joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414ab0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.camzt
lea edi, [esi - 0x10000]
push edi
jmp 0x414aca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414ad1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414ac0
mov eax, 1
add ebx, ebx
jne 0x414ae3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414ad8
jne 0x414af4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414ad8
xor ecx, ecx
sub eax, 3
jb 0x414b08
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414b7a
mov ebp, eax
add ebx, ebx
jne 0x414b13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414b20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414b44
inc ecx
add ebx, ebx
jne 0x414b30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414b25
jne 0x414b41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414b25
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414b64
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414b55
jmp 0x414ac6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414b64
add edi, ecx
jmp 0x414ac6
pop esi
mov edi, esi
mov ecx, 2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414b82
cmp byte [edi], 5
jne 0x414b82
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414b87
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414bff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19bb8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19bf4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414bb4
mov ecx, edi
jns 0x414be3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19bfc]
or eax, eax
je 0x414bf9
mov dword [ebx], eax
add ebx, 4
jmp 0x414bd1
call dword [esi + 0x19bf8]
mov ebp, dword [esi + 0x19c00]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414c33
sub esp, 0xffffff80
jmp 0x401134
Function at 0x401080
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi]
push eax
call fcn.0040a680
mov ecx, dword [esp + 0xc]
push esi
push ecx
call fcn.00406e30
mov esi, eax
push esi
call fcn.00406e70
push esi
push eax
call fcn.00406eb0
mov esi, eax
push esi
call fcn.00406e70
add esp, 0x1c
cmp eax, 1
jne 0x4010bf
push 0
call dword [sym.imp.MSVCRT.dll_exit]
push edi
push esi
push eax
call fcn.004013d0
mov eax, dword [0x418bdc]
add esp, 8
cmp eax, 3
jge 0x401152
mov eax, dword [0x4185e4]
test eax, eax
je 0x401152
mov al, byte [0x418a90]
test al, al
jne 0x401152
push 0x416358
mov edi, 0x41634c
call fcn.004085a0
add esp, 4
mov esi, eax
mov ecx, 0xa
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x401143
push 0x41636c
mov edi, 0x416360
call fcn.004085a0
add esp, 4
mov esi, eax
mov ecx, 0xa
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x401143
push 0x41637c
mov edi, 0x416374
call fcn.004085a0
add esp, 4
mov esi, eax
mov ecx, 7
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x401152
push 0
push 0x416380
call fcn.00401280
add esp, 8
mov eax, dword [0x418b7c]
pop edi
test eax, eax
je 0x401189
mov eax, dword [0x418b78]
test eax, eax
je 0x401176
push 0x418c5c
push 0x4163cc
call fcn.00401280
jmp 0x401186
mov eax, dword [0x418bd8]
push 0x4163f8
push eax
call fcn.004012b0
add esp, 8
call fcn.004059a0
mov eax, dword [0x418bdc]
test eax, eax
jne 0x4011cc
mov eax, dword [0x4185dc]
test eax, eax
jle 0x4011cc
mov eax, dword [0x418b78]
test eax, eax
jne 0x4011b7
mov eax, dword [0x418b7c]
test eax, eax
je 0x4011b7
call fcn.004042e0
call fcn.00404370
mov ecx, dword [0x410ba4]
cmp byte [ecx], 0
je 0x4011cc
call fcn.00404510
push 0
call fcn.004011e0
add esp, 4
pop esi
ret

Function at 0x4011e0
Capabilities:
Terminate process

Disassembly:
cmp dword [0x4185d8], 1
jne 0x401209
mov eax, dword [0x418bdc]
test eax, eax
jne 0x401209
mov eax, dword [0x418b54]
test eax, eax
jne 0x401209
mov eax, dword [0x418aa0]
push eax
call 0x401260
add esp, 4
mov eax, dword [0x418be4]
test eax, eax
jne 0x40121c
mov dword [0x410bf4], 0xffffffff
push esi
push edi
xor edi, edi
mov esi, 0x418594
cmp edi, dword [0x410bf4]
je 0x401238
mov ecx, dword [esi]
push ecx
call 0x401260
add esp, 4
add esi, 4
inc edi
cmp esi, 0x4185c4
jl 0x401225
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.MSVCRT.dll_exit]
pop edi
pop esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
test eax, eax
je 0x401275
cmp byte [eax], 0
je 0x401275
push eax
call dword [sym.imp.MSVCRT.dll__unlink]
pop ecx
ret
Function at 0x403900
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x4185e8]
sub esp, 8
test eax, eax
jne 0x403929
push 0x400
mov dword [0x4185e8], 0x400
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [0x418a94], eax
mov eax, dword [0x4185e8]
push ebx
push ebp
mov ebp, dword [0x418590]
push esi
mov esi, dword [0x418a94]
push edi
mov edi, dword [0x418b1c]
lea ecx, [esi + eax - 1]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], ecx
cmp edi, ebp
jb 0x40397d
mov edx, dword [esp + 0x20]
mov edi, 0x4185ec
push 0x400
push edi
push edx
mov ebp, edi
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
test eax, eax
jle 0x4039e0
lea ebp, [eax + 0x4185ec]
xor ebx, ebx
mov bl, byte [edi]
inc edi
cmp ebx, 0xa
je 0x4039d3
cmp ebx, 0xd
je 0x4039d3
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4039f6
cmp esi, dword [esp + 0x10]
jb 0x4039ce
mov eax, dword [0x4185e8]
mov ecx, dword [0x418a94]
add eax, eax
sub esi, ecx
push eax
push ecx
mov dword [0x4185e8], eax
call dword [sym.imp.MSVCRT.dll_realloc]
mov ecx, dword [0x4185e8]
add esp, 8
mov dword [0x418a94], eax
add esi, eax
lea edx, [eax + ecx - 1]
mov dword [esp + 0x10], edx
mov byte [esi], bl
inc esi
jmp 0x403954
mov dword [esp + 0x14], 1
jmp 0x403954
jge 0x4039f7
mov eax, dword [esp + 0x1c]
push eax
push 0x4167ec
call fcn.00401280
add esp, 8
jmp 0x4039f7
dec edi
mov eax, dword [0x418a94]
mov dword [0x418b1c], edi
cmp esi, eax
mov dword [0x418590], ebp
jne 0x403a16
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov byte [esi], 0
mov eax, dword [0x418a94]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x4061c0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [sym.imp.MSVCRT.dll__iob]
push esi
mov esi, dword [sym.imp.MSVCRT.dll_fprintf]
add eax, 0x40
push 0x4170d0
push eax
call esi
mov ecx, dword [esp + 0x14]
mov eax, dword [sym.imp.MSVCRT.dll__iob]
mov edx, dword [esp + 0x10]
push ecx
add eax, 0x40
push edx
push eax
call esi
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
push 0x4170d8
add ecx, 0x40
push ecx
call esi
add esp, 0x1c
push 1
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
nop
nop
nop
nop
nop
nop
nop
Function at 0x406310
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
push edi
call fcn.00406640
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
test ebx, ebx
mov ebp, eax
jge 0x406331
push edi
call fcn.00406e70
add esp, 4
mov ebx, eax
test ebx, ebx
jne 0x40633b
pop edi
pop ebp
xor eax, eax
pop ebx
ret
push esi
call fcn.00406410
mov esi, eax
mov eax, dword [edi]
push eax
push esi
call fcn.004064e0
add esp, 8
cmp ebx, 1
jle 0x406375
add edi, 4
dec ebx
push 0x4170dc
push esi
call fcn.00406440
mov ecx, dword [edi]
push ecx
push esi
call fcn.004064e0
add esp, 0x10
add edi, 4
dec ebx
jne 0x406358
mov ebx, dword [esi + 8]
push esi
call fcn.00406630
lea edx, [ebp + 2]
push 0x4170e0
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4063a4
push eax
push 0x4170e4
call fcn.004061c0
add esp, 8
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
push edi
push 1
push ebx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp eax, edi
je 0x4063d3
push 0
push 0x417108
call fcn.004061c0
add esp, 8
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
test eax, eax
pop esi
je 0x4063f1
push 0
push 0x417138
call fcn.004061c0
add esp, 8
push ebx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, ebp
pop edi
pop ebp
pop ebx
ret

Function at 0x4069a0
Capabilities:
Query environment variable

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.MSVCRT.dll_getenv]
push esi
call edi
add esp, 4
test eax, eax
push esi
je 0x4069c4
call edi
push eax
call fcn.00406a10
add esp, 8
jmp 0x4069cc
call fcn.00406a30
add esp, 4
mov esi, eax
push esi
call fcn.00406a80
add esp, 4
test eax, eax
jne 0x406a03
mov edi, dword [esp + 0xc]
push esi
call fcn.00406ae0
add esp, 4
test eax, eax
je 0x4069f6
push eax
push edi
call fcn.00406210
add esp, 8
push esi
call fcn.00406a80
add esp, 4
test eax, eax
je 0x4069df
push esi
call fcn.00406d00
add esp, 4
pop edi
pop esi
ret
Function at 0x406d50
Capabilities:
Terminate process

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
cmp edx, 0x4f
push ebx
mov ebx, dword [esp + 0x10]
push ebp
setne al
inc eax
push esi
cmp ebx, 0x2b
mov ebp, eax
push 0x1b6
jne 0x406d82
mov esi, dword [esp + 0x18]
push 0x10a
push esi
call dword [sym.imp.MSVCRT.dll__open]
jmp 0x406d92
mov esi, dword [esp + 0x18]
push 0x309
push esi
call dword [sym.imp.MSVCRT.dll__open]
add esp, 0xc
test eax, eax
jge 0x406db8
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
push esi
add ecx, 0x40
push 0x417270
push ecx
call dword [sym.imp.MSVCRT.dll_fprintf]
add esp, 0xc
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push edi
mov edi, dword [sym.imp.MSVCRT.dll__close]
push eax
call edi
push ebp
call edi
add esp, 8
pop edi
cmp ebx, 0x2b
push 0x1b6
jne 0x406de1
push 0x10a
push esi
call dword [sym.imp.MSVCRT.dll__open]
jmp 0x406ded
push 0x309
push esi
call dword [sym.imp.MSVCRT.dll__open]
add esp, 0xc
cmp eax, ebp
je 0x406db2
cmp ebp, 1
push esi
jne 0x406e0b
mov edx, dword [sym.imp.MSVCRT.dll__iob]
push 0x417290
add edx, 0x40
push edx
jmp 0x406e19
mov eax, dword [sym.imp.MSVCRT.dll__iob]
push 0x4172a8
add eax, 0x20
push eax
call dword [sym.imp.MSVCRT.dll_fprintf]
add esp, 0xc
push 1
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
nop
nop
nop
nop

Function at 0x4072e0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [sym.imp.MSVCRT.dll__iob]
push esi
mov esi, dword [sym.imp.MSVCRT.dll_fprintf]
add eax, 0x40
push 0x4173d4
push eax
call esi
mov ecx, dword [esp + 0x14]
mov eax, dword [sym.imp.MSVCRT.dll__iob]
mov edx, dword [esp + 0x10]
push ecx
add eax, 0x40
push edx
push eax
call esi
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
push 0x4173f8
add ecx, 0x40
push ecx
call esi
add esp, 0x1c
push 1
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
nop
nop
nop
nop
nop
nop
nop

Function at 0x4085a0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x418c98]
mov edx, dword [0x418cc4]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
cmp eax, edx
mov edi, eax
jbe 0x4085f2
mov eax, dword [edi - 8]
sub edi, 8
mov esi, ebp
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x4085e5
test cl, cl
je 0x4085e1
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x4085e5
add eax, 2
add esi, 2
test cl, cl
jne 0x4085c1
xor eax, eax
jmp 0x4085ea
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x408601
cmp edi, edx
ja 0x4085b9
push ebp
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x408930
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x418cc4]
test eax, eax
jne 0x408951
push 0x640
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [0x418c98], eax
mov dword [0x418cc4], eax
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, dword [0x418cb0]
push ebx
push ebp
push esi
push edi
push ecx
push 0x418cc8
push edx
mov dword [0x418ca0], eax
call fcn.00408b10
mov ecx, dword [0x418ca8]
mov ebp, eax
mov eax, dword [0x418cb0]
add esp, 0xc
cmp eax, ecx
jne 0x40898c
call fcn.00408880
mov ecx, dword [0x418cb0]
mov edi, dword [sym.imp.MSVCRT.dll__isctype]
mov esi, dword [esp + 0x14]
mov byte [ecx], 0
mov eax, dword [0x418cb0]
mov ebx, dword [0x418ca0]
inc eax
mov dword [0x418cb0], eax
mov dword [0x418ca0], eax
mov edx, dword [sym.imp.MSVCRT.dll___mb_cur_max]
cmp dword [edx], 1
jle 0x4089d1
xor eax, eax
push 0x107
mov al, byte [esi]
push eax
call edi
add esp, 8
jmp 0x4089e6
mov edx, dword [sym.imp.MSVCRT.dll__pctype]
xor ecx, ecx
mov cl, byte [esi]
mov eax, dword [edx]
mov ax, word [eax + ecx*2]
and eax, 0x107
test eax, eax
jne 0x4089ef
cmp byte [esi], 0x5f
jne 0x408a1c
mov ecx, dword [0x418cb0]
mov eax, dword [0x418ca8]
cmp ecx, eax
jne 0x408a03
call fcn.00408880
mov eax, dword [0x418cb0]
mov dl, byte [esi]
mov byte [eax], dl
mov ecx, dword [0x418cb0]
inc ecx
inc esi
mov dword [0x418cb0], ecx
jmp 0x4089b5
mov ecx, dword [0x418cb0]
mov eax, dword [0x418ca8]
cmp ecx, eax
jne 0x408a30
call fcn.00408880
mov edx, dword [0x418cb0]
mov byte [edx], 0
mov eax, dword [0x418cb0]
inc eax
mov dword [0x418cb0], eax
mov eax, dword [0x418ca0]
push eax
mov esi, eax
call fcn.00408ab0
add esp, 4
test eax, eax
jne 0x408a97
mov eax, dword [0x418cc4]
mov ecx, dword [0x418c98]
add eax, 0x640
cmp ecx, eax
jb 0x408a8c
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
push 0x4177bc
add ecx, 0x40
push ecx
call dword [sym.imp.MSVCRT.dll_fprintf]
add esp, 8
push 1
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, ecx
add ecx, 8
mov dword [0x418c98], ecx
mov dword [eax], esi
mov dword [eax + 4], ebx
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret
Function at 0x409260
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push ebx
push ebp
mov edx, dword [ecx]
mov ebp, dword [eax]
push esi
mov esi, dword [esp + 0x18]
test esi, esi
push edi
mov dword [esp + 0x10], edx
je 0x4093e6
cmp byte [esi], 0
je 0x4093e6
mov ebx, dword [sym.imp.MSVCRT.dll__open]
push 0
push esi
call ebx
add esp, 8
cmp eax, 0xffffffff
mov dword [esp + 0x1c], eax
jne 0x4092c6
or ecx, eax
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push eax
push esi
mov byte [ecx + esi - 1], al
call ebx
add esp, 8
cmp eax, 0xffffffff
mov dword [esp + 0x1c], eax
je 0x4093e6
mov edi, dword [sym.imp.MSVCRT.dll__lseek]
push 2
push 0
push eax
call edi
mov esi, eax
mov eax, dword [esp + 0x28]
push 0
push 0
push eax
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_malloc]
lea ecx, [esi + 0xa]
push ecx
call ebx
mov edx, dword [esp + 0x38]
mov edi, eax
push esi
push edi
push edx
mov dword [esp + 0x3c], edi
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0x28
test eax, eax
jge 0x409308
xor eax, eax
mov byte [edi + eax], 0
lea edi, [ebp*4 + 0x190]
push edi
call ebx
mov ecx, edi
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov esi, ebx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x10]
test ebp, ebp
je 0x409344
mov eax, dword [edi]
add edi, 4
mov dword [ebx], eax
lea esi, [ebx + 4]
dec ebp
mov ecx, dword [esp + 0x14]
push esi
push ecx
call fcn.004093f0
mov ecx, dword [esi]
add esp, 8
test ecx, ecx
je 0x409372
mov ecx, dword [esi + 4]
add esi, 4
test ecx, ecx
jne 0x409358
push esi
push eax
call fcn.004093f0
mov ecx, dword [esi]
add esp, 8
test ecx, ecx
jne 0x409358
mov edx, ebp
dec ebp
test edx, edx
je 0x409389
lea ecx, [ebp + 1]
mov edx, dword [edi]
add edi, 4
mov dword [esi], edx
add esi, 4
dec ecx
jne 0x40937c
cmp dword [0x418cac], 2
jne 0x4093bc
push esi
push eax
call fcn.004093f0
mov ecx, dword [esi]
add esp, 8
test ecx, ecx
je 0x4093bc
mov ecx, dword [esi + 4]
add esi, 4
test ecx, ecx
jne 0x4093a2
push esi
push eax
call fcn.004093f0
mov ecx, dword [esi]
add esp, 8
test ecx, ecx
jne 0x4093a2
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
sub esi, ebx
sar esi, 2
mov dword [eax], esi
push edx
mov dword [ecx], ebx
call dword [sym.imp.MSVCRT.dll__close]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x40a090
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push esi
push edi
push eax
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__read]
mov esi, eax
add esp, 0xc
test esi, esi
jge 0x40a0d1
mov edi, dword [esp + 0x18]
test edi, edi
je 0x40a0d1
call dword [sym.imp.MSVCRT.dll__errno]
mov eax, dword [eax]
push eax
call fcn.0040b1c0
push eax
push 0x41791c
call edi
add esp, 0xc
mov eax, esi
pop edi
pop esi
ret

Function at 0x40a0e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
push edi
push 0x8000
mov eax, dword [esi]
push eax
call dword [sym.imp.MSVCRT.dll__open]
add esp, 8
mov dword [esi + 4], eax
test eax, eax
jl 0x40a18c
mov edi, dword [esp + 0x1c]
mov dword [esi + 8], 0
test edi, edi
mov dword [esi + 0x10], 8
jne 0x40a12e
lea ecx, [esp + 8]
push 8
push ecx
push eax
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
jmp 0x40a13f
push edi
lea edx, [esp + 0xc]
push 8
push edx
push eax
call fcn.0040a090
add esp, 0x10
cmp eax, 8
jne 0x40a167
push eax
lea eax, [esp + 0xc]
push 0x417930
push eax
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x40a167
pop edi
mov eax, 1
pop esi
add esp, 0xc
ret
test edi, edi
je 0x40a178
mov ecx, dword [esi]
push ecx
push 0x41793c
call edi
add esp, 8
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.MSVCRT.dll__close]
add esp, 4
mov dword [esi + 4], 0xffffffff
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
Function at 0x40a7c0
Capabilities:
Query environment variable
Terminate process

Disassembly:
mov eax, dword [0x418e98]
push ebp
test eax, eax
push esi
jne 0x40a7f0
push 0x417d28
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
test eax, eax
je 0x40a7f3
cmp byte [eax], 0
je 0x40a7f3
push eax
call fcn.0040a640
add esp, 4
mov dword [0x418e98], eax
pop esi
pop ebp
ret
mov eax, dword [0x418e94]
test eax, eax
jne 0x40a814
push 0x16b
push 0x417d30
push 0x417d4c
call dword [sym.imp.MSVCRT.dll__assert]
add esp, 0xc
mov eax, dword [0x418e94]
push eax
call dword [sym.imp.MSVCRT.dll__strdup]
mov esi, eax
push esi
call fcn.0040b240
add esp, 8
test eax, eax
push esi
je 0x40a840
call 0x40a990
add esp, 4
mov dword [0x418e98], eax
pop esi
pop ebp
ret
mov ebp, dword [sym.imp.MSVCRT.dll_free]
call ebp
mov ecx, dword [0x418e94]
add esp, 4
mov al, byte [ecx]
inc ecx
test al, al
je 0x40a86b
cmp al, 0x5c
je 0x40a8bc
cmp al, 0x2f
je 0x40a8bc
cmp al, 0x3a
je 0x40a8bc
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a858
call fcn.0040aa00
call fcn.0040aa30
test eax, eax
je 0x40a95e
push eax
call fcn.0040a6c0
mov esi, eax
push esi
call fcn.0040aa70
add esp, 8
test eax, eax
je 0x40a8a8
push esi
call 0x40a990
add esp, 4
mov dword [0x418e98], eax
test eax, eax
jne 0x40a94a
push esi
call ebp
add esp, 4
call fcn.0040aa30
test eax, eax
jne 0x40a87d
jmp 0x40a95e
call fcn.0040aa90
mov esi, eax
test esi, esi
jne 0x40a8e7
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
push 0x417d64
add ecx, 0x40
push ecx
call dword [sym.imp.MSVCRT.dll_fprintf]
add esp, 8
push 1
call dword [sym.imp.MSVCRT.dll_exit]
push ebx
push edi
mov edi, dword [0x418e94]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, esi
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [edx + ecx + 2]
push edi
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebx, eax
mov eax, dword [0x418e94]
push eax
push 0x5c
push esi
push 0x417dd8
push ebx
call dword [sym.imp.MSVCRT.dll_sprintf]
push esi
push edi
push ebx
call fcn.0040aab0
push eax
call 0x40a990
push esi
mov dword [0x418e98], eax
call ebp
mov eax, dword [0x418e98]
add esp, 0x2c
pop edi
pop ebx
pop esi
pop ebp
ret
mov ecx, dword [0x418e90]
push ecx
call ebp
mov eax, dword [0x418e98]
add esp, 4
pop esi
pop ebp
ret
mov edx, dword [0x418e94]
mov eax, dword [sym.imp.MSVCRT.dll__iob]
push edx
add eax, 0x40
push 0x417de0
push eax
call dword [sym.imp.MSVCRT.dll_fprintf]
add esp, 0xc
push 1
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp + 4]
push esi
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, 3
add ecx, edx
cmp ecx, edx
je 0x40a9da
mov al, byte [ecx]
dec ecx
cmp al, 0x5c
je 0x40a9b8
cmp al, 0x2f
jne 0x40a9c6
mov al, byte [ecx]
cmp al, 0x5c
je 0x40a9c2
cmp al, 0x2f
jne 0x40a9c5
dec ecx
jmp 0x40a9b8
dec esi
test esi, esi
jne 0x40a9a9
push edx
mov byte [ecx + 1], 0
call fcn.0040a640
add esp, 4
pop edi
pop esi
ret
test esi, esi
jne 0x40a9ee
push edx
mov byte [ecx + 1], 0
call fcn.0040a640
add esp, 4
pop edi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x40aa00
Capabilities:
Query environment variable

Disassembly:
push 0x417e4c
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
mov dword [0x418e88], eax
test eax, eax
je 0x40aa2b
push eax
call dword [sym.imp.MSVCRT.dll__strdup]
add esp, 4
mov dword [0x418e88], eax
mov dword [0x418e90], eax
ret

Function at 0x40aab0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
lea esi, [eax + ebp - 1]
mov al, byte [eax + ebp - 1]
cmp al, 0x5c
je 0x40aad8
cmp al, 0x2f
je 0x40aad8
cmp al, 0x3a
je 0x40aad8
mov al, byte [esi - 1]
dec esi
cmp al, 0x5c
jne 0x40aac8
lea ecx, [esi + 1]
push ecx
call dword [sym.imp.MSVCRT.dll__strdup]
mov edi, dword [sym.imp.MSVCRT.dll__chdir]
push ebp
mov ebx, eax
mov byte [esi], 0
call edi
add esp, 8
call fcn.0040aa90
mov esi, eax
test esi, esi
jne 0x40ab1e
mov edx, dword [sym.imp.MSVCRT.dll__iob]
push 0x417e54
add edx, 0x40
push edx
call dword [sym.imp.MSVCRT.dll_fprintf]
add esp, 8
push 1
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [esp + 0x1c]
push eax
call edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [edx + ecx + 2]
mov ecx, dword [esp + 0x18]
cmp eax, ecx
jle 0x40ab59
push eax
push ebp
call dword [sym.imp.MSVCRT.dll_realloc]
add esp, 8
mov ebp, eax
push ebx
push 0x5c
push esi
push 0x417ec8
push ebp
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edi, dword [sym.imp.MSVCRT.dll_free]
push ebx
call edi
push esi
call edi
add esp, 0x1c
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x40af10
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
push edi
test eax, eax
je 0x40af2c
push esi
push eax
call fcn.0040afa0
add esp, 8
test eax, eax
jne 0x40af98
mov edi, dword [sym.imp.MSVCRT.dll_getenv]
push 0x418068
call edi
add esp, 4
test eax, eax
je 0x40af4e
push esi
push eax
call fcn.0040afa0
add esp, 8
test eax, eax
jne 0x40af98
push 0x418074
call edi
add esp, 4
test eax, eax
je 0x40af6a
push esi
push eax
call fcn.0040afa0
add esp, 8
test eax, eax
jne 0x40af98
push 0x41807c
call edi
add esp, 4
test eax, eax
je 0x40af86
push esi
push eax
call fcn.0040afa0
add esp, 8
test eax, eax
jne 0x40af98
push esi
push 0x418eb0
call fcn.0040afa0
add esp, 8
test eax, eax
jne 0x40af98
pop edi
pop esi
ret

Function at 0x40b1d0
Capabilities:
Create directory

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
mov bl, byte [edi]
lea esi, [edi + 1]
test ebx, ebx
je 0x40b22b
mov ebp, dword [sym.imp.MSVCRT.dll__mkdir]
lea eax, [esi - 1]
cmp eax, edi
jbe 0x40b20d
cmp byte [esi - 2], 0x3a
je 0x40b20d
cmp ebx, 0x5c
je 0x40b200
cmp ebx, 0x2f
jne 0x40b20d
push edi
mov byte [esi - 1], 0
call ebp
add esp, 4
mov byte [esi - 1], bl
xor ebx, ebx
mov bl, byte [esi]
inc esi
test ebx, ebx
jne 0x40b1e9
xor eax, eax
mov al, byte [esi - 2]
cmp eax, 0x5c
je 0x40b22b
cmp eax, 0x2f
je 0x40b22b
push edi
call ebp
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret