joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404986
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403721
and dword [ebp - 4], 0
cmp dword [0x445068], 0
mov ebx, eax
jne 0x404a37
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x404ae8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x404ae8
push eax
call fcn.004036af
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x445068], eax
call esi
push eax
call fcn.004036af
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44506c], eax
call esi
push eax
call fcn.004036af
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x445070], eax
call esi
push eax
call fcn.004036af
pop ecx
mov dword [0x445078], eax
test eax, eax
je 0x404a37
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004036af
pop ecx
mov dword [0x445074], eax
mov eax, dword [0x445074]
cmp eax, ebx
je 0x404a8f
cmp dword [0x445078], ebx
je 0x404a8f
push eax
call fcn.0040372a
push dword [0x445078]
mov esi, eax
call fcn.0040372a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x404a8f
test edi, edi
je 0x404a8f
call esi
test eax, eax
je 0x404a86
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x404a86
test byte [ebp - 0xc], 1
jne 0x404a8f
or dword [ebp + 0x10], 0x200000
jmp 0x404ac8
mov eax, dword [0x44506c]
cmp eax, ebx
je 0x404ac8
push eax
call fcn.0040372a
pop ecx
test eax, eax
je 0x404ac8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x404ac8
mov eax, dword [0x445070]
cmp eax, ebx
je 0x404ac8
push eax
call fcn.0040372a
pop ecx
test eax, eax
je 0x404ac8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x445068]
call fcn.0040372a
pop ecx
test eax, eax
je 0x404ae8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x404aea
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0x1da17ed6
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
mov ecx, 0x75640c7d
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401135
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
je 0x40115d
call esi
sub eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
jae 0x40117e
cmp byte [ebp + 0x14], 0
je 0x401170
cmp dword [ebx], edi
jne 0x401174
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebx], edi
jne 0x401167
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40114d
xor al, al
jmp 0x401169
Function at 0x401418
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x40d010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x40dcfc]
cmp byte [eax + 0x2140], 0
push edi
mov edi, dword [ebp + 8]
je 0x401445
push 2
pop eax
jmp 0x4015f6
mov eax, dword [edi + 0x14]
push esi
mov esi, dword [eax]
lea eax, [ebp - 0x804]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401462
sub eax, ecx
mov edx, eax
lea eax, [ebp - 0x804]
lea ecx, [eax + 1]
push ebx
mov bl, byte [eax]
inc eax
test bl, bl
jne 0x401477
sub eax, ecx
add eax, edx
cmp eax, 0x104
jb 0x4014a1
and dword [ebp - 0x808], 0
push 0x40bc40
lea eax, [ebp - 0x808]
push eax
call fcn.00401d6a
mov eax, dword [edi + 8]
dec eax
je 0x4015bb
dec eax
je 0x401593
dec eax
jne 0x4015f2
mov cl, byte [esi]
mov bl, 0x5c
cmp cl, bl
je 0x401559
cmp cl, 0x2f
je 0x401559
mov dl, 0x2e
cmp cl, dl
jne 0x4014e4
cmp byte [esi + 1], dl
jne 0x4014e4
mov al, byte [esi + 2]
cmp al, bl
je 0x401559
cmp al, 0x2f
je 0x401559
xor eax, eax
jmp 0x40150e
cmp cl, bl
je 0x4014f1
cmp cl, 0x2f
jne 0x40150a
cmp byte [eax + esi + 1], dl
jne 0x40150a
cmp byte [eax + esi + 2], dl
jne 0x40150a
mov cl, byte [eax + esi + 3]
cmp cl, bl
je 0x401559
cmp cl, 0x2f
je 0x401559
inc eax
mov cl, byte [eax + esi]
test cl, cl
jne 0x4014e8
mov ecx, dword [0x40dcfc]
mov edx, esi
add ecx, 0x1106
mov al, byte [edx]
inc edx
mov byte [ecx], al
inc ecx
test al, al
jne 0x401520
mov eax, dword [0x40dcfc]
push 1
push 0x2710
push 0x16
mov dword [eax], 0x15
push dword [0x40dcfc]
call fcn.00401135
test al, al
mov eax, dword [0x40dcfc]
jne 0x401561
mov byte [eax + 0x2140], 1
push 2
pop eax
jmp 0x4015f4
cmp dword [eax + 0x2108], 0
je 0x401559
push esi
call fcn.004013ec
mov ecx, dword [0x40dcfc]
add ecx, 0x1106
mov al, byte [esi]
inc esi
mov byte [ecx], al
inc ecx
test al, al
jne 0x40157c
mov eax, dword [0x40dcfc]
mov dword [eax], 0xb
jmp 0x4015e1
mov eax, dword [edi + 0x14]
mov edx, dword [0x40dcfc]
mov ecx, dword [eax]
add edx, 0x1106
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x4015a4
mov eax, dword [0x40dcfc]
mov dword [eax], 0xa
jmp 0x4015e1
mov eax, dword [edi + 0x14]
mov edx, dword [0x40dcfc]
mov ecx, dword [eax]
add edx, 0x1106
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x4015cc
mov eax, dword [0x40dcfc]
mov dword [eax], 9
push 1
push 0x64
push 0xc
push dword [0x40dcfc]
call fcn.00401135
xor eax, eax
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00401cd4
leave
ret 4
Function at 0x401946
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x409294
call fcn.00402408
mov ebx, dword [ebp + 8]
mov edi, ebx
mov dword [ebp + 8], edi
call fcn.0040102b
test al, al
jne 0x40196e
mov dword [ebx], 2
jmp 0x401ad9
call fcn.004018b4
xor eax, eax
inc eax
push eax
push 0x2710
push 3
push ebx
mov dword [ebx], eax
call fcn.00401135
test al, al
jne 0x401995
mov dword [ebx], 6
jmp 0x401ad9
add ebx, 4
and dword [0x40dcf0], 0
xor esi, esi
xor ecx, ecx
inc esi
cmp byte [ebx], cl
je 0x4019c8
mov eax, ebx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4019ad
sub eax, edi
lea ecx, [ecx + eax + 1]
lea esi, [esi + eax + 1]
lea eax, [ecx + ebx]
cmp byte [eax], dl
jne 0x4019aa
mov edi, dword [ebp + 8]
push esi
push dword [0x40dcf0]
call fcn.00401e07
pop ecx
pop ecx
mov dword [0x40dcf0], eax
test eax, eax
je 0x401acb
xor ecx, ecx
cmp byte [ebx], cl
je 0x401a2b
mov edi, ebx
mov esi, edi
lea edx, [esi + 1]
mov dword [ebp - 0x14], edx
mov dl, byte [esi]
inc esi
test dl, dl
jne 0x4019f3
sub esi, dword [ebp - 0x14]
mov edx, esi
lea esi, [eax + ecx]
mov al, byte [edi]
inc edi
mov byte [esi], al
inc esi
test al, al
jne 0x401a02
mov eax, dword [0x40dcf0]
add eax, edx
mov byte [eax + ecx], 0xd
mov eax, dword [0x40dcf0]
lea ecx, [ecx + edx + 1]
lea edi, [ecx + ebx]
cmp byte [edi], 0
jne 0x4019eb
mov edi, dword [ebp + 8]
push 4
mov byte [eax + ecx], 0
pop eax
push 0
push 0x2710
push eax
push edi
mov dword [edi], eax
call fcn.00401135
test al, al
je 0x401a4f
cmp dword [edi], 3
je 0x40199f
lea eax, [edi + 0x1906]
push eax
mov dword [0x40dcfc], edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp dword [edi], 5
jne 0x401acb
and dword [ebp - 4], 0
cmp byte [edi + 0x804], 0
lea eax, [edi + 0x1006]
push eax
je 0x401a86
lea eax, [edi + 4]
push eax
call fcn.00401182
jmp 0x401ac0
xor eax, eax
cmp byte [edi + 0x1005], al
sete al
push eax
lea eax, [edi + 0x805]
push eax
lea eax, [edi + 4]
push eax
call fcn.004011eb
jmp 0x401ac0
test eax, eax
je 0x401ad3
cmp eax, 0xff
je 0x401ad3
mov dword [edi], 6
jmp 0x401ad9
mov dword [edi], 7
call fcn.0040243e
ret 4

Function at 0x401ae1
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x40d010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push edi
push 0x800
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00401000
lea eax, [ebp - 0x804]
push eax
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov edi, eax
test edi, edi
je 0x401b6f
push esi
push 0x10000
push 0
push 0
push 6
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x401b6e
push esi
call fcn.00401946
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x40dcf4]
test eax, eax
je 0x401b5e
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x40dcf0]
test eax, eax
je 0x401b6e
push eax
call fcn.00402452
pop ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop edi
call fcn.00401cd4
leave
ret 0x10
Function at 0x401cd4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40d010]
jne 0x401cde
repz ret
jmp fcn.00402691

Function at 0x407c92
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404b17
and dword [ebp - 4], 0
cmp dword [0x4107b8], 0
mov ebx, eax
jne 0x407d43
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407df4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407df4
push eax
call fcn.00404aa5
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4107b8], eax
call esi
push eax
call fcn.00404aa5
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4107bc], eax
call esi
push eax
call fcn.00404aa5
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4107c0], eax
call esi
push eax
call fcn.00404aa5
pop ecx
mov dword [0x4107c8], eax
test eax, eax
je 0x407d43
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404aa5
pop ecx
mov dword [0x4107c4], eax
mov eax, dword [0x4107c4]
cmp eax, ebx
je 0x407d9b
cmp dword [0x4107c8], ebx
je 0x407d9b
push eax
call fcn.00404b20
push dword [0x4107c8]
mov esi, eax
call fcn.00404b20
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407d9b
test edi, edi
je 0x407d9b
call esi
test eax, eax
je 0x407d92
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407d92
test byte [ebp - 0xc], 1
jne 0x407d9b
or dword [ebp + 0x10], 0x200000
jmp 0x407dd4
mov eax, dword [0x4107bc]
cmp eax, ebx
je 0x407dd4
push eax
call fcn.00404b20
pop ecx
test eax, eax
je 0x407dd4
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407dd4
mov eax, dword [0x4107c0]
cmp eax, ebx
je 0x407dd4
push eax
call fcn.00404b20
pop ecx
test eax, eax
je 0x407dd4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4107b8]
call fcn.00404b20
pop ecx
test eax, eax
je 0x407df4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407df6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4024a0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
cmp byte [esi], 0
jne 0x4024d3
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea esi, [ebp - 0x10c]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push esi
call fcn.00402300
add esp, 0x14
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 8]
lea eax, [eax + edi*4]
push eax
call fcn.00404560
pop ecx
mov ebx, eax
test ebx, ebx
je 0x402525
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebx + edi*4]
push eax
push ebx
push esi
call fcn.00402300
add esp, 0x14
mov eax, dword [ebp - 4]
dec eax
mov dword [0x40dec4], eax
mov dword [0x40dec0], ebx
jmp 0x40252d
push 0xfffffffffffffffc
call fcn.004026c0
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402540
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov dword [ebp - 4], eax
test eax, eax
je 0x4025cc
mov eax, dword [ebp - 4]
xor edx, edx
cmp byte [eax], 0
je 0x402579
or ecx, 0xffffffff
inc ecx
cmp byte [eax + ecx], 0
jne 0x402563
inc ecx
cmp byte [eax], 0x3d
je 0x402572
add edx, ecx
add eax, ecx
cmp byte [eax], 0
jne 0x402560
inc edx
push edx
call fcn.00404560
pop ecx
mov dword [0x40dec8], eax
test eax, eax
je 0x4025df
mov edx, eax
mov eax, dword [ebp - 4]
mov esi, eax
cmp byte [esi], 0
je 0x4025be
or eax, 0xffffffff
inc eax
cmp byte [esi + eax], 0
jne 0x402599
lea edi, [eax + 1]
cmp byte [esi], 0x3d
je 0x4025b7
xor ecx, ecx
mov al, byte [esi + ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x4025aa
add edx, edi
add esi, edi
cmp byte [esi], 0
jne 0x402596
mov byte [edx], 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x4025e7
push 1
push 1
call fcn.004045c0
add esp, 8
mov dword [0x40dec8], eax
jmp 0x4025e7
push 0xfffffffffffffffc
call fcn.004026c0
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4048a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
push ebx
push esi
push edi
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov esi, edx
mov edx, dword [ebp + 0x10]
add edx, eax
mov dword [ebp - 0x808], edx
xor edi, edi
mov dword [ebp - 0x80c], 0
cmp esi, dword [ebp - 0x808]
jae 0x404971
lea eax, [ebp - 0x804]
cmp byte [esi], 0xa
jne 0x4048ed
add dword [ebp - 0x80c], 1
mov byte [eax], 0xd
inc eax
inc eax
inc esi
mov dl, byte [esi - 1]
mov byte [eax - 1], dl
lea edx, [ebp - 5]
cmp eax, edx
jae 0x404904
cmp esi, dword [ebp - 0x808]
jb 0x4048dd
lea edx, [ebp - 0x804]
mov ebx, eax
sub ebx, edx
push dword [ebp + 0xc]
call fcn.00407e40
pop ecx
test al, al
je 0x404946
push dword [ebp + 0xc]
call fcn.00407dd0
pop ecx
push ebx
lea edx, [ebp - 0x804]
push edx
push eax
call fcn.00407fc0
add esp, 0xc
test al, al
je 0x404975
add edi, ebx
inc esi
cmp esi, dword [ebp - 0x808]
jb 0x4048d7
jmp 0x404971
push dword [ebp + 0xc]
call fcn.00407dd0
pop ecx
push 0
lea edx, [ebp - 4]
push edx
push ebx
lea edx, [ebp - 0x804]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40497c
mov eax, dword [ebp - 4]
add edi, eax
cmp eax, ebx
jae 0x40493b
xor esi, esi
jmp 0x404984
mov esi, 0x1d
jmp 0x404984
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x80c]
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov dword [eax + 8], esi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4049b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
push ebx
push esi
push edi
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov esi, edx
mov edx, dword [ebp + 0x10]
add edx, eax
mov dword [ebp - 0x80c], edx
mov dword [ebp - 0x808], 0
xor edi, edi
cmp esi, dword [ebp - 0x80c]
jae 0x404a77
lea eax, [ebp - 0x804]
cmp word [esi], 0xa
jne 0x4049fe
add edi, 2
mov word [eax], 0xd
add eax, 2
add eax, 2
add esi, 2
mov dx, word [esi - 2]
mov word [eax - 2], dx
lea edx, [ebp - 6]
cmp eax, edx
jae 0x404a1b
cmp esi, dword [ebp - 0x80c]
jb 0x4049ed
lea edx, [ebp - 0x804]
mov ebx, eax
sub ebx, edx
push dword [ebp + 0xc]
call fcn.00407e40
pop ecx
test al, al
je 0x404a91
push dword [ebp + 0xc]
call fcn.00407dd0
pop ecx
push 0
lea edx, [ebp - 4]
push edx
mov edx, ebx
shr edx, 1
push edx
lea edx, [ebp - 0x804]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
test eax, eax
je 0x404a83
shl dword [ebp - 4], 1
mov eax, dword [ebp - 4]
add dword [ebp - 0x808], eax
cmp eax, ebx
jb 0x404a77
add esi, 2
cmp esi, dword [ebp - 0x80c]
jb 0x4049e7
mov dword [ebp - 0x810], 0
jmp 0x404abf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x810], eax
jmp 0x404abf
push dword [ebp + 0xc]
call fcn.00407dd0
pop ecx
push 0
lea edx, [ebp - 4]
push edx
push ebx
lea edx, [ebp - 0x804]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x404a5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x810], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x808]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov dword [eax + 4], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x810]
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404af0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc10
push ebx
push esi
push edi
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov ebx, edx
mov edx, dword [ebp + 0x10]
add edx, eax
mov dword [ebp - 0xc0c], edx
mov dword [ebp - 0xc08], 0
cmp ebx, dword [ebp - 0xc0c]
jae 0x404ba2
lea eax, [ebp - 0x404]
cmp word [ebx], 0xa
jne 0x404b39
mov word [eax], 0xd
add eax, 2
add eax, 2
add ebx, 2
mov dx, word [ebx - 2]
mov word [eax - 2], dx
lea edx, [ebp - 6]
cmp eax, edx
jae 0x404b56
cmp ebx, dword [ebp - 0xc0c]
jb 0x404b2b
push 0
push 0
push 0x800
lea edx, [ebp - 0xc04]
push edx
lea edx, [ebp - 0x404]
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x404]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x404bae
lea esi, [ebp + eax - 0xc04]
lea eax, [ebp - 0xc04]
cmp esi, eax
jbe 0x404c07
lea edi, [ebp - 0xc04]
jmp 0x404be0
mov dword [ebp - 0xc10], 0
jmp 0x404bba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc10], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc08]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc10]
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
jmp 0x404c4a
push dword [ebp + 0xc]
call fcn.00407dd0
pop ecx
push 0
lea edx, [ebp - 4]
push edx
mov edx, esi
sub edx, edi
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404c26
add edi, dword [ebp - 4]
cmp edi, esi
jb 0x404be0
mov eax, ebx
sub eax, dword [ebp + 0x10]
mov dword [ebp - 0xc08], eax
add ebx, 2
cmp ebx, dword [ebp - 0xc0c]
jb 0x404b25
jmp 0x404ba2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc08]
mov dword [edx], ecx
mov edx, dword [ebp + 8]
mov dword [edx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405d20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
add edx, eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0xc]
mov edi, eax
mov ebx, edi
cmp ebx, dword [ebp - 0xc]
jae 0x405e61
cmp byte [ebx], 0x1a
je 0x405e0c
cmp byte [ebx], 0xd
jne 0x405d6f
lea eax, [ebx + 1]
cmp eax, dword [ebp - 0xc]
jae 0x405d7c
cmp byte [ebx + 1], 0xa
jne 0x405d6f
mov byte [edi], 0xa
inc edi
add ebx, 2
jmp 0x405e58
inc edi
inc ebx
mov al, byte [ebx - 1]
mov byte [edi - 1], al
jmp 0x405e58
inc ebx
push esi
call fcn.00407dd0
pop ecx
push 0
lea edx, [ebp - 8]
push edx
push 1
lea edx, [ebp - 1]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405e7d
cmp dword [ebp - 8], 0
je 0x405e7d
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x40df80]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
test byte [eax + edx + 4], 0x48
je 0x405dfc
cmp byte [ebp - 1], 0xa
je 0x405e07
mov byte [edi], 0xd
inc edi
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x40df80]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
mov cl, byte [ebp - 1]
mov byte [eax + edx + 6], cl
jmp 0x405e58
inc edi
jmp 0x405e58
cmp byte [ebp - 1], 0xa
jne 0x405e68
cmp edi, dword [ebp + 0xc]
jne 0x405e68
mov byte [edi], 0xa
jmp 0x405df9
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x40df80]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
test byte [eax + edx + 4], 0x40
jne 0x405e50
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x40df80]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
or byte [eax + edx + 4], 2
jmp 0x405e61
inc edi
mov al, byte [ebx]
mov byte [edi - 1], al
jmp 0x405e61
cmp ebx, dword [ebp - 0xc]
jb 0x405d47
mov eax, edi
sub eax, dword [ebp + 0xc]
jmp 0x405e85
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push esi
call fcn.004080b0
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x405e58
mov byte [edi], 0xd
jmp 0x405df9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405e90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
add edx, eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0xc]
mov edi, eax
mov ebx, edi
cmp ebx, dword [ebp - 0xc]
jae 0x406014
cmp word [ebx], 0x1a
je 0x405fbb
cmp word [ebx], 0xd
jne 0x405ee6
lea eax, [ebx + 2]
cmp eax, dword [ebp - 0xc]
jae 0x405ef9
cmp word [ebx + 2], 0xa
jne 0x405ee6
mov word [edi], 0xa
add edi, 2
add ebx, 4
jmp 0x40600b
add edi, 2
add ebx, 2
mov ax, word [ebx - 2]
mov word [edi - 2], ax
jmp 0x40600b
add ebx, 2
push esi
call fcn.00407dd0
pop ecx
push 0
lea edx, [ebp - 8]
push edx
push 2
lea edx, [ebp - 2]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x406034
cmp dword [ebp - 8], 0
je 0x406034
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x40df80]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
test byte [eax + edx + 4], 0x48
je 0x405fa8
cmp word [ebp - 2], 0xa
je 0x405fb4
mov word [edi], 0xd
add edi, 2
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x40df80]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
mov cl, byte [ebp - 2]
mov byte [eax + edx + 6], cl
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x40df80]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
movzx ecx, word [ebp - 2]
sar ecx, 8
mov byte [eax + edx + 7], cl
jmp 0x40600b
add edi, 2
jmp 0x40600b
cmp word [ebp - 2], 0xa
jne 0x40601b
cmp edi, dword [ebp + 0xc]
jne 0x40601b
mov word [edi], 0xa
jmp 0x405fa3
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x40df80]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
test byte [eax + edx + 4], 0x40
jne 0x405fff
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x40df80]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
or byte [eax + edx + 4], 2
jmp 0x406014
add edi, 2
mov ax, word [ebx]
mov word [edi - 2], ax
jmp 0x406014
cmp ebx, dword [ebp - 0xc]
jb 0x405eb7
mov eax, edi
sub eax, dword [ebp + 0xc]
jmp 0x40603e
push 1
push 0xffffffffffffffff
push 0xfffffffe
push esi
call fcn.004080b0
add esp, 0x10
cmp word [ebp - 2], 0xa
je 0x40600b
mov word [edi], 0xd
jmp 0x405fa3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406130
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x40df80]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
test byte [eax + edx + 4], 0x48
jne 0x40616d
mov dword [ebp - 8], 0
jmp 0x406181
push ebx
push edi
push esi
call fcn.004060d0
add esp, 0xc
mov edx, eax
mov dword [ebp - 8], edx
add edi, eax
sub ebx, eax
push esi
call fcn.00407dd0
pop ecx
push 0
lea edx, [ebp - 4]
push edx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4061a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4061ab
mov edx, dword [ebp - 4]
add dword [ebp - 8], edx
xor eax, eax
mov edx, dword [ebp - 8]
xchg edx, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret