joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5dabc4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5dabdb
add esp, 0xfffffff0
call fcn.00408534
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c1a24
mov eax, dword [0x5f86dc]
cmp byte [eax], 0
jne 0x5dac08
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x5f8a6c]
cmp word [eax + 2], 0
jne 0x5dac22
mov eax, dword [0x5f8a6c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005dcfb8
mov eax, dword [0x5f8bb8]
cmp word [eax + 2], 0
jne 0x5dac3c
mov eax, dword [0x5f8bb8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005dd1bc
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x50513c]
call fcn.0050b664
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5dd734
mov dl, 1
mov eax, dword [0x489aa8]
call fcn.00407e7c
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x489aa8]
call fcn.00407e7c
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x509ed8]
call fcn.005159a4
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5dae2c
mov eax, dword [0x5f88fc]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00515ed0
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5dda1c
mov dl, 1
mov eax, dword [0x489aa8]
call fcn.00407e7c
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x5f88fc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.004247dc
test eax, eax
je 0x5dad56
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00424634
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.004247c0
test eax, eax
je 0x5dad6e
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040ac48
push ebx
push 0x5dc994
call fcn.005cfe90
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x5f86dc]
cmp byte [eax], 0
jne 0x5dadbf
mov eax, ebx
call fcn.005db010
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.005ddc54
mov eax, ebx
call fcn.005de8dc
mov byte [ebx + 0x196], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5dae23
call fcn.0040858c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5db354
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5db3f6
cmp dword [ebx + 0xac], 0
jne 0x5db3f0
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5db290
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5db3f0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5db3b6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5db3f0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.004ac3e0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5db3c5
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5db6b0
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
mov eax, dword [0x5ff238]
cmp dword [eax + 0x188], 0
je 0x5db82a
test bl, bl
jne 0x5db775
cmp dword [esi + 0xb4], 0
jne 0x5db76a
mov eax, esi
call fcn.005de72c
push eax
push 0x5db5a4
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5db73b
mov eax, dword [0x5ff238]
cmp byte [eax + 0xeb], 0
je 0x5db73b
mov eax, dword [esi + 0xf0]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x5db71c
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5db73b
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5db724
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5db76a
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004ac3e0
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5db74a
inc dword [esi + 0xb4]
jmp 0x5db82a
cmp dword [esi + 0xb4], 0
jle 0x5db82a
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5db82a
cmp dword [esi + 0x58], 0
je 0x5db7df
mov eax, dword [0x5ff238]
cmp byte [eax + 0xeb], 0
je 0x5db7df
mov eax, dword [esi + 0xf0]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x5db7c0
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5db7df
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5db7c8
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5db80e
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004ac3e0
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5db7ee
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5ccccc]
call fcn.0040c4d8
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5dc4c8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5dc525
cmp byte [ebx + 0xeb], 0
jne 0x5dc525
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409f64
mov eax, dword [esi]
test eax, eax
je 0x5dc512
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5dc532
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a1bc
jmp 0x5dc532
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a1bc
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5dde68
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5dded9
mov eax, esi
call fcn.0053cbf4
test al, al
je 0x5dded9
mov eax, dword [ebx + 0x98]
call fcn.0053c820
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5dded9
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x134]
test al, al
je 0x5ddeca
push 0
mov eax, dword [ebx + 0x98]
call fcn.0053c820
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.005332d8
jmp 0x5dded9
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.005ddc74
pop esi
pop ebx
ret
Function at 0x5e2818
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x5e2896
mov eax, dword [ebx + 8]
call fcn.0053c820
mov ecx, eax
mov dl, 1
mov eax, dword [0x548e14]
call fcn.0053698c
mov dword [ebx + 0x8c], eax
mov esi, dword [ebx + 0x8c]
xor edx, edx
mov eax, esi
call fcn.0054dad0
mov dword [esi + 0x2cc], ebx
mov dword [esi + 0x2c8], 0x5e20e8
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0053c820
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0053c820
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x5e2910
mov eax, dword [ebx + 8]
call fcn.0053c820
mov ecx, eax
mov dl, 1
mov eax, dword [0x548e14]
call fcn.0053698c
mov dword [ebx + 0x9c], eax
mov esi, dword [ebx + 0x9c]
mov dl, 1
mov eax, esi
call fcn.0054dad0
mov dword [esi + 0x2cc], ebx
mov dword [esi + 0x2c8], 0x5e2134
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0053c820
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0053c820
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x94], 0
jne 0x5e297e
mov eax, dword [ebx + 8]
call fcn.0053c820
mov ecx, eax
mov dl, 1
mov eax, dword [0x5498b0]
call fcn.0053698c
mov dword [ebx + 0x94], eax
mov eax, dword [ebx + 0x94]
mov byte [eax + 0x2a0], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.0053c820
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.0053c820
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x5e66ac
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe68
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x198], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5e6749
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x5e6764
call fcn.0040a1bc
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
lea eax, [ebp - 0x198]
mov edx, esi
mov ecx, 0
call fcn.0040a938
mov eax, dword [ebp - 0x198]
call fcn.0040a7fc
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x5e6730
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 4], eax
push dword [ebp - 4]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, ebx
call fcn.0040abdc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e6750
lea eax, [ebp - 0x198]
call fcn.00409e00
ret
Function at 0x401160
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6c300c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x401187
push 0x4df
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x4011fa
push 0x4d
pop eax
push 0x3a
mov word [ebp - 0x1c], ax
pop eax
push 0x57
mov word [ebp - 0x1a], ax
pop eax
push 0x36
mov word [ebp - 0x18], ax
pop eax
push 0x46
mov word [ebp - 0x16], ax
pop eax
push 0x2f
mov word [ebp - 0x14], ax
pop eax
push 0x65
pop ecx
mov word [ebp - 0x12], ax
xor eax, eax
inc eax
mov word [ebp - 0xe], cx
push 9
mov word [ebp - 0x10], ax
pop eax
push 0xa
mov word [ebp - 0xa], cx
mov word [ebp - 8], cx
mov word [ebp - 0xc], ax
pop ecx
mov ax, word [ebp + ecx*2 - 0x1e]
xor word [ebp + ecx*2 - 0x1c], ax
dec ecx
test ecx, ecx
jg 0x4011d1
xor word [ebp - 0x1c], 0x29
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ecx, ecx
mov dword [esi], eax
test eax, eax
setne cl
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0066f8d2
leave
ret

Function at 0x401210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6c300c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx], 0
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
jne 0x401234
mov eax, 0x80040007
jmp 0x401284
movaps xmm0, xmmword [0x6bc5b0]
lea eax, [ebp - 0x24]
push eax
push dword [ecx]
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x6c436f74
mov dword [ebp - 0x10], 0x746e6569
mov dword [ebp - 0xc], 0x61657241
mov byte [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x401280
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, ecx
jmp 0x401284
push edi
push esi
call eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0066f8d2
leave
ret 8

Function at 0x401d34
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401d8a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401d8a
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x401d7c
cmp esi, ecx
jae 0x401d8a
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x401d6a
cmp esi, ecx
jae 0x401d8a
cmp word [esi], 0
je 0x401d8a
mov eax, esi
jmp 0x401d8c
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x402604
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x6aafee
call fcn.006aa2b6
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x402681
push 2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x402681
call fcn.00401d91
mov esi, eax
jmp 0x402787
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x4026a4
call fcn.00401d91
jmp 0x40277a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x40269a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x4026d7
mov esi, 0x8007000e
jmp 0x40277c
push 2
pop ecx
mul ecx
mov byte [ebp - 4], cl
cmp edx, esi
ja 0x4027aa
jb 0x4026f2
cmp eax, 0xffffffff
ja 0x4027aa
cmp eax, 0x400
jbe 0x402707
push eax
lea ecx, [ebp - 0x418]
call fcn.004052d9
jmp 0x402729
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x402729
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x4026cd
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x40269a
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.004031ce
mov esi, eax
test edi, edi
je 0x402787
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x4027a0
lea ecx, [ebp - 0x418]
call fcn.0040527b
mov eax, esi
call fcn.006aa203
ret 0x10
push 0x80070216
call fcn.00401cb5
int3
Function at 0x404299
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x6c300c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xc
pop esi
mov dword [ebp - 0x64], 4
mov ecx, esi
mov dword [ebp - 0x20], 0x11700662
mov dword [ebp - 0x1c], 0x93b0861
mov dword [ebp - 0x18], 0x432f4327
mov byte [ebp - 0x14], 0x43
mov al, byte [ebp + ecx - 0x21]
xor byte [ebp + ecx - 0x20], al
dec ecx
test ecx, ecx
jg 0x4042d1
xor byte [ebp - 0x20], 0x23
lea eax, [ebp - 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call edi
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x30], 0xd3bdcfaa
mov dword [ebp - 0x2c], 0xdbe9dab6
mov dword [ebp - 0x28], 0x91fd91f5
mov byte [ebp - 0x24], 0x91
mov al, byte [ebp + esi - 0x31]
xor byte [ebp + esi - 0x30], al
dec esi
test esi, esi
jg 0x40430a
xor byte [ebp - 0x30], 0xe1
lea eax, [ebp - 0x30]
push eax
call edi
push 0x13
pop ebx
push 0x10
mov edx, eax
mov dword [ebp - 0x10], 0x5f2c432f
pop eax
push 0xb
mov word [ebp - 0xc], 0x723a
mov byte [ebp - 0xa], bl
mov word [ebp - 9], 0x197d
mov byte [ebp - 7], 0x75
mov byte [ebp - 6], al
mov byte [ebp - 5], al
pop ecx
mov al, byte [ebp + ecx - 0x11]
xor byte [ebp + ecx - 0x10], al
dec ecx
test ecx, ecx
jg 0x40434c
xor byte [ebp - 0x10], 0x6c
lea eax, [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push edx
call edi
movaps xmm0, xmmword [0x6bc5e0]
mov esi, eax
push 0x10
movups xmmword [ebp - 0x58], xmm0
mov byte [ebp - 0x48], 0x9a
pop ecx
mov al, byte [ebp + ecx - 0x59]
xor byte [ebp + ecx - 0x58], al
dec ecx
test ecx, ecx
jg 0x40437e
xor byte [ebp - 0x58], 0xbe
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x60]
call edi
lea ecx, [ebp - 0x5c]
push ecx
push 8
push 0xffffffffffffffff
call eax
test eax, eax
jne 0x4043aa
xor eax, eax
jmp 0x4043fd
movaps xmm0, xmmword [0x6bc5f0]
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0xc5c5abc4
mov al, byte [ebp + ebx - 0x45]
xor byte [ebp + ebx - 0x44], al
dec ebx
test ebx, ebx
jg 0x4043bc
xor byte [ebp - 0x44], 0x84
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x60]
call edi
lea ecx, [ebp - 0x64]
push ecx
push dword [ebp - 0x64]
lea ecx, [ebp - 0x68]
push ecx
push 0x14
push dword [ebp - 0x5c]
call eax
push dword [ebp - 0x5c]
test eax, eax
jne 0x4043f3
call esi
jmp 0x4043a6
call esi
xor eax, eax
cmp dword [ebp - 0x68], eax
setne al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0066f8d2
leave
ret
Function at 0x406aa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x406ac7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040720f
jmp 0x406b7c
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x406ae9
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x406aeb
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x406b70
jg 0x406b00
test esi, esi
je 0x406b70
test ecx, ecx
jl 0x406b49
jg 0x406b0a
test eax, eax
je 0x406b49
cmp edi, ecx
jg 0x406b1e
jl 0x406b14
cmp esi, eax
jae 0x406b1e
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.00687ad0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x406b4c
mov edx, dword [ebp + 8]
test edi, edi
jl 0x406b70
jg 0x406b56
test esi, esi
je 0x406b70
cmp dword [ebx + 0x4c], 0
je 0x406b70
push dword [ebx + 0x4c]
push esi
push 1
push edx
call fcn.0068f653
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406b85
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x406bac
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004072d6
jmp 0x406c7b
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x406bce
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x406bd0
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x406c6f
jg 0x406bed
test esi, esi
je 0x406c6f
test ecx, ecx
jl 0x406c3a
jg 0x406bf7
test eax, eax
je 0x406c3a
cmp ebx, ecx
jg 0x406c0b
jl 0x406c01
cmp esi, eax
jae 0x406c0b
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.00687ad0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x406c41
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x406c6f
jg 0x406c4b
test esi, esi
je 0x406c6f
cmp dword [edi + 0x4c], 0
je 0x406c6f
mov ecx, edi
call fcn.0040787b
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.0068fc3b
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406efd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x6c300c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x406f23
xor eax, eax
jmp 0x406fe8
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x406f4c
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x406f4c
dec dword [edx]
mov eax, ebx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x406fe8
cmp dword [esi + 0x4c], 0
je 0x406fe6
mov ecx, esi
call fcn.0040787b
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x406f79
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0068c208
cmp eax, edi
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x406fe6
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x406fe6
cmp eax, 1
jle 0x406fb5
cmp eax, 3
jne 0x406fe6
push dword [esi + 0x4c]
movsx ecx, byte [ebp - 0x25]
push ecx
jmp 0x406f6b
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x406fd8
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call fcn.0068f653
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x406fe6
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x406fe8
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0066f8d2
leave
ret 4

Function at 0x407903
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6c300c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x407985
cmp byte [esi + 0x3d], 0
je 0x407985
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x407957
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40795b
sub eax, 1
je 0x40795f
dec eax
sub eax, 1
je 0x407985
xor al, al
jmp 0x407987
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40797c
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0068f653
add esp, 0x10
cmp edi, eax
jne 0x407957
cmp byte [esi + 0x3d], 0
sete al
jmp 0x407987
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0066f8d2
leave
ret