joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408b30
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x48]
mov esi, dword [esp + 0x40]
mov eax, dword [ebx]
mov edx, dword [ebx + 8]
test esi, esi
mov ebp, dword [ebx + 4]
mov ecx, dword [eax + 0x74]
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], ecx
je 0x408bb9
cmp byte [0x425a50], 0
jne 0x408b70
mov eax, dword [esp + 0x44]
cmp byte [eax], 0x25
je 0x408c74
cmp ebp, dword [esp + 0x20]
jge 0x408bb9
mov ecx, dword [esp + 0x44]
inc ecx
mov dword [esp + 0x1c], ecx
nop
mov edi, dword [esp + 0x44]
mov ebx, dword [esp + 0x1c]
movzx eax, byte [edi]
test al, al
je 0x408bb2
nop
cmp al, 0x25
mov edi, ebx
movsx edx, al
je 0x408bd0
mov edi, dword [esi + 4]
dec edi
test edi, edi
mov dword [esi + 4], edi
js 0x408bc1
mov ecx, dword [esi]
mov byte [ecx], dl
inc dword [esi]
movzx eax, byte [ebx]
inc ebx
test al, al
jne 0x408b90
inc ebp
cmp ebp, dword [esp + 0x20]
jl 0x408b80
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], esi
mov dword [esp], edx
call sub.msvcrt.dll__flsbuf
jmp 0x408baa
movsx edx, byte [ebx]
inc ebx
cmp edx, 0x4c
je 0x408c53
cmp edx, 0x4c
jg 0x408c15
cmp edx, 0x25
je 0x408b99
mov dword [esp + 0x10], 0
mov edx, dword [esp + 0x28]
lea ecx, [ebx - 2]
mov dword [esp + 0xc], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp], esi
call fcn.00408d10
test eax, eax
mov ebx, eax
jne 0x408baa
mov ebx, edi
mov edx, 0x25
jmp 0x408b99
cmp edx, 0x6c
jne 0x408be3
mov dword [esp + 0xc], 0
mov edx, dword [esp + 0x24]
mov dword [esp + 8], 0
mov eax, dword [edx + ebp*4 + 4]
cmp byte [eax - 1], 0xa
je 0x408c50
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx + ebp*4]
mov dword [esp], eax
call fcn.0040bdb0
jmp 0x408baa
dec eax
jmp 0x408c38
mov dword [esp + 0xc], 0
mov edi, dword [esp + 0x24]
mov dword [esp + 8], 0
mov edx, dword [edi + ebp*4 + 4]
mov dword [esp + 4], edx
mov eax, dword [edi + ebp*4]
jmp 0x408c43
mov edx, eax
movzx eax, byte [eax + 1]
cmp al, 0x6c
je 0x408cc4
cmp al, 0x4c
jne 0x408b70
mov eax, dword [esp + 0x44]
cmp byte [eax + 2], 0
jne 0x408b70
mov dword [esp + 0xc], esi
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov edi, dword [esi + ebx*4]
mov edx, dword [esi + ebp*4]
mov dword [esp + 4], 1
sub edi, edx
mov dword [esp + 8], edi
mov eax, dword [esi + ebp*4]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
jmp 0x408bb9
cmp byte [edx + 2], 0xa
jne 0x408c7e
cmp byte [edx + 3], 0
jne 0x408c7e
cmp ebp, dword [esp + 0x20]
jge 0x408c7e
mov dword [esp + 0xc], esi
mov esi, dword [esp + 0x20]
mov eax, dword [ecx + esi*4]
cmp byte [eax - 1], 0xa
je 0x408d02
mov edx, dword [ecx + ebp*4]
sub eax, edx
inc eax
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], 1
mov eax, dword [ecx + ebp*4]
jmp 0x408cb7
mov ebx, dword [esp + 0x24]
mov edi, dword [ebx + ebp*4]
sub eax, edi
jmp 0x408ced
Function at 0x40bdb0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ecx, dword [esp + 0x48]
cmp byte [0x425a50], 0
mov ebx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ecx
je 0x40bf52
xor ebp, ebp
mov ecx, dword [0x425750]
mov edi, edx
cmp edx, dword [esp + 0x28]
mov esi, dword [0x425a30]
mov dword [esp + 0x1c], ecx
jae 0x40be5b
lea esi, [esi]
movzx ebx, byte [edi]
inc edi
movzx eax, bl
cmp eax, 9
je 0x40bf07
cmp eax, 9
jg 0x40bea7
cmp eax, 8
je 0x40be83
mov ecx, dword [sym.imp.msvcrt.dll___mb_cur_max]
movzx edx, bl
cmp dword [ecx], 1
je 0x40be71
mov dword [esp + 4], 0x157
mov dword [esp], edx
call sub.msvcrt.dll__isctype
test eax, eax
je 0x40be41
inc ebp
movzx edx, bl
mov ebx, dword [esi + 4]
dec ebx
mov dword [esi + 4], ebx
test ebx, ebx
js 0x40be63
mov ecx, dword [esi]
mov byte [ecx], dl
inc dword [esi]
cmp edi, dword [esp + 0x28]
jb 0x40be00
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], esi
mov dword [esp], edx
call sub.msvcrt.dll__flsbuf
jmp 0x40be55
mov eax, dword [sym.imp.msvcrt.dll__pctype]
mov ecx, dword [eax]
movzx eax, word [ecx + edx*2]
and eax, 0x157
jmp 0x40be3c
test ebp, ebp
je 0x40be55
mov ebx, dword [esi + 4]
dec ebp
dec ebx
mov dword [esi + 4], ebx
test ebx, ebx
js 0x40be9a
mov edx, dword [esi]
mov byte [edx], 8
jmp 0x40be53
mov dword [esp + 4], esi
mov dword [esp], 8
jmp 0x40be6a
cmp eax, 0xd
jne 0x40be1e
mov ebp, dword [esi + 4]
dec ebp
test ebp, ebp
mov dword [esi + 4], ebp
js 0x40bef5
mov ebx, dword [esi]
mov byte [ebx], 0xd
inc dword [esi]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x40beee
cmp edi, dword [esp + 0x28]
jae 0x40beee
cmp byte [edi], 0xa
je 0x40beee
mov dword [esp], esi
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
call dword [sym.imp.libintl3.dll_libintl_fprintf]
xor ebp, ebp
jmp 0x40be55
mov dword [esp + 4], esi
mov dword [esp], 0xd
call sub.msvcrt.dll__flsbuf
jmp 0x40bec2
mov eax, ebp
xor edx, edx
mov ebx, dword [esp + 0x1c]
div dword [esp + 0x1c]
sub ebx, edx
add ebp, ebx
mov esi, esi
lea edi, [edi]
mov edx, dword [esi + 4]
dec edx
test edx, edx
mov dword [esi + 4], edx
js 0x40bf40
mov ecx, dword [esi]
mov byte [ecx], 0x20
inc dword [esi]
dec ebx
jne 0x40bf20
jmp 0x40be55
mov dword [esp + 4], esi
mov dword [esp], 0x20
call sub.msvcrt.dll__flsbuf
jmp 0x40bf32
sub dword [esp + 0x28], edx
mov esi, dword [0x425a30]
mov dword [esp + 0x44], 1
mov edx, dword [esp + 0x28]
mov dword [esp + 0x4c], esi
mov dword [esp + 0x48], edx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp sub.msvcrt.dll_fwrite
Function at 0x40d0a0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xc
mov ebx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov ebp, dword [esp + 0x20]
mov edi, ebx
add edi, eax
mov esi, esi
lea edi, [edi]
mov esi, edi
sub esi, ebx
jns 0x40d0cb
mov esi, 0x7fffffff
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], ebp
call sub.msvcrt.dll__read
test eax, eax
jle 0x40d0f5
add ebx, eax
cmp ebx, edi
jb 0x40d0c0
mov ecx, dword [esp + 0x24]
mov eax, ebx
sub eax, ecx
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
test eax, eax
je 0x40d0e5
call sub.msvcrt.dll__errno
cmp dword [eax], 0x16
je 0x40d114
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x40d0e1
mov eax, 0xffffffff
jmp 0x40d0ed
test esi, esi
jns 0x40d103
jmp 0x40d0e1
Function at 0x416230
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x1c
mov dword [esp + 0x18], ebx
mov ebx, 0x30a29
mov dword [esp], 0x416220
call sub.msvcrt.dll_getenv
test eax, eax
je 0x416251
cmp byte [eax], 0
jne 0x416260
mov eax, ebx
mov ebx, dword [esp + 0x18]
add esp, 0x1c
ret
mov dword [esp + 8], 0xa
lea ecx, [esp + 0x14]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_strtol
mov ecx, dword [esp + 0x14]
cmp byte [ecx], 0
jne 0x416251
mov ebx, eax
jmp 0x416251

Function at 0x416370
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
xor eax, eax
push edi
push esi
push ebx
sub esp, 0x1c
mov edx, dword [esp + 0x30]
mov ecx, dword [edx + 8]
mov dword [esp + 0x18], ecx
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x4163d9
mov ebp, dword [edx]
xor edi, edi
mov edx, dword [ebp + 4]
shr edx, 0x1d
and dl, 1
cmp edi, dword [esp + 0x18]
mov byte [esp + 0x17], dl
jae 0x4163d4
lea esi, [esi]
lea edi, [edi]
movzx eax, byte [esp + 0x17]
mov esi, dword [ebp + edi*8]
mov dword [esp + 0x10], esi
mov esi, dword [ebp + edi*8 + 4]
mov ebx, esi
shr ebx, 0x1d
and ebx, 1
cmp eax, ebx
je 0x4163e1
inc edi
cmp edi, dword [esp + 0x18]
jb 0x4163b0
movzx eax, byte [esp + 0x17]
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], 0x419830
test esi, 0x10000000
jne 0x4163f9
mov dword [esp + 0xc], 0x416780
mov dword [esp + 8], esi
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x34]
mov dword [esp], ecx
mov dword [esp + 4], edx
call dword [esp + 0xc]
test eax, eax
sete cl
test esi, 0x40000000
jne 0x416460
mov edx, dword [esp + 0x34]
movzx eax, byte [edx]
test al, al
je 0x416460
test cl, cl
jne 0x416450
lea esi, [esi]
cmp al, 0x2f
lea ebx, [edx + 1]
je 0x416470
movzx eax, byte [ebx]
mov edx, ebx
test al, al
je 0x416460
test cl, cl
je 0x416430
lea esi, [esi]
lea edi, [edi]
xor byte [esp + 0x17], 1
jmp 0x4163cd
test cl, cl
je 0x4163cd
jmp 0x416450
cmp byte [edx + 1], 0x2f
je 0x416490
mov dword [esp + 8], esi
mov ecx, dword [esp + 0x10]
mov dword [esp + 4], ebx
mov dword [esp], ecx
call dword [esp + 0xc]
test eax, eax
sete cl
jmp 0x416437
lea ebx, [edx + 1]
jmp 0x416437
Function at 0x419080
Capabilities:
Query environment variable

Disassembly:
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x10]
mov ebx, esi
nop
lea esi, [esi]
add ebx, 2
mov ecx, esi
movzx edx, word [ebx]
test dx, dx
je 0x4190d9
cmp dx, 0x5b
je 0x4190f6
cmp dx, 0x3f
je 0x4190e0
cmp dx, 0x2a
je 0x4190e0
cmp dx, 0x2b
je 0x4190e0
cmp dx, 0x40
je 0x4190e0
cmp dx, 0x21
je 0x4190e0
jmp 0x4190d0
cmp dx, 0x29
jne 0x419090
lea ecx, [ebx + 2]
pop edx
mov eax, ecx
pop ebx
pop esi
ret
cmp word [ebx + 2], 0x28
jne 0x4190d0
lea ecx, [ebx + 2]
mov dword [esp], ecx
call fcn.00419080
mov ebx, eax
jmp 0x419090
mov edx, dword [0x425390]
test edx, edx
je 0x419157
add ebx, 2
movzx eax, word [ebx]
cmp ax, 0x21
je 0x41914f
mov edx, dword [0x425390]
test edx, edx
js 0x419149
cmp ax, 0x5d
je 0x419138
lea esi, [esi]
add ebx, 2
mov ecx, esi
test ax, ax
je 0x4190d9
movzx eax, word [ebx]
cmp ax, 0x5d
jne 0x419120
jmp 0x419090
add ebx, 2
movzx eax, word [ebx]
cmp ax, 0x5d
jne 0x419120
jmp 0x419090
cmp ax, 0x5e
jne 0x419116
add ebx, 2
movzx eax, word [ebx]
jmp 0x419116
mov dword [esp], 0x417170
call sub.msvcrt.dll_getenv
test eax, eax
setne dl
movzx ecx, dl
lea edx, [ecx + ecx - 1]
mov dword [0x425390], edx
jmp 0x419100
Function at 0x41aff0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2cc
mov ebp, dword [esp + 0x2e0]
test ebp, ebp
mov esi, dword [ebp + 4]
je 0x41b1f5
mov edx, dword [ebp]
cmp edx, 0xffffffff
je 0x41b157
mov dword [esp], edx
lea ecx, [esp + 0x180]
mov dword [esp + 4], ecx
call sub.KERNEL32.dll_FindNextFileA
sub esp, 8
test eax, eax
je 0x41b14b
mov dword [esp + 8], 0x104
lea edi, [esp + 0x1ac]
mov ebx, dword [esi]
mov dword [esp + 4], ebx
lea ebx, [esi + 0x14]
mov dword [esp], ebx
call sub.msvcrt.dll_strncpy
mov dword [esp + 4], 0x41afe0
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.msvcrt.dll_strncat
mov dword [esp + 4], ebx
lea edx, [esp + 0x120]
mov dword [esp + 8], edx
mov dword [esp], 0
call fcn.0041cec0
test eax, eax
jne 0x41b139
mov ecx, dword [esp + 0x120]
and ecx, 0xf000
shr ecx, 0xc
mov byte [esi + 0x12], cl
mov ecx, edi
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
and edx, 0x80808080
je 0x41b0c0
test edx, 0x8080
jne 0x41b0e5
shr edx, 0x10
add ecx, 2
mov word [esi + 0x10], 0x110
add dl, dl
sbb ecx, 3
sub ecx, edi
mov byte [esi + 0x13], cl
mov edx, dword [esp + 0x128]
mov ecx, dword [esp + 0x12c]
mov dword [esi + 8], edx
mov dword [esi + 0xc], ecx
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.msvcrt.dll_strncpy
inc dword [ebp + 0x14]
call sub.msvcrt.dll__errno
mov dword [eax], 0
lea eax, [esi + 8]
add esp, 0x2cc
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0041cea0
mov esi, eax
call sub.msvcrt.dll__errno
mov dword [eax], esi
xor eax, eax
jmp 0x41b12e
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x12
jne 0x41b139
jmp 0x41b147
mov edx, dword [esi]
lea ebx, [esp + 0x10]
mov dword [esp], ebx
mov dword [esp + 4], edx
call sub.msvcrt.dll_strcpy
mov ecx, ebx
nop
lea esi, [esi]
mov edi, dword [ecx]
add ecx, 4
lea edx, [edi - 0x1010101]
not edi
and edx, edi
and edx, 0x80808080
je 0x41b170
test edx, 0x8080
jne 0x41b195
shr edx, 0x10
add ecx, 2
add dl, dl
sbb ecx, 3
sub ecx, ebx
movzx eax, byte [esp + ecx + 0xf]
cmp al, 0x2f
je 0x41b1b9
cmp al, 0x5c
je 0x41b1b9
mov dword [esp + 4], 0x41afe0
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x41afe2
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov dword [esp], ebx
lea edx, [esp + 0x180]
mov dword [esp + 4], edx
call sub.KERNEL32.dll_FindFirstFileA
mov dword [ebp], eax
sub esp, 8
inc eax
jne 0x41b036
mov dword [ebp], 0xffffffff
jmp 0x41b139
call sub.msvcrt.dll__errno
mov dword [eax], 9
jmp 0x41b147
Function at 0x41b5e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x1c
mov dword [esp + 0x18], edi
mov edi, dword [esp + 0x20]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], esi
test edi, edi
je 0x41b5fc
cmp byte [edi], 0
jne 0x41b620
call sub.msvcrt.dll__errno
mov dword [eax], 2
xor eax, eax
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
add esp, 0x1c
ret
mov dword [esp], edi
call sub.KERNEL32.dll_GetFileAttributesA
sub esp, 4
cmp eax, 0xffffffff
je 0x41b6a2
test al, 0x10
je 0x41b692
mov dword [esp], 0x18
call sub.msvcrt.dll_malloc
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x41b609
mov dword [esp], 0x118
call sub.msvcrt.dll_malloc
mov esi, eax
xor eax, eax
test esi, esi
je 0x41b609
mov dword [esp], edi
call fcn.0041d6f0
mov dword [esi], eax
mov eax, ebx
mov dword [ebx + 4], esi
mov dword [ebx], 0xffffffff
mov dword [ebx + 8], 0x118
mov dword [ebx + 0xc], 0x118
mov dword [ebx + 0x10], 8
mov dword [ebx + 0x14], 1
jmp 0x41b609
call sub.msvcrt.dll__errno
mov dword [eax], 0x14
jmp 0x41b607
call fcn.0041cea0
mov esi, eax
call sub.msvcrt.dll__errno
mov dword [eax], esi
jmp 0x41b607

Function at 0x41b7a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x17c
mov ebx, dword [esp + 0x194]
mov dword [esp], 0x41b774
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 4], 0x41b781
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov ebp, eax
mov edx, dword [esp + 0x190]
mov dword [esp], edx
call sub.KERNEL32.dll_GetFileAttributesA
sub esp, 4
mov dword [esp + 0x2c], eax
xor eax, eax
cmp dword [esp + 0x2c], 0xffffffff
je 0x41b83a
cld
mov ecx, 0x50
lea esi, [esp + 0x30]
mov edi, esi
test ebp, ebp
rep stosd dword es:[edi], eax
mov dword [esp + 0x1c], 0
je 0x41b82d
mov dword [esp + 8], ebx
mov eax, dword [esp + 0x190]
mov dword [esp + 4], 0
mov dword [esp], eax
call ebp
sub esp, 0xc
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x41b845
mov eax, 1
add esp, 0x17c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], esi
mov edi, dword [esp + 0x190]
mov dword [esp], edi
call sub.KERNEL32.dll_FindFirstFileA
sub esp, 8
mov ecx, dword [esp + 0x30]
inc eax
setne dl
mov dword [ebx], ecx
mov ebp, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
movzx esi, dl
mov dword [ebx + 4], ebp
mov dword [ebx + 8], edi
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x1c], esi
mov esi, dword [esp + 0x40]
mov dword [ebx + 0xc], edx
mov edx, dword [esp + 0x1c]
mov dword [ebx + 0x10], esi
mov ecx, dword [esp + 0x44]
mov ebp, dword [esp + 0x48]
test edx, edx
mov dword [ebx + 0x14], ecx
mov dword [ebx + 0x18], ebp
mov edi, dword [esp + 0x4c]
mov dword [ebx + 0x1c], edi
mov esi, dword [esp + 0x50]
mov dword [ebx + 0x20], esi
jne 0x41b835
cld
mov eax, dword [esp + 0x1c]
mov ecx, 9
mov edi, ebx
rep stosd dword es:[edi], eax
mov ebp, dword [esp + 0x2c]
mov dword [ebx], ebp
jmp 0x41b835
Function at 0x41d330
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
cmp eax, 0x83
ja case.0x41d342.62
jmp dword [eax*4 + 0x41d34c]
call sub.msvcrt.dll__errno
mov dword [eax], 0x16
mov esi, esi
lea edi, [edi]
mov eax, 0xffffffff
lea esi, [esi]
lea edi, [edi]
add esp, 0xc
ret
mov eax, 0x989680
jmp 0x41d580
call fcn.0041ed20
cmp eax, 6
mov edx, 6
jg 0x41d59e
mov eax, edx
jmp 0x41d580
call fcn.0041ed20
mov edx, eax
jmp 0x41d59a
mov eax, 0x800
jmp 0x41d580
mov eax, 1
jmp 0x41d580
mov eax, 0x400
jmp 0x41d580
add esp, 0xc
jmp 0x41ec10
add esp, 0xc
jmp 0x41ebc0
add esp, 0xc
jmp 0x41ec60
add esp, 0xc
jmp 0x41ecc0
mov eax, 0x200
jmp 0x41d580
mov eax, 8
jmp 0x41d580
mov eax, 0x7fffffff
jmp 0x41d580
mov eax, 0x80000000
jmp 0x41d580
mov eax, 0x20
jmp 0x41d580
mov eax, 2
jmp 0x41d580
xor eax, eax
jmp 0x41d580
mov eax, 0x7f
jmp 0x41d580
mov eax, 0xffffff80
jmp 0x41d580
mov eax, 0x7fff
jmp 0x41d580
mov eax, 0xffff8000
jmp 0x41d580
mov eax, 0xff
jmp 0x41d580
mov eax, 0xffff
jmp 0x41d580
call sub.msvcrt.dll__errno
mov dword [eax], 0x28
jmp case.0x41d342.53
sub esp, 0xc
mov dword [esp + 8], edi
mov edi, dword [0x425670]
test edi, edi
mov eax, edi
je 0x41ebe0
mov eax, dword [edi + 0x14]
mov edi, dword [esp + 8]
add esp, 0xc
ret
cld
mov edi, 0x425680
mov ecx, 9
mov dword [0x425670], edi
rep stosd dword es:[edi], eax
mov dword [esp], 0x425680
call sub.KERNEL32.dll_GetSystemInfo
mov edi, dword [0x425670]
sub esp, 4
jmp 0x41ebd3
sub esp, 0xc
mov dword [esp + 8], edi
mov edi, dword [0x425670]
test edi, edi
mov eax, edi
je 0x41ec30
mov eax, dword [edi + 0x14]
mov edi, dword [esp + 8]
add esp, 0xc
ret
cld
mov edi, 0x425680
mov ecx, 9
mov dword [0x425670], edi
rep stosd dword es:[edi], eax
mov dword [esp], 0x425680
call sub.KERNEL32.dll_GetSystemInfo
mov edi, dword [0x425670]
sub esp, 4
jmp 0x41ec23
sub esp, 0xc
mov dword [esp + 8], edi
mov edi, dword [0x425670]
test edi, edi
mov eax, edi
je 0x41ec88
mov eax, dword [edi + 0xc]
xor edx, edx
mov ecx, dword [edi + 8]
sub eax, ecx
div dword [edi + 4]
mov edi, dword [esp + 8]
add esp, 0xc
ret
cld
mov edi, 0x425680
mov ecx, 9
mov dword [0x425670], edi
rep stosd dword es:[edi], eax
mov dword [esp], 0x425680
call sub.KERNEL32.dll_GetSystemInfo
mov edi, dword [0x425670]
sub esp, 4
jmp 0x41ec73
sub esp, 0xc
mov dword [esp + 8], edi
mov edi, dword [0x425670]
test edi, edi
mov eax, edi
je 0x41ece8
mov edx, dword [edi + 8]
mov eax, dword [edi + 0xc]
sub eax, edx
xor edx, edx
div dword [edi + 4]
mov edi, dword [esp + 8]
add esp, 0xc
ret
cld
mov edi, 0x425680
mov ecx, 9
mov dword [0x425670], edi
rep stosd dword es:[edi], eax
mov dword [esp], 0x425680
call sub.KERNEL32.dll_GetSystemInfo
mov edi, dword [0x425670]
sub esp, 4
jmp 0x41ecd3
Function at 0x41dcd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x1c
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x18], ebp
xor ebp, ebp
test ebx, ebx
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
je 0x41dcf9
test esi, 0xffffffe8
je 0x41dd20
call sub.msvcrt.dll__errno
mov dword [eax], 0x16
mov eax, 0xffffffff
mov ebx, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
add esp, 0x1c
ret
mov dword [esp], 0x8001
call sub.KERNEL32.dll_SetErrorMode
sub esp, 4
mov dword [esp], ebx
call sub.KERNEL32.dll_GetFileAttributesA
sub esp, 4
mov edi, eax
cmp eax, 0xffffffff
je 0x41dd83
mov dword [esp], 0
call sub.KERNEL32.dll_SetErrorMode
sub esp, 4
mov eax, 0xffffffff
inc ebp
je 0x41dd09
test esi, 0x10
je 0x41dd68
test edi, 0x10
je 0x41dd76
and esi, 2
je 0x41dd72
and edi, 1
jne 0x41dd76
xor eax, eax
jmp 0x41dd09
call sub.msvcrt.dll__errno
mov dword [eax], 0xd
jmp 0x41dd04
call fcn.0041cea0
mov ebp, eax
call sub.msvcrt.dll__errno
mov dword [eax], ebp
mov ebp, 0xffffffff
jmp 0x41dd41
Function at 0x4011f0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, 0x3ec
mov eax, dword [esi]
push edi
mov dword [eax + 5], edi
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [eax + 9], ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov ebx, 0x449
test eax, eax
je 0x401260
push 4
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push 0
push 0x443
push edi
push dword [esi + 4]
call ebp
mov ecx, dword [esi]
call fcn.00401505
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
and dword [esp + 0x14], 0
push eax
push 2
push ebx
push edi
mov dword [esp + 0x28], 0x40144d
push dword [esi + 4]
call ebp
mov edi, 0x3ee
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x4012b8
mov ecx, dword [esi]
cmp byte [ecx + 4], 0
je 0x4012a1
call fcn.00401521
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
and dword [esp + 0x14], 0
push eax
push 2
push ebx
push edi
mov dword [esp + 0x28], 0x40144d
push dword [esi + 4]
call ebp
jmp 0x4012b8
push 0x3ea
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
pop eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x4012c3
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
mov edi, dword [eax + 0xd]
push edi
call fcn.004010b5
test al, al
pop ecx
jne 0x40130f
mov eax, dword [esi]
push 0x10
push dword [eax + 0xd]
push str.file_not_found._n_na__use_the_following_dialog_to_browse_to_the_file_OR_nb__cancel_the_following_dialog__copy_the_file_into_PatchFXs_directory_and_retry
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esi]
push dword [eax + 0xd]
push dword [esi + 4]
call fcn.00401026
pop ecx
pop ecx
mov ecx, dword [esi]
mov dword [ecx + 0xd], eax
mov eax, dword [esi]
cmp dword [eax + 0xd], 0
jne 0x40130f
mov dword [eax + 0xd], edi
xor eax, eax
jmp 0x401345
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push ebx
push 0x3eb
push dword [esi + 4]
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call ebx
push 0x3ea
push dword [esi + 4]
call edi
push 0
push eax
call ebx
mov ecx, dword [esi]
call fcn.004016aa
movzx eax, al
pop ebx
pop edi
pop esi
ret
Function at 0x401348
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
sub esp, 0x100
push ebx
push ebp
push esi
mov ebp, 0x3ea
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, ecx
push ebp
push dword [esi + 4]
call edi
lea ecx, [esp + 0x10]
push 0xff
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [esp + 0x10]
push 0x407144
push eax
call fcn.004021d0
pop ecx
mov ebx, 0x3ee
pop ecx
push ebx
push dword [esi + 4]
test eax, eax
jne 0x4013e9
call edi
test eax, eax
je 0x40143f
push ebx
push dword [esi + 4]
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 8
push eax
call ebx
push 0x3ef
push dword [esi + 4]
call edi
push 0
push eax
call ebx
push 0x3eb
push dword [esi + 4]
call edi
push 0
push eax
call ebx
push 0x3ec
push dword [esi + 4]
call edi
push 0
push eax
call ebx
push ebp
push dword [esi + 4]
call edi
push str.Back
jmp 0x401438
call edi
test eax, eax
je 0x40143f
push ebx
push dword [esi + 4]
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call ebx
push 0x3ef
push dword [esi + 4]
call edi
push 8
push eax
call ebx
push 0x3eb
push dword [esi + 4]
call edi
push 8
push eax
call ebx
push 0x3ec
push dword [esi + 4]
call edi
push 8
push eax
call ebx
push ebp
push dword [esi + 4]
call edi
push 0x407144
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 1
pop eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret

Function at 0x401478
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
xor edi, edi
push 1
push edi
push edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
call esi
push edi
push edi
push edi
mov dword [ebp - 8], eax
push dword [ebp + 8]
call esi
mov ebx, dword [ebp + 0xc]
cmp ebx, edi
jne 0x4014b3
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
call fcn.00401dbb
pop ecx
mov dword [ebp + 0xc], eax
lea ecx, [ebp - 0xc]
push edi
push ecx
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 1
pop eax
cmp ebx, eax
jb 0x4014e7
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + eax - 1]
imul ecx, eax
add dword [ebp - 4], ecx
inc eax
cmp eax, ebx
jbe 0x4014d4
push dword [ebp + 0xc]
call fcn.00401dc9
pop ecx
push edi
push edi
push dword [ebp - 8]
push dword [ebp + 8]
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret