joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1123e70
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1008
call 0x11257e0
mov eax, dword [esp + 0x100c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x101c]
mov ebp, ecx
test eax, eax
mov dword [esi], 0xffffffff
je 0x1123f81
cmp byte [eax], 0
je 0x1123f81
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push eax
call dword [fcn.00514184]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x10], ebx
jne 0x1123ee0
mov dword [ebp + 0x400], 2
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x1008
ret 8
push edi
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x20]
push 0x1000
push ecx
push ebx
call dword [fcn.00514204]
test eax, eax
je 0x1123f5b
mov edx, dword [esp + 0x10]
test edx, edx
je 0x1123f57
lea edi, [esp + edx + 0x18]
lea edx, [esp + 0x18]
cmp edx, edi
lea ecx, [esp + 0x18]
jae 0x1123f39
mov eax, dword [esi]
xor ebx, ebx
mov bl, byte [ecx]
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [ebp + edx*4]
xor edx, eax
inc ecx
cmp ecx, edi
mov dword [esi], edx
jb 0x1123f15
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x20]
push 0x1000
push ecx
push ebx
call dword [fcn.00514204]
test eax, eax
jne 0x1123efd
jmp 0x1123f5b
test eax, eax
jne 0x1123f65
mov dword [ebp + 0x400], 3
push ebx
call dword [fcn.0051418c]
mov edx, dword [esi]
pop edi
not edx
mov dword [esi], edx
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x1008
ret 8
mov dword [ebp + 0x400], 1
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x1008
ret 8

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x401120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401139
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40114d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40116e
cmp esi, eax
jae 0x401147
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401160
cmp esi, eax
jae 0x401147
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x401fb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42b078
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x28], edi
call fcn.00401cb0
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.004015e0
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x402042
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x403fa0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x58
push esi
mov esi, dword [esp + 0x60]
push esi
push 0x200
lea eax, [esp + 0x30]
push eax
push 0x42c6e9
push str.UpdateDate
push str.cclib
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
fld qword [0x42c668]
push 0x400
fstp qword [esp + 0x14]
push 2
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x24], 0
call fcn.00403e40
cmp dword [esp + 0x18], 1
jne 0x40403f
lea edx, [esp + 4]
push edx
call dword [sym.imp.inNet.dll_class_ATL::CStringT_char__class_StrTraitMFC_char__class_ATL::ChTraitsCRT_char______cdecl_GetDate_void_]
mov eax, dword [esp + 8]
add esp, 4
push esi
push eax
push str.UpdateDate
push str.cclib
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [esp + 4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404038
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
xor eax, eax
pop esi
add esp, 0x58
ret
push 0
call fcn.0040ea7d
fld qword [0x42c668]
mov dword [esp + 8], eax
fstp qword [esp + 0x20]
add esp, 4
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], edx
mov dword [esp + 0x28], 0
call fcn.00401240
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 8]
push edx
lea ecx, [esp + 0x24]
call fcn.00401430
cmp dword [esp + 0xc], 1
je 0x404038
push esi
push 0
push str.HowLong
push str.cclib
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
fld qword [esp + 4]
mov esi, eax
call fcn.0040e50c
xor ecx, ecx
cmp eax, esi
setge cl
pop esi
mov eax, ecx
add esp, 0x58
ret
Function at 0x405170
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x4051c3
call fcn.0042844d
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x4051c3
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x4051b9
xor eax, eax
jmp 0x4052dc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x4051f3
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x4051f3
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x4052d9
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x405220
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.00404d69
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x4052d9
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x405269
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x405269
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x405263
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.00404d69
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x4052c9
and dword [ebp + 0xc], 0
jmp 0x4052c9
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x4052c9
push 0xc
call fcn.0041ccd5
mov esi, eax
test esi, esi
pop ecx
je 0x4052ab
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x4052ad
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x4052c4
push dword [ebp - 8]
call fcn.0041c24f
jmp 0x4052c9
call fcn.0041c226
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x40522e
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40f1df
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.0040eff0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40f27a
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x43c394]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x40f27a
cmp eax, 1
je 0x40f29b
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40f27a
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x40f247
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x40f276
xor eax, eax
inc eax
jmp 0x40f2ba
cmp edi, eax
jae 0x40f27e
xor eax, eax
jmp 0x40f2ba
cmp eax, esi
jae 0x40f285
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x43c394]
jmp 0x40f29e
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f524
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x42f700
call fcn.0040fdc4
mov edi, 0x94
mov eax, edi
call fcn.0040eff0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x43c394], ecx
mov eax, dword [esi + 4]
mov dword [0x43c3a0], eax
mov edx, dword [esi + 8]
mov dword [0x43c3a4], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x43c398], esi
cmp ecx, 2
je 0x40f584
or esi, 0x8000
mov dword [0x43c398], esi
shl eax, 8
add eax, edx
mov dword [0x43c39c], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40f5bf
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40f5bf
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x40f5d7
cmp eax, 0x20b
je 0x40f5c4
mov dword [ebp - 0x1c], esi
jmp 0x40f5eb
cmp dword [ecx + 0x84], 0xe
jbe 0x40f5bf
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x40f5e5
cmp dword [ecx + 0x74], 0xe
jbe 0x40f5bf
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.00414e75
pop ecx
test eax, eax
jne 0x40f5ff
push 0x1c
call fcn.0040f500
pop ecx
call fcn.00412041
test eax, eax
jne 0x40f610
push 0x10
call fcn.0040f500
pop ecx
call fcn.00416593
mov dword [ebp - 4], esi
call fcn.00416395
test eax, eax
jge 0x40f629
push 0x1b
call fcn.0040f4db
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x43dc70], eax
call fcn.00416273
mov dword [0x43c384], eax
call fcn.004161d1
test eax, eax
jge 0x40f64f
push 8
call fcn.0040f4db
pop ecx
call fcn.00415f9e
test eax, eax
jge 0x40f660
push 9
call fcn.0040f4db
pop ecx
push 1
call fcn.00410218
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x40f676
push eax
call fcn.0040f4db
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00415f41
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x40f697
movzx eax, word [ebp - 0x40]
jmp 0x40f69a
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0041bddc
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x40f6b8
push edi
call fcn.00410345
call fcn.00410367
jmp 0x40f6ea
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0040fdff
ret
Function at 0x410282
Capabilities:
Terminate process

Disassembly:
push 8
push 0x42f768
call fcn.0040fdc4
push 8
call fcn.00414b5f
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x43c3d4], esi
jne 0x4102b6
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x43c3d0], esi
mov al, byte [ebp + 0x10]
mov byte [0x43c3cc], al
cmp dword [ebp + 0xc], edi
jne 0x410300
cmp dword [0x43dc68], edi
je 0x4102f0
mov eax, dword [0x43dc64]
sub eax, 4
mov dword [0x43dc64], eax
cmp eax, dword [0x43dc68]
jb 0x4102f0
mov eax, dword [eax]
cmp eax, edi
je 0x4102d1
call eax
jmp 0x4102d1
push 0x4380a0
mov eax, 0x438098
call fcn.00410200
pop ecx
push 0x4380ac
mov eax, 0x4380a4
call fcn.00410200
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x410331
cmp dword [ebp + 0x10], edi
jne 0x41033f
mov dword [0x43c3d4], esi
push dword [ebp + 8]
call fcn.004101be
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x41033e
push 8
call fcn.00414aaa
pop ecx
ret
call fcn.0040fdff
ret
Function at 0x415a04
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x415a32
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x415a39
cmp ebx, dword [eax + 4]
jae 0x415a39
xor eax, eax
jmp 0x415c29
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x415a4a
xor eax, eax
inc eax
jmp 0x415c28
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x415a60
cmp ecx, edx
jae 0x415ba5
cmp dword [eax + 4], 0
je 0x415a69
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x415a51
cmp dword [ebp + 8], 0
je 0x415a8b
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x415ba5
cmp eax, esi
jae 0x415ba5
mov eax, dword [0x43c640]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x415ab0
cmp dword [esi*4 + 0x43c648], edi
je 0x415ba9
inc esi
cmp esi, eax
jl 0x415a9e
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x415c25
cmp dword [ebp - 8], 0x1000000
jne 0x415c25
test byte [ebp - 0xc], 0xcc
je 0x415b2e
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x415c25
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x415c25
cmp word [eax + 0x18], 0x10b
jne 0x415c25
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x415c25
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x415b2e
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x415b2e
test byte [ecx + 0x27], 0x80
jne 0x415ba5
push 1
push 0x43c688
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x415a42
mov ecx, dword [0x43c640]
test ecx, ecx
mov edx, ecx
jle 0x415b62
lea eax, [ecx*4 + 0x43c644]
cmp dword [eax], edi
je 0x415b62
dec edx
sub eax, 4
test edx, edx
jg 0x415b56
test edx, edx
jne 0x415b93
push 0xf
pop ebx
cmp ecx, ebx
jg 0x415b6f
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x415b87
lea eax, [edx*4 + 0x43c648]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x415b75
cmp ecx, 0x10
jge 0x415b93
inc ecx
mov dword [0x43c640], ecx
push 0
push 0x43c688
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x415a42
xor eax, eax
jmp 0x415c28
test esi, esi
jle 0x415a42
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x43c688
call ebx
test eax, eax
jne 0x415a42
cmp dword [esi*4 + 0x43c648], edi
je 0x415bff
mov eax, dword [0x43c640]
lea esi, [eax - 1]
test esi, esi
jl 0x415bed
cmp dword [esi*4 + 0x43c648], edi
je 0x415be9
dec esi
jns 0x415bdd
test esi, esi
jge 0x415bfd
cmp eax, 0x10
jge 0x415bf8
inc eax
mov dword [0x43c640], eax
lea esi, [eax - 1]
jmp 0x415bff
je 0x415c17
xor ecx, ecx
test esi, esi
jl 0x415c17
lea eax, [ecx*4 + 0x43c648]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x415c05
push 0
push 0x43c688
call ebx
jmp 0x415a42
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415c2d
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x439310]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x439948]
je 0x415c62
inc eax
cmp eax, 0x13
jb 0x415c53
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x439948]
jne 0x415d88
mov eax, dword [0x43c38c]
cmp eax, 1
je 0x415d60
cmp eax, edx
jne 0x415c92
cmp dword [0x439304], 1
je 0x415d60
cmp ecx, 0xfc
je 0x415d88
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x415cc8
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.004176e0
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.0040fa80
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x415cfc
mov eax, edi
push eax
call fcn.0040fa80
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x430108
push edi
call fcn.00418c00
add esp, 0x10
push edi
call fcn.0040fa80
push dword [esi + 0x43994c]
mov ebx, eax
call fcn.0040fa80
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.0040eff0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.004176e0
push edi
push ebx
call fcn.004176f0
push 0x4300e8
push ebx
call fcn.004176f0
push dword [esi + 0x43994c]
push ebx
call fcn.004176f0
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.0041a20d
add esp, 0x2c
jmp 0x415d88
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x43994c]
push dword [esi]
call fcn.0040fa80
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.0040fa6e
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x417d20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x417ef4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x43d900]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x417ef4
test cl, 0x48
je 0x417d8b
cmp byte [eax + 5], 0xa
je 0x417d8b
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x417ddd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x417dc5
call fcn.004100ae
mov dword [eax], 9
call fcn.004100b7
mov dword [eax], esi
jmp 0x417dd5
cmp eax, 0x6d
je 0x417ef4
push eax
call fcn.004100c0
pop ecx
or eax, 0xffffffff
jmp 0x417ef6
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x417eef
test eax, eax
je 0x417e04
cmp byte [ebx], 0xa
jne 0x417e04
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x417e0d
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x417ee9
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x417ed9
cmp al, 0xd
je 0x417e3f
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x417ecb
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x417e59
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x417e54
add dword [ebp + 0x10], 2
jmp 0x417ead
mov dword [ebp + 0x10], eax
jmp 0x417ec7
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x417e81
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x417ec7
cmp dword [ebp - 0xc], 0
je 0x417ec7
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x417ea2
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x417ead
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x417eca
cmp ebx, dword [ebp + 0xc]
jne 0x417eb2
cmp byte [ebp - 1], 0xa
jne 0x417eb2
mov byte [ebx], 0xa
jmp 0x417eca
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004182d1
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x417ecb
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x417e23
jmp 0x417ee9
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x417ee9
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x417ef6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret