]
mov dword [edx], ecx
xor eax, eax
add esp, 8
ret
cmp byte [esi], 0
je 0x408230
cmp byte [esi + 8], 0
je 0x408230
or eax, 0xffffffff
add esp, 8
ret
Function at 0x4082d0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
cmp byte [esi], 0
je 0x408315
cmp byte [esi + 1], 0
je 0x40831d
mov eax, dword [esi + 4]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [esi], 0
push ebp
je 0x408332
cmp byte [esi + 1], 0
je 0x408324
mov edx, dword [esi + 4]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, eax
sub ebp, dword [esi + 0xc]
mov dword [esp + 4], ebp
jmp 0x40833b
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x1c], ecx
jmp 0x4082ee
or eax, 0xffffffff
add esp, 0x18
ret
mov dword [esp + 4], 0
mov ebp, dword [esp + 4]
jmp 0x40833b
mov eax, dword [esi + 0x1c]
mov dword [esp + 4], eax
mov ebp, eax
push edi
mov edi, 0xffff
mov dword [esp + 0xc], edi
cmp ebp, edi
jae 0x40834f
mov dword [esp + 0xc], ebp
mov edi, ebp
push ebx
push 0x404
call fcn.0042713a
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x40836d
pop ebx
pop edi
or eax, 0xffffffff
pop ebp
add esp, 0x18
ret
mov eax, 4
mov dword [esp + 0x18], 0xffffffff
cmp edi, eax
jbe 0x408481
jmp 0x408390
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0xc]
add eax, 0x400
mov dword [esp + 0x14], edi
cmp eax, edi
ja 0x4083a1
mov dword [esp + 0x14], eax
mov eax, ebp
sub eax, dword [esp + 0x14]
sub ebp, eax
mov dword [esp + 0x20], eax
cmp ebp, 0x404
jbe 0x4083ba
mov ebp, 0x404
cmp byte [esi], 0
je 0x4083df
cmp byte [esi + 1], 0
je 0x408481
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4083e2
mov dword [esi + 0x1c], eax
cmp byte [esi], 0
mov edi, ebp
je 0x40840a
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x20]
push eax
push ebp
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x408404
mov byte [esi + 8], 1
mov eax, dword [esp + 0x1c]
jmp 0x408430
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea edx, [eax + ebp]
cmp edx, ecx
jbe 0x40841b
sub ecx, eax
mov edi, ecx
mov ecx, dword [esi + 0x14]
push edi
add ecx, eax
push ecx
push ebx
call fcn.0042c520
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div ebp
cmp eax, 1
jne 0x408481
lea eax, [ebp - 3]
test eax, eax
jl 0x40846c
dec eax
cmp byte [eax + ebx], 0x50
jne 0x40845c
cmp byte [eax + ebx + 1], 0x4b
jne 0x40845c
cmp byte [eax + ebx + 2], 5
jne 0x40845c
cmp byte [eax + ebx + 3], 6
je 0x408462
test eax, eax
jge 0x408440
jmp 0x40846c
mov edx, dword [esp + 0x20]
add eax, edx
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
jne 0x408481
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x14], eax
jb 0x408384
push ebx
call fcn.0042701d
mov eax, dword [esp + 0x1c]
add esp, 4
pop ebx
pop edi
pop ebp
add esp, 0x18
ret
Function at 0x408e50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x408e6e
pop edi
pop ebp
mov eax, 0xffffff9a
pop ebx
add esp, 0xc
ret
cmp dword [edi + 0x18], ebx
je 0x408e62
cmp dword [edi + 0x7c], ebx
je 0x408e7d
call fcn.00409240
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00408bc0
add esp, 0xc
test eax, eax
je 0x408ea4
pop edi
pop ebp
mov eax, 0xffffff99
pop ebx
add esp, 0xc
ret
push esi
push 0x84
call fcn.0042713a
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x408ee5
push 0x4000
call fcn.0042713a
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
cmp eax, ebx
jne 0x408ef2
push esi
call fcn.0042701d
add esp, 4
pop esi
pop edi
pop ebp
mov eax, 0xffffff98
pop ebx
add esp, 0xc
ret
mov dword [esi + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
cmp eax, ebx
jne 0x408f3a
lea eax, [esi + 4]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.00407d10
test eax, eax
jne 0x408f3a
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x5c], ecx
mov dl, byte [edi + 0x30]
and dl, 1
mov byte [esi + 0x6c], dl
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x408f64
mov cl, byte [edi + 0x39]
mov byte [esi + 0x80], cl
jmp 0x408f6d
mov dl, byte [edi + 0x3f]
mov byte [esi + 0x80], dl
movzx eax, byte [esi + 0x6c]
neg eax
sbb eax, eax
and eax, 0xc
lea edx, [esi + 0x70]
mov dword [esi + 0x7c], eax
mov dword [edx], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
cmp ebp, ebx
je 0x408fa7
mov cl, byte [ebp]
cmp cl, bl
je 0x408fa7
call fcn.00407a00
add ebp, 1
jne 0x408f96
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x18]
lea eax, [ecx + edx + 0x1e]
mov dword [esi + 0x3c], eax
mov dword [esi + 8], ebx
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret