joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d000
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call fcn.0046caf0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x46d025
mov eax, 0xfffffff5
jmp 0x46d159
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x320]
and edx, 1
jne 0x46d03d
mov eax, 0xfffffff4
jmp 0x46d159
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x320]
shr ecx, 2
and ecx, 1
je 0x46d06b
mov edx, dword [ebp - 4]
push edx
call fcn.00469a80
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x46d06b
mov eax, dword [ebp - 8]
jmp 0x46d159
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + 4]
cmp ecx, 1
je 0x46d0da
push 0
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.MSVCR100.dll_fseek]
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call fcn.0046cd80
add esp, 4
mov edx, dword [ebp - 4]
movsx eax, byte [edx + 0x2ab]
test eax, eax
je 0x46d0da
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x2aa]
test edx, edx
jne 0x46d0da
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
push 1
mov edx, dword [ebp - 4]
movsx eax, word [edx + 0x316]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x2d0
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x2c4], 0
je 0x46d116
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x2c4]
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2c4], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 0x2cc], 0
je 0x46d142
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2cc]
push ecx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x2cc], 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x320]
and ecx, 0xfffffffe
mov edx, dword [ebp - 4]
mov dword [edx + 0x320], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x46ded0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x320]
and ecx, 0xfffffffd
mov edx, dword [ebp + 8]
mov dword [edx + 0x320], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [str.WKNC_Id:_fbseek.cpp_7003_2011_05_16_16:32:53Z_jsturton___WORKNC]
mov dword [eax + 0x210], ecx
mov edx, dword [ebp + 8]
mov dword [edx + 0x214], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x21c], 0xa0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x218], 0xa0
mov edx, dword [ebp + 8]
mov dword [edx + 0x220], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x224], 0
call fcn.0046c900
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x228
push ecx
call sub.MSVCR100.dll_strcpy
add esp, 8
mov edx, dword [ebp + 8]
mov byte [edx + 0x2a8], 1
mov eax, dword [ebp + 8]
mov byte [eax + 0x2a9], 1
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x2aa], 1
mov edx, dword [ebp + 8]
mov byte [edx + 0x2ac], 0
call fcn.0046c850
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x2ab], al
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
push eax
push 0xa0
push 1
mov ecx, dword [ebp + 8]
add ecx, 0x210
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, 0xa0
je 0x46dfbb
mov eax, 0xffffffe6
jmp 0x46dfbd
xor eax, eax
pop ebp
ret

Function at 0x4707c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x486d20]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004708f0
add esp, 8
cmp eax, 0xffffffff
je 0x4708bf
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCR100.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffff
je 0x47089e
push 0x101
lea eax, [ebp - 0x148]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.MSVCR100.dll__read]
add esp, 0xc
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jle 0x470874
lea edx, [ebp - 0x148]
push edx
call dword [sym.imp.MSVCR100.dll_atol]
add esp, 4
cmp dword [ebp + 0xc], eax
jne 0x470850
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
jmp 0x470872
cmp dword [0xb238b8], 0
je 0x470872
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x480970
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 0xc
jmp 0x47088f
cmp dword [0xb238b8], 0
je 0x47088f
mov eax, dword [ebp - 0x40]
push eax
push str._nread_error_:_nblu___d_n_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 8
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.MSVCR100.dll__close]
add esp, 4
jmp 0x4708bd
cmp dword [0xb238b8], 0
je 0x4708bd
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x3c]
push eax
push str._nopen_error_:_handle___d___nomfic___s_n_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 0xc
jmp 0x4708da
cmp dword [0xb238b8], 0
je 0x4708da
mov ecx, dword [ebp + 8]
push ecx
push str._nstat_error_:_nomfic___s_n_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00458368
mov esp, ebp
pop ebp
ret
Function at 0x470910
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x486d20]
xor eax, ebp
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 4], eax
push 0x180
push 0x502
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x470992
mov ecx, dword [ebp - 4]
push ecx
push 0x480a04
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call sub.MSVCR100.dll_strlen
add esp, 4
add eax, 1
push eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.MSVCR100.dll__write]
add esp, 0xc
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.MSVCR100.dll__close]
add esp, 4
jmp 0x470a28
call dword [sym.imp.MSVCR100.dll__errno]
cmp dword [eax], 0x11
jne 0x470a21
push 0x100
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x470a1f
push 0x14
push 0
lea edx, [ebp - 0x24]
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x13
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.MSVCR100.dll__read]
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x4709fc
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.MSVCR100.dll_atol]
add esp, 4
mov dword [ebp - 0xc], eax
jmp 0x470a03
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.MSVCR100.dll__close]
add esp, 4
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
je 0x470a1f
mov dword [ebp - 0x28], 0xffffffff
jmp 0x470a28
mov dword [ebp - 0x28], 0xfffffffe
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00458368
mov esp, ebp
pop ebp
ret
Function at 0x472860
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x486d20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x320]
and ecx, 0xfffffffd
mov edx, dword [ebp + 8]
mov dword [edx + 0x320], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [str.WKNC]
mov dword [eax + 0x210], ecx
mov edx, dword [ebp + 8]
mov dword [edx + 0x214], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x21c], 0xa0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x220], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x224], 0
call fcn.0046c900
push eax
mov eax, dword [ebp + 8]
add eax, 0x228
push eax
call sub.MSVCR100.dll_strcpy
add esp, 8
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x2a8], 1
mov edx, dword [ebp + 8]
mov byte [edx + 0x2a9], 1
mov eax, dword [ebp + 8]
mov byte [eax + 0x2aa], 0
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x2ac], 0
call fcn.0046c850
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x8c], eax
mov edx, dword [ebp + 8]
mov al, byte [ebp - 0x8c]
mov byte [edx + 0x2ab], al
movsx ecx, byte [ebp - 0x8c]
test ecx, ecx
je 0x472955
mov edx, dword [ebp + 8]
movsx eax, word [edx + 0x316]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x21c]
lea eax, [eax + edx + 1]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x21c], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x21c]
add eax, 0x80
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x218], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
push eax
push 0xa0
push 1
mov ecx, dword [ebp + 8]
add ecx, 0x210
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, 0xa0
je 0x47299b
mov eax, 0xffffffe6
jmp 0x472a19
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 0x2ab]
test eax, eax
je 0x4729eb
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
movsx ecx, word [eax + 0x316]
add ecx, 1
push ecx
push 1
mov edx, dword [ebp + 8]
add edx, 0x2d0
push edx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
mov ecx, dword [ebp + 8]
movsx edx, word [ecx + 0x316]
add edx, 1
cmp eax, edx
je 0x4729eb
mov eax, 0xffffffe6
jmp 0x472a19
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
push 0x80
push 1
lea edx, [ebp - 0x88]
push edx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, 0x80
je 0x472a17
mov eax, 0xffffffe6
jmp 0x472a19
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00458368
mov esp, ebp
pop ebp
ret
Function at 0x10002890
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x100028f1
mov eax, dword [ebp + 0x14]
shl dword [ebp + 0x10], 8
mov ecx, dword [ebp + 8]
push ebx
mov eax, dword [eax]
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x18]
push esi
mov cl, byte [ecx]
movsx edx, cl
sub cl, 0x61
cmp cl, 0x19
mov ecx, dword [ebp + 0x10]
lea esi, [edx - 0x20]
cmova esi, edx
mov edx, dword [ebp + 0xc]
add ecx, esi
add eax, ebx
xor eax, dword [edx + ecx*4]
mov ecx, ebx
shl ecx, 5
add ecx, 3
add ecx, esi
add ebx, ecx
mov ecx, dword [ebp + 8]
inc ecx
add ebx, eax
mov dword [ebp + 8], ecx
sub edi, 1
jne 0x100028b2
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
mov eax, dword [ebp + 0x18]
pop edi
pop ebp
ret 0x18
Function at 0x4045c0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
mov eax, str.Unknown_error
je 0x4045d0
mov eax, esi
push 0
push str.SQLAnywhere_Fatal_Error
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
test esi, esi
je 0x4045ed
push esi
call fcn.00408fe6
add esp, 4
push 1
call fcn.0040946c
pop esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x4068f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xd0
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
push edi
mov ebx, 0x4183e0
jmp 0x406910
mov ecx, 0xa
mov esi, str.SoftwareSybaseAdaptive_Server_Anywhere
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x18]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x406926
mov ax, word [0x413310]
mov word [edi], ax
mov eax, dword [esp + 0xe4]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406940
lea edi, [esp + 0x18]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x406950
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebx]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x24]
push edx
push eax
call ebp
test eax, eax
jne 0x4069ca
mov edx, dword [esp + 0xec]
lea ecx, [esp + 0xf0]
push ecx
mov ecx, dword [esp + 0xec]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4069ca
mov ecx, dword [esp + 0xf4]
cmp dword [esp + 0x14], ecx
je 0x4069e6
add ebx, 4
cmp ebx, 0x4183e8
jl 0x406910
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xd0
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xd0
ret

Function at 0x408afa
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x418d60]
xor eax, dword [ebp + 4]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
mov dword [ebp - 4], eax
je 0x408b75
push ebx
call fcn.00408ac3
test eax, eax
pop ecx
jne 0x408b47
call fcn.0040a451
mov dword [eax], 0xf
call fcn.0040a448
mov dword [eax], 0xd
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop ebx
call fcn.0040d859
leave
ret
and byte [ebp + 0xb], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0x104
lea eax, [ebp + 8]
add bl, 0x40
push eax
mov byte [ebp + 8], bl
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x2e
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x408b87
lea eax, [ebp - 0x10c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x408b37
inc eax
cmp eax, 0x104
ja 0x408b37
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x408bbf
cmp eax, dword [ebp + 0x10]
jg 0x408ba2
mov eax, dword [ebp + 0x10]
push eax
call fcn.004083a6
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x408bd4
call fcn.0040a448
mov dword [eax], 0xc
jmp 0x408b37
cmp eax, dword [ebp + 0x10]
jle 0x408bd4
call fcn.0040a448
mov dword [eax], 0x22
jmp 0x408b37
lea eax, [ebp - 0x10c]
push eax
push ecx
call fcn.0040d730
pop ecx
pop ecx
jmp 0x408b39
Function at 0x409399
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 8
call fcn.0040aec6
xor esi, esi
inc esi
cmp dword [0x419cbc], esi
pop ecx
jne 0x4093c1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x419cb8], esi
mov byte [0x419cb4], al
jne 0x409427
mov ecx, dword [0x41a48c]
test ecx, ecx
je 0x409408
mov eax, dword [0x41a488]
sub eax, 4
cmp eax, ecx
jmp 0x409401
mov eax, dword [eax]
test eax, eax
je 0x4093f3
call eax
mov eax, dword [0x41a488]
sub eax, 4
cmp eax, dword [0x41a48c]
mov dword [0x41a488], eax
jae 0x4093eb
mov eax, 0x417028
mov esi, 0x417030
cmp eax, esi
mov edi, eax
jae 0x409427
mov eax, dword [edi]
test eax, eax
je 0x409420
call eax
add edi, 4
cmp edi, esi
jb 0x409418
mov eax, 0x417034
mov esi, 0x417038
cmp eax, esi
mov edi, eax
jae 0x409446
mov eax, dword [edi]
test eax, eax
je 0x40943f
call eax
add edi, 4
cmp edi, esi
jb 0x409437
cmp dword [ebp + 0x10], 0
pop edi
pop esi
je 0x409457
push 8
call fcn.0040ae32
jmp 0x409469
push dword [ebp + 8]
mov dword [0x419cbc], 1
call fcn.004092f2
pop ecx
pop ebp
ret

Function at 0x40962c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40964c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040a45a
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x40966f
test byte [esp + 8], 2
je 0x40966f
call fcn.0040a448
mov dword [eax], 0xd
call fcn.0040a451
mov dword [eax], 5
jmp 0x409648
xor eax, eax
ret
Function at 0x409f80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x40a146
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x41a360]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x40a146
test cl, 0x48
je 0x409fe6
mov al, byte [eax + 5]
cmp al, 0xa
je 0x409fe6
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40a038
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x40a020
call fcn.0040a448
mov dword [eax], 9
call fcn.0040a451
mov dword [eax], esi
jmp 0x40a030
cmp eax, 0x6d
je 0x40a146
push eax
call fcn.0040a45a
pop ecx
or eax, 0xffffffff
jmp 0x40a148
mov eax, dword [edi]
mov edx, dword [ebp - 0xc]
add dword [ebp - 8], edx
lea ecx, [eax + esi + 4]
mov al, byte [ecx]
test al, al
jns 0x40a141
test edx, edx
je 0x40a05b
cmp byte [ebx], 0xa
jne 0x40a05b
or al, 4
jmp 0x40a05d
and al, 0xfb
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x40a13b
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x40a12b
cmp al, 0xd
je 0x40a091
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x40a11d
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x40a0ab
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x40a0a6
add dword [ebp + 0x10], 2
jmp 0x40a0ff
mov dword [ebp + 0x10], eax
jmp 0x40a119
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40a0d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40a119
cmp dword [ebp - 0xc], 0
je 0x40a119
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x40a0f4
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x40a0ff
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x40a11c
cmp ebx, dword [ebp + 0xc]
jne 0x40a104
cmp byte [ebp - 1], 0xa
jne 0x40a104
mov byte [ebx], 0xa
jmp 0x40a11c
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0040e606
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x40a11d
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x40a075
jmp 0x40a13b
mov eax, dword [edi]
lea esi, [eax + esi + 4]
mov al, byte [esi]
test al, 0x40
jne 0x40a13b
or al, 2
mov byte [esi], al
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x40a148
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a1f8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x418d60]
xor eax, dword [ebp + 4]
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
jne 0x40a221
xor eax, eax
jmp 0x40a38f
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x41a360]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x40a254
push 2
push edi
push edi
push dword [ebp + 8]
call fcn.00409790
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x40a326
cmp dword [ebp + 0x10], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edi
jbe 0x40a361
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x420]
mov dword [ebp - 0xc], edi
cmp ecx, dword [ebp + 0x10]
jae 0x40a2af
mov edx, dword [ebp - 0x10]
inc dword [ebp - 0x10]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x40a2a0
inc dword [ebp - 0x18]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0xc]
mov byte [eax], dl
inc eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x400
jl 0x40a283
mov edi, eax
lea eax, [ebp - 0x420]
sub edi, eax
push 0
lea eax, [ebp - 0x1c]
push eax
push edi
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40a2ef
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x14], eax
cmp eax, edi
jl 0x40a2f8
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp + 0xc]
xor edi, edi
cmp eax, dword [ebp + 0x10]
jb 0x40a274
jmp 0x40a2fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
xor edi, edi
mov eax, dword [ebp - 0x14]
cmp eax, edi
jne 0x40a38a
cmp dword [ebp - 8], edi
je 0x40a361
push 5
pop esi
cmp dword [ebp - 8], esi
jne 0x40a353
call fcn.0040a448
mov dword [eax], 9
call fcn.0040a451
mov dword [eax], esi
jmp 0x40a35c
push edi
lea ecx, [ebp - 0x1c]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40a348
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], eax
jmp 0x40a2fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x40a2fa
push dword [ebp - 8]
call fcn.0040a45a
pop ecx
or eax, 0xffffffff
jmp 0x40a38d
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x40a376
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
jne 0x40a376
xor eax, eax
jmp 0x40a38d
call fcn.0040a448
mov dword [eax], 0x1c
call fcn.0040a451
mov dword [eax], edi
jmp 0x40a35c
sub eax, dword [ebp - 0x18]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
call fcn.0040d859
leave
ret
Function at 0x40baf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x418d60]
xor eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x418b20]
je 0x40bb1d
inc eax
cmp eax, 0x12
jb 0x40bb0e
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x418b20]
jne 0x40bc51
mov eax, dword [0x419c70]
cmp eax, 1
je 0x40bc2c
cmp eax, edx
jne 0x40bb4d
cmp dword [0x418444], 1
je 0x40bc2c
cmp ecx, 0xfc
je 0x40bc51
push 0x104
lea eax, [ebp - 0x10c]
push eax
push edx
mov byte [ebp - 8], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40bb86
lea eax, [ebp - 0x10c]
push str._program_name_unknown_
push eax
call fcn.0040d730
pop ecx
pop ecx
lea eax, [ebp - 0x10c]
push eax
lea edi, [ebp - 0x10c]
call fcn.0040caf0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x40bbc8
lea eax, [ebp - 0x10c]
push eax
call fcn.0040caf0
mov edi, eax
lea eax, [ebp - 0x10c]
sub eax, 0x3b
push 3
add edi, eax
push 0x415778
push edi
call fcn.004094b0
add esp, 0x10
push edi
call fcn.0040caf0
push dword [esi + 0x418b24]
mov ebx, eax
call fcn.0040caf0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.0040c490
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.0040d730
push edi
push ebx
call fcn.0040d740
push 0x415758
push ebx
call fcn.0040d740
push dword [esi + 0x418b24]
push ebx
call fcn.0040d740
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.0040f4c8
add esp, 0x2c
jmp 0x40bc51
push edx
lea eax, [ebp + 8]
push eax
lea esi, [esi + 0x418b24]
push dword [esi]
call fcn.0040caf0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x118]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.0040d859
pop edi
pop esi
pop ebx
leave
ret