joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426435
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x43e3ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0041e639
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0041e639
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x4264ac
cmp word [ecx], dx
je 0x4264ac
mov eax, dword [0x433a2c]
push edi
dec eax
push eax
push 0x433918
call fcn.004263d4
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x42651f
cmp word [eax], dx
je 0x42651f
mov eax, dword [edi]
test eax, eax
je 0x4264d0
cmp word [eax], dx
je 0x4264d0
lea eax, [ebp - 0x10]
push eax
call fcn.00425da2
jmp 0x4264d9
lea eax, [ebp - 0x10]
push eax
call fcn.00425e3d
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x426549
mov eax, dword [0x433914]
push dword [ebp - 0x14]
dec eax
push eax
push 0x433608
call fcn.004263d4
add esp, 0xc
test al, al
je 0x426549
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x426514
cmp word [eax], di
je 0x426514
lea eax, [ebp - 0x10]
push eax
call fcn.00425da2
pop ecx
jmp 0x42654b
lea eax, [ebp - 0x10]
push eax
call fcn.00425e3d
jmp 0x426511
mov eax, dword [edi]
test eax, eax
je 0x426536
cmp word [eax], dx
je 0x426536
lea eax, [ebp - 0x10]
push eax
call fcn.00425d57
pop ecx
jmp 0x426549
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x426614
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00426259
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x426614
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x426614
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x426614
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4265a1
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.0042230a
test ebx, ebx
je 0x42660f
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.0042230a
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x426614
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x426614
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.00422f41
add esp, 0x10
xor eax, eax
inc eax
jmp 0x426616
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004078da
leave
ret
Function at 0x40b590
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
mov eax, dword [0x441064]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
lea eax, [ebp - 0x2a4]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push eax
push 0
mov ecx, 0x23
mov eax, 0x1c
cmovne eax, ecx
mov ebx, edx
push 0
or eax, 0x8000
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x40b675
push 0x27
lea eax, [ebp - 0x9c]
push eax
lea eax, [esi + 0x8c]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
js 0x40b675
mov ecx, dword [esi + 0xa0]
mov edx, dword [esi + 0x9c]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
movzx eax, dx
push eax
shr edx, 0x10
lea eax, [ebp - 0x4c]
push edx
push str._d._d._d._d
push 0x24
push eax
call fcn.0040b230
add esp, 0x1c
test eax, eax
js 0x40b675
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x2a4]
push eax
push str._lsApplicationsCache_lsv_ls.msi
push edi
call fcn.0040df30
add esp, 0x14
test eax, eax
js 0x40b675
push 1
push 1
push dword [edi]
push ebx
call fcn.0040e5a0
test eax, eax
jns 0x40b675
cmp dword [ebp + 8], 1
jne 0x40b675
push edi
push 0
mov edx, ebx
mov ecx, esi
call fcn.0040b590
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00410b68
mov esp, ebp
pop ebp
ret

Function at 0x40b690
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
mov eax, dword [0x441064]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
lea eax, [ebp - 0x2a4]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push eax
push 0
mov ecx, 0x23
mov eax, 0x1c
cmovne eax, ecx
mov ebx, edx
push 0
or eax, 0x8000
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x40b775
push 0x27
lea eax, [ebp - 0x9c]
push eax
lea eax, [esi + 0x8c]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
js 0x40b775
mov ecx, dword [esi + 0xa0]
mov edx, dword [esi + 0x9c]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
movzx eax, dx
push eax
shr edx, 0x10
lea eax, [ebp - 0x4c]
push edx
push str._d._d._d._d
push 0x24
push eax
call fcn.0040b230
add esp, 0x1c
test eax, eax
js 0x40b775
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x2a4]
push eax
push str._lsApplicationsCache_lsv_ls.mst
push edi
call fcn.0040df30
add esp, 0x14
test eax, eax
js 0x40b775
push 1
push 1
push dword [edi]
push ebx
call fcn.0040e5a0
test eax, eax
jns 0x40b775
cmp dword [ebp + 8], 1
jne 0x40b775
push edi
push 0
mov edx, ebx
mov ecx, esi
call fcn.0040b690
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00410b68
mov esp, ebp
pop ebp
ret
Function at 0x40e420
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x441064]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x220], eax
mov esi, 0x80004005
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x21c], eax
or edi, 0xffffffff
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x40e4af
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40e498
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x40e4af
push esi
push 0x4be
push str.c:_buildagentwork_f0a36ae8bd009770_third_partydutil_fileutil.cpp
call fcn.0040ebe0
jmp 0x40e57c
push ebx
xor ebx, ebx
cmp edi, 0xffffffff
jne 0x40e544
push dword [ebp - 0x214]
lea eax, [ebp - 0x20c]
push ebx
push dword [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push str._s_s_05d._s
push eax
call fcn.0040df30
mov esi, eax
add esp, 0x18
test esi, esi
js 0x40e57b
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40e537
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40e527
movzx esi, si
or esi, 0x80070000
cmp esi, 0x80070050
jne 0x40e533
xor esi, esi
jmp 0x40e537
test esi, esi
js 0x40e57b
inc ebx
cmp ebx, 0x3e8
jl 0x40e4b2
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x40e553
mov dword [eax], edi
or edi, 0xffffffff
mov ecx, dword [ebp - 0x220]
test ecx, ecx
je 0x40e56f
mov eax, dword [ebp - 0x210]
mov dword [ecx], eax
mov dword [ebp - 0x210], 0
cmp edi, 0xffffffff
je 0x40e57b
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x40e58c
push eax
call fcn.0040e120
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00410b68
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40e5a0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
test edi, edi
setne al
mov ecx, eax
or ecx, 2
cmp dword [ebp + 0x14], esi
cmove ecx, eax
push ecx
push ebx
push dword [ebp + 8]
mov dword [ebp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x40e6a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test edi, edi
jne 0x40e5fd
cmp esi, 0x50
je 0x40e5ef
cmp esi, 0xb7
jne 0x40e5fd
mov esi, 1
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x10
cmp esi, 3
jne 0x40e69b
movzx eax, word [ebx]
xor edi, edi
mov ecx, ebx
test ax, ax
je 0x40e68d
mov edx, eax
cmp dx, 0x5c
mov eax, ecx
cmovne eax, edi
add ecx, 2
mov edi, eax
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x40e614
test edi, edi
je 0x40e68d
xor eax, eax
push eax
push ebx
mov word [edi], ax
call fcn.0040ead0
mov esi, eax
mov eax, 0x5c
mov word [edi], ax
test esi, esi
js 0x40e6a8
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x40e6a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40e672
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x40e6a8
push esi
push 0x42e
push str.c:_buildagentwork_f0a36ae8bd009770_third_partydutil_fileutil.cpp
call fcn.0040ebe0
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x10
mov esi, 0x80070003
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x10
test esi, esi
jle 0x40e6a8
movzx esi, si
or esi, 0x80070000
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x40e990
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x441064]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push edi
mov edi, dword [ebp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40ea87
cmp eax, 0x104
jae 0x40ea87
lea eax, [ebp - 0x414]
push eax
push 0
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x40ea12
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40ea00
movzx esi, si
or esi, 0x80070000
test esi, esi
mov eax, 0x80004005
cmovns esi, eax
push esi
push 0x53
jmp 0x40eaa9
mov ecx, dword [ebp + 0x10]
xor eax, eax
test ecx, ecx
je 0x40ea23
cmp ecx, 0x7fffffff
jbe 0x40ea28
mov eax, 0x80070057
test eax, eax
js 0x40eab5
test ecx, ecx
je 0x40ea5e
mov edx, 0x7ffffffe
lea edi, [ebp - 0x414]
sub edx, ecx
sub edi, esi
lea eax, [edx + ecx]
test eax, eax
je 0x40ea5e
movzx eax, word [edi + esi]
test ax, ax
je 0x40ea5e
mov word [esi], ax
add esi, 2
sub ecx, 1
jne 0x40ea43
test ecx, ecx
lea eax, [esi - 2]
pop edi
cmovne eax, esi
xor edx, edx
test ecx, ecx
pop esi
mov word [eax], dx
mov eax, 0x8007007a
cmovne eax, edx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00410b68
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40ea9c
movzx esi, si
or esi, 0x80070000
test esi, esi
mov eax, 0x80004005
cmovns esi, eax
push esi
push 0x4e
push str.c:_buildagentwork_f0a36ae8bd009770_third_partydutildirutil.cpp
call fcn.0040ebe0
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00410b68
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40ead0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40ebcb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40eb03
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
cmp eax, 3
je 0x40eb18
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40eb18
test al, 0x10
jne 0x40eaf9
movzx eax, word [edi]
mov ecx, edi
push ebx
xor ebx, ebx
test ax, ax
je 0x40ebb5
mov edx, eax
nop dword [eax + eax]
cmp dx, 0x5c
mov eax, ecx
cmovne eax, ebx
add ecx, 2
mov ebx, eax
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x40eb30
test ebx, ebx
je 0x40ebb5
push dword [ebp + 0xc]
xor eax, eax
push edi
mov word [ebx], ax
call fcn.0040ead0
mov esi, eax
mov eax, 0x5c
mov word [ebx], ax
test esi, esi
js 0x40ebca
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40ebaa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
jne 0x40eb94
pop ebx
mov esi, 1
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
test esi, esi
jle 0x40ebca
movzx esi, si
pop ebx
or esi, 0x80070000
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
pop ebx
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
mov esi, 0x80070003
push esi
push 0x82
push str.c:_buildagentwork_f0a36ae8bd009770_third_partydutildirutil.cpp
call fcn.0040ebe0
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x40f330
Capabilities:
Get session information
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x441064]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x828]
push eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x828], 0
push dword [ebp + 8]
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x40f3a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetStringInfoFromSessionInformation__:_WTSQuerySessionInformation___err___d_n
lea ecx, [ebp - 0x824]
push 0x410
push ecx
call fcn.00409270
add esp, 0x10
lea ecx, [ebp - 0x824]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00410b68
mov esp, ebp
pop ebp
ret
push dword [esi]
lea ecx, [ebp - 0x824]
push dword [ebp + 0xc]
push str.GetStringInfoFromSessionInformation__:_WTSQuerySessionInformation__d____s_n
push 0x410
push ecx
call fcn.00409270
add esp, 0x14
lea ecx, [ebp - 0x824]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.00410b68
mov esp, ebp
pop ebp
ret
Function at 0x40f3f0
Capabilities:
Get user security identifier
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc44
mov eax, dword [0x441064]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
push 0x410
mov dword [ebp - 0xc40], eax
lea eax, [ebp - 0x414]
push ebx
push eax
mov dword [ebp - 0xc3c], ebx
mov dword [ebp - 0xc38], ebx
call fcn.00412cd0
push esi
push edi
push str._s_s
lea eax, [ebp - 0x414]
push 0x208
push eax
call fcn.00409270
lea eax, [ebp - 0x414]
push eax
push str.Resolve__:_szAccountName___s_n
lea eax, [ebp - 0xc34]
push 0x410
push eax
call fcn.00409270
add esp, 0x30
lea eax, [ebp - 0xc44]
push eax
lea eax, [ebp - 0xc38]
push eax
push ebx
lea eax, [ebp - 0xc3c]
push eax
push ebx
lea eax, [ebp - 0x414]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov eax, dword [ebp - 0xc3c]
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x40f4b2
push eax
push 8
call esi
push eax
call edi
mov ebx, eax
mov ecx, dword [ebp - 0xc38]
test ecx, ecx
je 0x40f4ca
add ecx, ecx
push ecx
push 8
call esi
push eax
call edi
mov edi, eax
jmp 0x40f4cc
xor edi, edi
test ebx, ebx
je 0x40f55a
lea eax, [ebp - 0xc44]
push eax
lea eax, [ebp - 0xc38]
push eax
push edi
lea eax, [ebp - 0xc3c]
push eax
push ebx
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x40f51c
push dword [ebp - 0xc40]
push ebx
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
jne 0x40f54a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetSidFromEnumSess__:_ConvertSidToStringSid___err___d_n
jmp 0x40f528
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.UserByExplorer__:_LookupAccountNameW___err___d_n
lea eax, [ebp - 0xc34]
push 0x410
push eax
call fcn.00409270
add esp, 0x10
lea eax, [ebp - 0xc34]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call eax
push ebx
push 0
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call ebx
jmp 0x40f560
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x40f56c
push edi
push 0
call esi
push eax
call ebx
mov ebx, dword [ebp - 0xc40]
lea eax, [ebp - 0xc34]
push dword [ebx]
push str.Resolve__:_lpszSid___s_n
push 0x410
push eax
call fcn.00409270
add esp, 0x10
lea eax, [ebp - 0xc34]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebx], eax
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.00410b68
mov esp, ebp
pop ebp
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..pdata
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x4b897e5f
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..pdata_1
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x53f139a6
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4082e8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x40830f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004090d8
jmp 0x4083c4
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x408331
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x408333
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x4083b8
jg 0x408348
test esi, esi
je 0x4083b8
test ecx, ecx
jl 0x408391
jg 0x408352
test eax, eax
je 0x408391
cmp edi, ecx
jg 0x408366
jl 0x40835c
cmp esi, eax
jae 0x408366
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.004e5ba0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x408394
mov edx, dword [ebp + 8]
test edi, edi
jl 0x4083b8
jg 0x40839e
test esi, esi
je 0x4083b8
cmp dword [ebx + 0x4c], 0
je 0x4083b8
push dword [ebx + 0x4c]
push esi
push 1
push edx
call fcn.004edce7
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4083cd
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x4083f4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00409009
jmp 0x4084c3
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x408416
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x408418
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x4084b7
jg 0x408435
test esi, esi
je 0x4084b7
test ecx, ecx
jl 0x408482
jg 0x40843f
test eax, eax
je 0x408482
cmp ebx, ecx
jg 0x408453
jl 0x408449
cmp esi, eax
jae 0x408453
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.004e5ba0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x408489
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x4084b7
jg 0x408493
test esi, esi
je 0x4084b7
cmp dword [edi + 0x4c], 0
je 0x4084b7
mov ecx, edi
call fcn.0040896f
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.004edf0b
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x408725
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x6f03ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x40874b
xor eax, eax
jmp 0x408810
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x408774
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x408774
dec dword [edx]
mov eax, ebx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x408810
cmp dword [esi + 0x4c], 0
je 0x40880e
mov ecx, esi
call fcn.0040896f
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4087a1
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.004ee30d
cmp eax, edi
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x40880e
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x40880e
cmp eax, 1
jle 0x4087dd
cmp eax, 3
jne 0x40880e
push dword [esi + 0x4c]
movsx ecx, byte [ebp - 0x25]
push ecx
jmp 0x408793
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x408800
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call fcn.004edce7
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x40880e
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x408810
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cdca5
leave
ret 4

Function at 0x408992
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6f03ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x408a14
cmp byte [esi + 0x3d], 0
je 0x408a14
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4089e6
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x4089ea
sub eax, 1
je 0x4089ee
dec eax
sub eax, 1
je 0x408a14
xor al, al
jmp 0x408a16
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x408a0b
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004edce7
add esp, 0x10
cmp edi, eax
jne 0x4089e6
cmp byte [esi + 0x3d], 0
sete al
jmp 0x408a16
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004cdca5
leave
ret