joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fe69
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [0x432500], 0
push ebx
push esi
push edi
mov ebx, 0x400
jne 0x40feb4
push 0x64
lea eax, [ebp - 0x12c]
push eax
push 0xf
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ax, word [ebp - 0x12c]
mov word [0x464320], ax
xor eax, eax
mov word [0x464322], ax
mov dword [0x432500], 0x464320
push 0x32
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00406727
mov edi, dword [ebp + 0x10]
xor eax, eax
mov esi, dword [ebp + 0x14]
push esi
push edi
push 0x4324f0
mov word [edi], ax
lea eax, [ebp - 0x64]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
xor eax, eax
mov word [edi + esi*2 - 2], ax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40fff1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.004138f0
cmp byte [0x44fa70], 0
je 0x41009f
push 0x800
lea eax, [ebp - 0x200c]
push eax
push dword [ebp + 8]
call fcn.004114c0
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41009f
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x1000
push eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x200c]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x410096
mov eax, dword [ebp - 4]
mov ecx, 0x7ff
shr eax, 1
mov dword [ebp - 4], eax
cmp eax, ecx
jb 0x41007a
mov eax, ecx
push dword [ebp + 0xc]
xor ecx, ecx
mov word [ebp + eax*2 - 0x100c], cx
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + 8]
call fcn.00406858
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret 8
Function at 0x410156
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x2004
call fcn.004138f0
mov ecx, dword [esp + 0x2014]
push ebx
xor ebx, ebx
push esi
test ecx, ecx
je 0x410171
mov byte [ecx], bl
mov edx, dword [esp + 0x2020]
test edx, edx
je 0x41017e
mov byte [edx], bl
mov esi, dword [esp + 0x2010]
test esi, esi
je 0x410241
movzx eax, word [esi]
test ax, ax
je 0x410241
push ebp
mov ebp, dword [esp + 0x2018]
push edi
mov edi, dword [esp + 0x2020]
mov dword [esp + 0x10], ebx
movzx eax, ax
add esi, 2
cmp eax, 0x3d
jne 0x4101cb
test edi, edi
je 0x4101d5
test ebx, ebx
jne 0x4101d5
test ecx, ecx
je 0x4101c7
mov byte [ecx], 1
mov ebx, ebp
jmp 0x4101ec
cmp eax, 0xd
je 0x4101ff
cmp eax, 0xa
je 0x410202
mov word [ebp], ax
add ebp, 2
mov eax, dword [esp + 0x202c]
add eax, 0xfffffffe
cmp dword [esp + 0x10], eax
jge 0x4101fa
movzx eax, word [esi]
inc dword [esp + 0x10]
test ax, ax
jne 0x4101ad
jmp 0x410202
mov byte [edx], 1
jmp 0x410202
add esi, 2
xor eax, eax
mov word [ebp], ax
test edi, edi
je 0x41023b
mov word [edi], ax
test ebx, ebx
je 0x41023b
push 0x1000
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [esp + 0x202c]
lea eax, [esp + 0x18]
push eax
push edi
call fcn.00406858
xor eax, eax
mov word [ebx], ax
pop edi
mov eax, esi
pop ebp
jmp 0x410243
xor eax, eax
pop esi
pop ebx
add esp, 0x2004
ret 0x18

Function at 0x41024e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push eax
push dword [ebp + 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov ebx, eax
neg ebx
sbb bl, bl
add bl, 1
je 0x4102a9
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [ebp - 4]
dec eax
neg eax
sbb al, al
lea ebx, [eax + 1]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0x428220]
call esi
pop esi
jmp 0x4102b1
mov eax, dword [ebp + 8]
xor ecx, ecx
mov word [eax], cx
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4127d3
Capabilities:
Hide graphical window

Disassembly:
and dword [0x44da54], 0
push 1
push dword [esp + 8]
mov byte [0x44da49], 1
mov byte [0x44da4a], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 2
push dword [esp + 0xc]
call fcn.00401197
cmp dword [0x44da34], 0
jne 0x412813
cmp byte [0x44da63], 0
je 0x41281c
cmp dword [0x44da5c], 0
jne 0x41282f
push 0
push 1
push 0x111
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
ret 4

Function at 0x412902
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.004138f0
cmp byte [0x44fa70], 0
je 0x412991
cmp word [0x44fa72], 0
je 0x412991
push esi
push 0x800
lea eax, [ebp - 0x1008]
push eax
push 0x44fa72
call fcn.004114c0
lea eax, [ebp - 8]
xor esi, esi
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x412990
push dword [ebp + 8]
call fcn.00418bf3
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1008]
push 1
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x412997
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.004138f0
push esi
push dword [ebp + 8]
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x1000
lea eax, [ebp - 0x2000]
push eax
push dword [ebp + 8]
call fcn.0040659c
mov esi, eax
test esi, esi
je 0x4129ef
movzx ecx, word [esi]
push ecx
jmp 0x4129da
add esi, 2
movzx eax, word [esi]
push eax
call fcn.004066b5
test al, al
jne 0x4129d3
push esi
push str.sfxpar
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40fe90
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
cmp byte [esi], 0
jne 0x40fec3
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea esi, [ebp - 0x10c]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push esi
call fcn.0040fcf0
add esp, 0x14
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 8]
lea eax, [eax + edi*4]
push eax
call fcn.0040d1a0
pop ecx
mov ebx, eax
test ebx, ebx
je 0x40ff15
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebx + edi*4]
push eax
push ebx
push esi
call fcn.0040fcf0
add esp, 0x14
mov eax, dword [ebp - 4]
dec eax
mov dword [0x425374], eax
mov dword [0x425370], ebx
jmp 0x40ff1d
push 0xfffffffffffffffc
call fcn.0040e660
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40ff30
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov dword [ebp - 4], eax
test eax, eax
je 0x40ffbc
mov eax, dword [ebp - 4]
xor edx, edx
cmp byte [eax], 0
je 0x40ff69
or ecx, 0xffffffff
inc ecx
cmp byte [eax + ecx], 0
jne 0x40ff53
inc ecx
cmp byte [eax], 0x3d
je 0x40ff62
add edx, ecx
add eax, ecx
cmp byte [eax], 0
jne 0x40ff50
inc edx
push edx
call fcn.0040d1a0
pop ecx
mov dword [0x425224], eax
test eax, eax
je 0x40ffcf
mov edx, eax
mov eax, dword [ebp - 4]
mov esi, eax
cmp byte [esi], 0
je 0x40ffae
or eax, 0xffffffff
inc eax
cmp byte [esi + eax], 0
jne 0x40ff89
lea edi, [eax + 1]
cmp byte [esi], 0x3d
je 0x40ffa7
xor ecx, ecx
mov al, byte [esi + ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x40ff9a
add edx, edi
add esi, edi
cmp byte [esi], 0
jne 0x40ff86
mov byte [edx], 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x40ffd7
push 1
push 1
call fcn.00412600
add esp, 8
mov dword [0x425224], eax
jmp 0x40ffd7
push 0xfffffffffffffffc
call fcn.0040e660
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410cc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
push ebx
push esi
push edi
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov esi, edx
mov edx, dword [ebp + 0x10]
add edx, eax
mov dword [ebp - 0x808], edx
xor edi, edi
mov dword [ebp - 0x80c], 0
cmp esi, dword [ebp - 0x808]
jae 0x410d91
lea eax, [ebp - 0x804]
cmp byte [esi], 0xa
jne 0x410d0d
add dword [ebp - 0x80c], 1
mov byte [eax], 0xd
inc eax
inc eax
inc esi
mov dl, byte [esi - 1]
mov byte [eax - 1], dl
lea edx, [ebp - 5]
cmp eax, edx
jae 0x410d24
cmp esi, dword [ebp - 0x808]
jb 0x410cfd
lea edx, [ebp - 0x804]
mov ebx, eax
sub ebx, edx
push dword [ebp + 0xc]
call fcn.00411540
pop ecx
test al, al
je 0x410d66
push dword [ebp + 0xc]
call fcn.004114d0
pop ecx
push ebx
lea edx, [ebp - 0x804]
push edx
push eax
call fcn.00413560
add esp, 0xc
test al, al
je 0x410d95
add edi, ebx
inc esi
cmp esi, dword [ebp - 0x808]
jb 0x410cf7
jmp 0x410d91
push dword [ebp + 0xc]
call fcn.004114d0
pop ecx
push 0
lea edx, [ebp - 4]
push edx
push ebx
lea edx, [ebp - 0x804]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x410d9c
mov eax, dword [ebp - 4]
add edi, eax
cmp eax, ebx
jae 0x410d5b
xor esi, esi
jmp 0x410da4
mov esi, 0x1d
jmp 0x410da4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x80c]
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov dword [eax + 8], esi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410dd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
push ebx
push esi
push edi
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov esi, edx
mov edx, dword [ebp + 0x10]
add edx, eax
mov dword [ebp - 0x80c], edx
mov dword [ebp - 0x808], 0
xor edi, edi
cmp esi, dword [ebp - 0x80c]
jae 0x410e97
lea eax, [ebp - 0x804]
cmp word [esi], 0xa
jne 0x410e1e
add edi, 2
mov word [eax], 0xd
add eax, 2
add eax, 2
add esi, 2
mov dx, word [esi - 2]
mov word [eax - 2], dx
lea edx, [ebp - 6]
cmp eax, edx
jae 0x410e3b
cmp esi, dword [ebp - 0x80c]
jb 0x410e0d
lea edx, [ebp - 0x804]
mov ebx, eax
sub ebx, edx
push dword [ebp + 0xc]
call fcn.00411540
pop ecx
test al, al
je 0x410eb1
push dword [ebp + 0xc]
call fcn.004114d0
pop ecx
push 0
lea edx, [ebp - 4]
push edx
mov edx, ebx
shr edx, 1
push edx
lea edx, [ebp - 0x804]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
test eax, eax
je 0x410ea3
shl dword [ebp - 4], 1
mov eax, dword [ebp - 4]
add dword [ebp - 0x808], eax
cmp eax, ebx
jb 0x410e97
add esi, 2
cmp esi, dword [ebp - 0x80c]
jb 0x410e07
mov dword [ebp - 0x810], 0
jmp 0x410edf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x810], eax
jmp 0x410edf
push dword [ebp + 0xc]
call fcn.004114d0
pop ecx
push 0
lea edx, [ebp - 4]
push edx
push ebx
lea edx, [ebp - 0x804]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x410e7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x810], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x808]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov dword [eax + 4], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x810]
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410f10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc10
push ebx
push esi
push edi
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov ebx, edx
mov edx, dword [ebp + 0x10]
add edx, eax
mov dword [ebp - 0xc0c], edx
mov dword [ebp - 0xc08], 0
cmp ebx, dword [ebp - 0xc0c]
jae 0x410fc2
lea eax, [ebp - 0x404]
cmp word [ebx], 0xa
jne 0x410f59
mov word [eax], 0xd
add eax, 2
add eax, 2
add ebx, 2
mov dx, word [ebx - 2]
mov word [eax - 2], dx
lea edx, [ebp - 6]
cmp eax, edx
jae 0x410f76
cmp ebx, dword [ebp - 0xc0c]
jb 0x410f4b
push 0
push 0
push 0x800
lea edx, [ebp - 0xc04]
push edx
lea edx, [ebp - 0x404]
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x404]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x410fce
lea esi, [ebp + eax - 0xc04]
lea eax, [ebp - 0xc04]
cmp esi, eax
jbe 0x411027
lea edi, [ebp - 0xc04]
jmp 0x411000
mov dword [ebp - 0xc10], 0
jmp 0x410fda
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc10], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc08]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc10]
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
jmp 0x41106a
push dword [ebp + 0xc]
call fcn.004114d0
pop ecx
push 0
lea edx, [ebp - 4]
push edx
mov edx, esi
sub edx, edi
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x411046
add edi, dword [ebp - 4]
cmp edi, esi
jb 0x411000
mov eax, ebx
sub eax, dword [ebp + 0x10]
mov dword [ebp - 0xc08], eax
add ebx, 2
cmp ebx, dword [ebp - 0xc0c]
jb 0x410f45
jmp 0x410fc2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc08]
mov dword [edx], ecx
mov edx, dword [ebp + 8]
mov dword [edx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4118e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
add edx, eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0xc]
mov edi, eax
mov ebx, edi
cmp ebx, dword [ebp - 0xc]
jae 0x411a21
cmp byte [ebx], 0x1a
je 0x4119cc
cmp byte [ebx], 0xd
jne 0x41192f
lea eax, [ebx + 1]
cmp eax, dword [ebp - 0xc]
jae 0x41193c
cmp byte [ebx + 1], 0xa
jne 0x41192f
mov byte [edi], 0xa
inc edi
add ebx, 2
jmp 0x411a18
inc edi
inc ebx
mov al, byte [ebx - 1]
mov byte [edi - 1], al
jmp 0x411a18
inc ebx
push esi
call fcn.004114d0
pop ecx
push 0
lea edx, [ebp - 8]
push edx
push 1
lea edx, [ebp - 1]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x411a3d
cmp dword [ebp - 8], 0
je 0x411a3d
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x425430]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
test byte [eax + edx + 4], 0x48
je 0x4119bc
cmp byte [ebp - 1], 0xa
je 0x4119c7
mov byte [edi], 0xd
inc edi
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x425430]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
mov cl, byte [ebp - 1]
mov byte [eax + edx + 6], cl
jmp 0x411a18
inc edi
jmp 0x411a18
cmp byte [ebp - 1], 0xa
jne 0x411a28
cmp edi, dword [ebp + 0xc]
jne 0x411a28
mov byte [edi], 0xa
jmp 0x4119b9
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x425430]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
test byte [eax + edx + 4], 0x40
jne 0x411a10
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x425430]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
or byte [eax + edx + 4], 2
jmp 0x411a21
inc edi
mov al, byte [ebx]
mov byte [edi - 1], al
jmp 0x411a21
cmp ebx, dword [ebp - 0xc]
jb 0x411907
mov eax, edi
sub eax, dword [ebp + 0xc]
jmp 0x411a45
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push esi
call fcn.004117d0
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x411a18
mov byte [edi], 0xd
jmp 0x4119b9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411a50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
add edx, eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0xc]
mov edi, eax
mov ebx, edi
cmp ebx, dword [ebp - 0xc]
jae 0x411bd4
cmp word [ebx], 0x1a
je 0x411b7b
cmp word [ebx], 0xd
jne 0x411aa6
lea eax, [ebx + 2]
cmp eax, dword [ebp - 0xc]
jae 0x411ab9
cmp word [ebx + 2], 0xa
jne 0x411aa6
mov word [edi], 0xa
add edi, 2
add ebx, 4
jmp 0x411bcb
add edi, 2
add ebx, 2
mov ax, word [ebx - 2]
mov word [edi - 2], ax
jmp 0x411bcb
add ebx, 2
push esi
call fcn.004114d0
pop ecx
push 0
lea edx, [ebp - 8]
push edx
push 2
lea edx, [ebp - 2]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x411bf4
cmp dword [ebp - 8], 0
je 0x411bf4
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x425430]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
test byte [eax + edx + 4], 0x48
je 0x411b68
cmp word [ebp - 2], 0xa
je 0x411b74
mov word [edi], 0xd
add edi, 2
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x425430]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
mov cl, byte [ebp - 2]
mov byte [eax + edx + 6], cl
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x425430]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
movzx ecx, word [ebp - 2]
sar ecx, 8
mov byte [eax + edx + 7], cl
jmp 0x411bcb
add edi, 2
jmp 0x411bcb
cmp word [ebp - 2], 0xa
jne 0x411bdb
cmp edi, dword [ebp + 0xc]
jne 0x411bdb
mov word [edi], 0xa
jmp 0x411b63
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x425430]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
test byte [eax + edx + 4], 0x40
jne 0x411bbf
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x425430]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
or byte [eax + edx + 4], 2
jmp 0x411bd4
add edi, 2
mov ax, word [ebx]
mov word [edi - 2], ax
jmp 0x411bd4
cmp ebx, dword [ebp - 0xc]
jb 0x411a77
mov eax, edi
sub eax, dword [ebp + 0xc]
jmp 0x411bfe
push 1
push 0xffffffffffffffff
push 0xfffffffe
push esi
call fcn.004117d0
add esp, 0x10
cmp word [ebp - 2], 0xa
je 0x411bcb
mov word [edi], 0xd
jmp 0x411b63
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411cf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov eax, esi
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x425430]
mov edx, esi
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
test byte [eax + edx + 4], 0x48
jne 0x411d2d
mov dword [ebp - 8], 0
jmp 0x411d41
push ebx
push edi
push esi
call fcn.00411c90
add esp, 0xc
mov edx, eax
mov dword [ebp - 8], edx
add edi, eax
sub ebx, eax
push esi
call fcn.004114d0
pop ecx
push 0
lea edx, [ebp - 4]
push edx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x411d63
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x411d6b
mov edx, dword [ebp - 4]
add dword [ebp - 8], edx
xor eax, eax
mov edx, dword [ebp - 8]
xchg edx, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414600
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x42542c]
cmp dword [ebp + 8], eax
jae 0x4146f3
mov eax, dword [ebp + 8]
shr eax, 4
and eax, 0xffffffc
mov eax, dword [eax + 0x425430]
mov edx, dword [ebp + 8]
and edx, 0x3f
lea edx, [edx + edx*2]
shl edx, 2
test byte [eax + edx + 4], 1
je 0x4146f3
push 1
push 0
push 0
push dword [ebp + 8]
call fcn.004117d0
add esp, 0x10
mov esi, eax
mov edi, edx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
cmp edx, 0xffffffff
jne 0x414668
cmp eax, 0xffffffff
je 0x4146fd
push 2
push 0
push 0
push dword [ebp + 8]
call fcn.004117d0
add esp, 0x10
cmp edx, 0xffffffff
jne 0x414683
cmp eax, 0xffffffff
je 0x4146fd
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
sub esi, eax
sbb edi, edx
test edi, edi
jg 0x414705
jl 0x414697
test esi, esi
ja 0x414705
test edi, edi
jg 0x414793
jl 0x4146a9
test esi, esi
jae 0x414793
push 0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push edx
push eax
push dword [ebp + 8]
call fcn.004117d0
add esp, 0x10
cmp edx, 0xffffffff
jne 0x4146cc
cmp eax, 0xffffffff
je 0x41478e
push dword [ebp + 8]
call fcn.004114d0
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x414793
mov dword [0x425220], 0xd
jmp 0x41478e
mov dword [0x425220], 9
or eax, 0xffffffff
jmp 0x4147ac
push 0x1000
push 1
call fcn.00412600
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x41478e
push 0x8000
push dword [ebp + 8]
call fcn.00414850
add esp, 8
mov dword [ebp - 0xc], eax
test edi, edi
jl 0x414742
jg 0x41473b
cmp esi, 0x1000
jb 0x414742
mov eax, 0x1000
jmp 0x414744
mov eax, esi
push eax
push ebx
push dword [ebp + 8]
call fcn.004110e0
add esp, 0xc
cmp eax, 0xffffffff
je 0x414774
cdq
neg eax
adc edx, 0
neg edx
add eax, esi
adc edx, edi
mov esi, eax
mov edi, edx
test edx, edx
jg 0x41472d
jl 0x414770
test eax, eax
ja 0x41472d
xor esi, esi
jmp 0x414777
or esi, 0xffffffff
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.00414850
add esp, 8
push ebx
call fcn.0040e080
pop ecx
jmp 0x414795
or esi, 0xffffffff
jmp 0x414795
xor esi, esi
push 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
push edx
push eax
push dword [ebp + 8]
call fcn.004117d0
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100096d0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1000989d
pushal
mov esi, 0x3db8000
lea edi, [esi - 0x7000]
push edi
jmp 0x100096fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10009701
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100096f0
mov eax, 1
add ebx, ebx
jne 0x10009713
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10009708
jne 0x10009724
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10009708
xor ecx, ecx
sub eax, 3
jb 0x10009738
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x100097aa
mov ebp, eax
add ebx, ebx
jne 0x10009743
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x10009750
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x10009774
inc ecx
add ebx, ebx
jne 0x10009760
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10009755
jne 0x10009771
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10009755
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10009794
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10009785
jmp 0x100096f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10009794
add edi, ecx
jmp 0x100096f6
pop esi
mov edi, esi
mov ecx, 0x7b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x100097b2
cmp byte [edi], 4
jne 0x100097b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x100097b7
lea edi, [esi + 0x7000]
mov eax, dword [edi]
or eax, eax
je 0x1000982f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x91b8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x921c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x100097e4
mov ecx, edi
jns 0x10009813
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9220]
or eax, eax
je 0x10009829
mov dword [ebx], eax
add ebx, 4
jmp 0x10009801
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10009860
cmp al, 0xef
ja 0x10009853
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x10009835
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10009842
mov ebp, dword [esi + 0x9224]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10009894
sub esp, 0xffffff80
jmp 0x100032af