joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461e89
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x461ec1
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045ff16
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045feee
jmp 0x461ecd
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x463577
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4635b9
call fcn.004692f4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4635b9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4635b0
xor eax, eax
jmp 0x4635c1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004635c7
pop edi
pop esi
pop ebx
ret 4

Function at 0x469824
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x469852
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x469870
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046978a
jmp 0x469870
mov eax, dword [esi + 0x14]
test eax, eax
je 0x469870
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046978a
test edi, edi
mov eax, edi
jne 0x46985a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401008
Capabilities:
Accept command line arguments
Set console window title

Disassembly:
xor eax, eax
mov ecx, 0x403ad1
mov edi, 0x403018
sub ecx, edi
shr ecx, 2
rep stosd dword es:[edi], eax
dec eax
mov cl, 0xa
mov edi, 0x403018
rep stosd dword es:[edi], eax
call sub.KERNEL32.DLL_GetProcessHeap
mov dword [0x403088], eax
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x4030b4], eax
xchg edi, eax
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
mov dword [0x403080], eax
mov esi, 0x403388
push esi
push eax
call sub.KERNEL32.DLL_GetConsoleScreenBufferInfo
test eax, eax
je 0x40106b
mov al, byte [esi + 8]
mov byte [0x4030f1], al
cmp dword [esi + 4], 0
jne 0x40106b
or byte [0x4030f0], 1
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [0x403084], eax
push edi
call fcn.00401c77
pop edi
mov ecx, 0x100
mov ah, 0x20
cmp byte [edi], 0x22
jne 0x40108d
mov ah, 0x22
inc edi
mov esi, edi
lodsb al, byte [esi]
cmp al, ah
je 0x401099
test al, al
jne 0x40108f
dec esi
lodsb al, byte [esi]
cmp al, 0x20
je 0x401099
dec esi
mov dword [0x4030b8], esi
push esi
mov edi, 0x403108
lodsb al, byte [esi]
test al, al
je 0x4010e8
cmp al, 0x2d
je 0x4010b8
cmp al, 0x2f
jne 0x4010ab
cmp byte [esi - 2], 0x20
jne 0x4010ab
mov ah, byte [esi]
cmp ah, 0x20
je 0x4010ab
test ah, ah
je 0x4010ab
test byte [0x4030f0], 0x80
je 0x4010de
mov ah, byte [esi + 1]
cmp ah, 0x20
je 0x4010de
test ah, ah
jne 0x4010ab
lodsb al, byte [esi]
stosb byte es:[edi], al
cmp al, 0x20
je 0x4010ab
test al, al
jne 0x4010de
stosb byte es:[edi], al
call fcn.00401336
pop esi
mov edi, 0x403188
mov ebx, edi
mov dword [0x4030bc], edi
call fcn.004012ca
mov dword [0x4030c8], ecx
cmp ecx, ebx
jne 0x401112
call fcn.00401989
jmp 0x40115b
call fcn.00401304
mov dword [0x4030c0], ecx
mov dword [0x4030c4], edx
mov edi, 0x403288
mov dword [0x4030cc], edi
cmp byte [esi - 1], 0
je 0x401156
mov ebx, edi
call fcn.004012ca
mov dword [0x4030d8], ecx
cmp ecx, ebx
je 0x401156
call fcn.00401304
mov dword [0x4030d0], ecx
mov dword [0x4030d4], edx
call fcn.00401c77
mov esi, dword [0x4030bc]
mov edi, 0x403388
push edi
lodsb al, byte [esi]
stosb byte es:[edi], al
test al, al
jne 0x401167
dec edi
mov esi, 0x40194d
cmp edi, 0x403388
jne 0x40117e
add esi, 3
lodsb al, byte [esi]
stosb byte es:[edi], al
test al, al
jne 0x40117e
call sub.KERNEL32.DLL_SetConsoleTitleA
call fcn.00401c78
xchg edi, eax
Function at 0x401c78
Capabilities:
Get common file path
Get disk information

Disassembly:
mov esi, 0x4034c1
mov dword [esi], 0x94
push esi
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [esi + 4], 5
ja 0x401c97
jb 0x401c9e
cmp dword [esi + 8], 1
jb 0x401c9e
mov byte [0x40348e], 1
mov ebx, dword [0x4030cc]
cmp byte [ebx], 0
jne 0x401cc5
push ebx
push 0x100
call sub.KERNEL32.DLL_GetCurrentDirectoryA
add eax, ebx
mov dword [0x4030d4], eax
mov dword [0x4030d0], eax
mov dword [0x4030d8], eax
call sub.KERNEL32.DLL_GetLogicalDrives
mov dword [0x403499], eax
xchg ebx, eax
mov esi, dword [0x4030bc]
cmp byte [esi + 1], 0x3a
jne 0x401cff
movzx eax, byte [esi]
sub al, 0x41
bt ebx, eax
jb 0x401cff
call fcn.00401231
dec ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
popal
insb byte es:[edi], dx
and byte [ebx + 0x6f], dh
jne 0x401d69
arpl word [ebp + 0x20], sp
jb 0x401d66
jbe 0x401ce4
mov esi, dword [0x4030cc]
cmp byte [esi + 1], 0x3a
jne 0x401d33
movzx eax, byte [esi]
sub al, 0x41
bt ebx, eax
jb 0x401d33
call fcn.00401231
dec ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
popal
insb byte es:[edi], dx
and byte [ebp + 0x73], ah
je 0x401d90
invalid
outsb dx, byte [esi]
popal
je 0x401d94
outsd dx, dword [esi]
outsb dx, byte [esi]
and byte [edx + esi*2 + 0x69], ah
jbe 0x401d18
mov eax, dword [0x4030d0]
cmp byte [eax], 0x2e
jne 0x401d53
cmp eax, dword [0x4030d4]
jb 0x401d53
mov esi, dword [0x4030bc]
call fcn.00402370
xor eax, eax
ret
mov al, 0x5c
mov edi, dword [0x4030d8]
cmp byte [edi - 1], al
je 0x401d6a
stosb byte es:[edi], al
mov dword [0x4030d4], edi
xor al, al
add byte [edx], dh
shr byte [edx + 0x4030ecba], 0
stosb byte es:[edi], al
mov edx, 0x4030ec
bt dword [edx], 0xa
jae 0x401d7b
and dword [edx], 0xffffff7c
bt dword [edx], 1
jae 0x401dd2
and dword [edx], 0xfffffb36
bts dword [edx], 8
mov ecx, 0x80
mov esi, 0x403188
mov edi, 0x4038d1
add byte [edi + 0x4038d1], bh
rep movsd dword es:[edi], dword [esi]
push dword [0x4030bc]
mov esi, 0x402547
mov edi, dword [0x4030d4]
push edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.00401eba
pop dword [0x4030d4]
pop dword [0x4030bc]
mov ecx, 0x80
mov esi, 0x4038d1
mov edi, 0x403188
rep movsd dword es:[edi], dword [esi]
call fcn.00402089
call fcn.004016e7
mov eax, dword [0x40349d]
push eax
call fcn.00402532
call fcn.00401658
and byte [esi + 0x69], al
insb byte es:[edi], dx
in eax, 0x58
dec eax
je 0x401dfc
mov al, 0x73
call fcn.004016f0
call fcn.00401658
and byte [ecx + 0x6e], ch
mov al, byte [0x4034a1a1]
add byte [ebp - 0x17bf6340], al
pop ds
pop es
add byte [eax], al
call fcn.00401658
and byte [ecx + ebp*2 + 0x72], al
arpl word gs:[edi + ebp*2 - 0xe], si
popfd
je 0x401e2e
call fcn.00401658
imul esp, dword [ebp - 0xd], 0x79b007eb
mov al, 0x79
call fcn.004016f0
call fcn.00401658
sub al, 0x20
mov al, byte [0x4034a9a1]
add al, ch
jmp 0x401e4b
jmp dword [eax]
Function at 0x4017c0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
movzx eax, ax
push ebx
push eax
push 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
ja 0x40183e
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40181a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401836
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov ebx, dword [esp + 0x18]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401886
add ebx, 0xfffffff0
lea ecx, [ebx + 0xc]
or edx, eax
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40187d
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
jmp 0x40181d
push 0
lea ecx, [esp + 0x14]
push ecx
push edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4018b9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4018d9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x4020d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x440d78
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
push ebx
push edi
mov eax, dword [0x44eab0]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
xor ebx, ebx
lea eax, [esp + 0x28]
mov dword [esp + 0xb8], ebx
push eax
mov dword [esp + 0x14], esi
mov edi, ecx
mov dword [esp + 0x10], ebx
call fcn.004029b0
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx + 4]
and dword [esp + eax + 0x38], 0xfffffffe
mov edx, dword [esp + 0x28]
lea eax, [esp + eax + 0x28]
mov eax, dword [edx + 4]
lea eax, [esp + eax + 0x28]
mov dword [eax + 0x14], 6
mov eax, 1
mov dword [esp + 0xb8], eax
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
mov dword [esp + 0xc], eax
lea eax, [esp + 0x30]
push eax
mov ecx, edi
call fcn.00403110
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
add esp, 4
test byte [edx + eax + 8], 6
jne 0x4021c3
push esi
lea eax, [esp + 0x2c]
push eax
call fcn.00402220
test al, al
je 0x4021c3
lea ecx, [esp + 0x7c]
mov byte [esp + 0xb8], bl
call fcn.00402290
lea ecx, [esp + 0x7c]
push ecx
mov dword [esp + 0x80], vtable.std::ios_base.0
call fcn.00427808
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0xb0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0xb0
ret
push str.bad_cast
lea ecx, [esp + 0x18]
call fcn.0041014d
mov dword [esp + 0x14], vtable.boost::bad_lexical_cast.0
mov dword [esp + 0x20], 0x450fd0
mov dword [esp + 0x24], 0x450ff8
mov byte [esp + 0xb8], 2
lea edi, [esp + 0x14]
jmp 0x4030c0
push 0xffffffffffffffff
push 0x4409b8
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push ebx
push esi
mov eax, dword [0x44eab0]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
lea esi, [esp + 0xc]
call fcn.00403880
mov ebx, eax
lea esi, [esp + 0x34]
mov dword [esp + 0x68], 0
call fcn.004038d0
push 0x44c248
mov eax, esi
push eax
call fcn.00412085
int3
Function at 0x402d20
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x44072b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x44eab0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00427846
push 4
mov dword [esp + 0x20], 0
call fcn.00407662
mov edi, eax
add esp, 4
test edi, edi
je 0x402da0
call fcn.00427631
mov dword [edi], eax
call fcn.00427465
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0042776d
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x402d95
add eax, 1
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.0042778e
jmp 0x402da2
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x406240
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x406259
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x406294
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x406290
lea ebx, [ebx]
cmp esi, eax
jae 0x406294
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x406280
cmp esi, eax
jb 0x40629a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x406bb0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x40
mov eax, dword [0x44eab0]
xor eax, esp
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x44]
push ebx
push edi
mov dword [esp + 0xc], eax
xor eax, eax
push 0x4468cc
push ecx
mov ebx, edx
mov byte [esp + 0x18], 0
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov word [esp + 0x25], ax
mov byte [esp + 0x27], al
call fcn.00411175
mov edi, eax
add esp, 8
test edi, edi
jne 0x406c0f
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.004102e2
add esp, 0x40
ret 4
push ebp
push esi
push 2
push 0
push edi
call fcn.0041120f
push edi
call fcn.0041142c
push 0
push 0
push edi
mov esi, eax
call fcn.0041120f
push esi
call fcn.00410d5a
push edi
push esi
mov ebp, eax
push 1
push ebp
call fcn.00411736
add esp, 0x30
push ebp
push ebx
mov eax, esi
call fcn.00406d80
lea ecx, [esp + 0x18]
mov esi, ebx
call fcn.00406e60
xor ebx, ebx
cmp ebp, ebx
je 0x406c65
push ebp
call fcn.00410a56
add esp, 4
push edi
call fcn.004117c3
add esp, 4
xor eax, eax
mov byte [esp + 0x28], bl
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
mov dword [esp + 0x35], eax
mov dword [esp + 0x39], eax
mov dword [esp + 0x3d], eax
mov dword [esp + 0x41], eax
mov dword [esp + 0x45], eax
mov byte [esp + 0x10], al
mov word [esp + 0x11], bx
lea ecx, [ecx]
movzx edx, byte [esp + ebx + 0x18]
push 0x10
lea ecx, [esp + 0x14]
push ecx
push edx
call fcn.0042cb80
add esp, 0xc
cmp byte [esp + 0x11], 0
jne 0x406cfe
lea edi, [esp + 0x28]
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x406cc3
mov ax, word [0x4468d0]
mov word [edi], ax
lea eax, [esp + 0x10]
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x406ce0
lea edi, [esp + 0x28]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x406cf2
jmp 0x406d20
lea eax, [esp + 0x10]
mov edx, eax
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x406d04
lea edi, [esp + 0x28]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x406d16
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
add ebx, 1
cmp ebx, 0x10
rep movsb byte es:[edi], byte [esi]
jl 0x406ca0
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x28]
mov ecx, eax
pop esi
sub edx, ecx
pop ebp
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x406d50
mov ecx, dword [esp + 0x44]
pop edi
pop ebx
xor ecx, esp
mov al, 1
call fcn.004102e2
add esp, 0x40
ret 4
Function at 0x406e60
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0xc
mov eax, dword [0x44eab0]
xor eax, esp
mov dword [esp + 8], eax
push ebp
push edi
mov edi, ecx
xor ecx, ecx
lea eax, [esi + 0x16]
jmp 0x406e80
movzx edx, byte [eax - 2]
mov byte [esp + ecx + 8], dl
movzx edx, byte [eax - 1]
mov byte [esp + ecx + 9], dl
movzx edx, byte [eax]
mov byte [esp + ecx + 0xa], dl
movzx edx, byte [eax + 1]
mov byte [esp + ecx + 0xb], dl
add ecx, 4
add eax, 4
cmp ecx, 8
jb 0x406e80
mov ecx, dword [esi + 0x14]
shr ecx, 3
and ecx, 0x3f
cmp ecx, 0x38
mov eax, 0x38
jb 0x406ec2
mov eax, 0x78
lea ebp, [esi + 0x5c]
push ebp
sub eax, ecx
push esi
call fcn.00406d80
lea eax, [esp + 8]
push eax
push esi
mov eax, 8
call fcn.00406d80
lea ecx, [edi + 1]
lea eax, [esi + 6]
mov edi, 4
lea esp, [esp]
movzx edx, byte [eax - 2]
mov byte [ecx - 1], dl
movzx edx, byte [eax - 1]
mov byte [ecx], dl
movzx edx, byte [eax]
mov byte [ecx + 1], dl
movzx edx, byte [eax + 1]
mov byte [ecx + 2], dl
add eax, 4
add ecx, 4
sub edi, 1
jne 0x406ef0
push 0x9c
push edi
push esi
call fcn.00413a00
push 0x40
push edi
push ebp
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], edi
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
call fcn.00413a00
mov ecx, dword [esp + 0x28]
add esp, 0x18
pop edi
mov byte [ebp], 0x80
pop ebp
xor ecx, esp
call fcn.004102e2
add esp, 0xc
ret

Function at 0x4102e2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44eab0]
jne 0x4102ec
repz ret
jmp fcn.00414ea8
Function at 0x41149a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x4114d7
cmp dword [ebp + 0x14], edi
je 0x4114d7
cmp ecx, edi
jne 0x4114de
call fcn.00410ba9
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.00410754
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x4114f2
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x411513
cmp ebx, 0xffffffff
je 0x411502
push ebx
push edi
push ecx
call fcn.00413a00
add esp, 0xc
cmp esi, edi
je 0x4114bf
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x4114bf
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x41152f
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x411536
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x411627
test word [esi + 0xc], 0x10c
je 0x41158a
mov eax, dword [esi + 4]
test eax, eax
je 0x41158a
jl 0x411688
cmp ebx, eax
mov edi, ebx
jb 0x41155b
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x41162f
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004101c7
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x41161f
cmp ebx, dword [ebp - 0xc]
jb 0x4115f7
cmp dword [ebp - 0xc], 0
je 0x4115b4
mov ecx, 0x7fffffff
xor edx, edx
cmp ebx, ecx
jbe 0x4115a9
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x4115b0
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x4115bf
mov eax, 0x7fffffff
cmp ebx, eax
ja 0x4115bf
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x41165b
push eax
push dword [ebp - 8]
push esi
call fcn.00419691
pop ecx
push eax
call fcn.0041a17a
add esp, 0xc
test eax, eax
je 0x41169a
cmp eax, 0xffffffff
je 0x411688
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x41161f
push esi
call fcn.00419a99
cmp eax, 0xffffffff
pop ecx
je 0x41168c
cmp dword [ebp - 4], 0
je 0x41165b
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x41153e
mov eax, dword [ebp + 0x14]
jmp 0x4114d9
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x411646
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.00413a00
add esp, 0xc
call fcn.00410ba9
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x4114cf
cmp dword [ebp + 0xc], 0xffffffff
je 0x411671
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00413a00
add esp, 0xc
call fcn.00410ba9
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x4114cf
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x4114d9
or dword [esi + 0xc], 0x10
jmp 0x41168c
Function at 0x41579c
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x44eb00]
je 0x4157b7
inc edi
cmp edi, 0x17
jb 0x4157a8
cmp edi, 0x17
jae 0x415937
push ebp
push 3
call fcn.0041e469
cmp eax, 1
pop ecx
je 0x415903
push 3
call fcn.0041e469
test eax, eax
pop ecx
jne 0x4157eb
cmp dword [0x44eaa8], 1
je 0x415903
cmp ebx, 0xfc
je 0x415936
push 0x443b90
mov ebx, 0x314
push ebx
mov ebp, 0x453318
push ebp
call fcn.00413fff
add esp, 0xc
test eax, eax
je 0x415821
push esi
push esi
push esi
push esi
push esi
call fcn.00410658
add esp, 0x14
push 0x104
mov esi, 0x453331
push esi
push 0
mov byte [0x453435], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x415865
push 0x443b78
push 0x2fb
push esi
call fcn.00413fff
add esp, 0xc
test eax, eax
je 0x415865
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00410658
add esp, 0x14
push esi
call fcn.00411b40
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4158aa
push esi
call fcn.00411b40
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x45362c
push 0x443b74
sub ecx, eax
push ecx
push eax
call fcn.0041420c
add esp, 0x14
test eax, eax
je 0x4158aa
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00410658
add esp, 0x14
jmp 0x4158ac
xor esi, esi
push 0x443b70
push ebx
push ebp
call fcn.004145db
add esp, 0xc
test eax, eax
je 0x4158cc
push esi
push esi
push esi
push esi
push esi
call fcn.00410658
add esp, 0x14
push dword [edi*8 + 0x44eb04]
push ebx
push ebp
call fcn.004145db
add esp, 0xc
test eax, eax
je 0x4158ee
push esi
push esi
push esi
push esi
push esi
call fcn.00410658
add esp, 0x14
push 0x12010
push 0x443b48
push ebp
call fcn.0041e2ac
add esp, 0xc
jmp 0x415936
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x415936
cmp ebp, 0xffffffff
je 0x415936
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x44eb04]
push dword [esi]
call fcn.00411b40
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret