joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402080
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x4020cb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x4020c4
test esi, esi
je 0x4020c4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4020a0
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4022b0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402300
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4023d4
mov eax, dword [esp + 0x28]
cmp eax, 0x40
je 0x40233e
cmp eax, 4
jne 0x402360
test esi, esi
je 0x402352
xor eax, eax
movzx ecx, byte [edi + eax]
mov byte [ebx + eax], cl
add eax, 1
cmp eax, esi
jb 0x402344
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
lea ebp, [esp + 0x10]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov ecx, dword [esp + 0x28]
test esi, esi
je 0x40239f
xor edx, edx
movzx eax, byte [edi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp edx, esi
jb 0x402391
cmp ecx, 0x40
je 0x402352
cmp ecx, 4
je 0x402352
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004022b0
lea esi, [esi]
Function at 0x10002840
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10008894
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x100122f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
push 0x1000a5f0
lea eax, [esi + 0x50]
push eax
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x1c], 0
call fcn.10001200
mov edi, dword [esp + 0x38]
push edi
push eax
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x3c], 0
call fcn.10001200
add esp, 0x18
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x34]
push edx
push ecx
push edi
mov ecx, eax
mov byte [esp + 0x34], 1
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
mov ecx, esi
call sym.RTMUI.dll_public:_void___thiscall_CLocalizationManager::CompareFileSystemHelper_char_const___char_const___char_const___unsigned_long_int__unsigned_long_int__
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov edx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x10]
push str._____d_file_s__total
push eax
mov dword [esp + 0x30], 2
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 0xc
push 0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.LocalizationDifferences.log
call dword [sym.imp.mfc90.dll_Ordinal_310]
push 1
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x48], esp
push edx
mov byte [esp + 0x3c], 3
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov ecx, esi
mov byte [esp + 0x38], 2
call sym.RTMUI.dll_public:_void___thiscall_CLocalizationManager::AppendLog_class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char_____int__class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char_____int__unsigned_long_int_
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 0xc
Function at 0x10003960
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x10008a9a
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100122f8]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x18], ebp
xor edi, edi
mov dword [esp + 0x14], edi
mov ebx, dword [esp + 0x34]
mov ecx, ebx
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x14], 1
call fcn.1000775a
mov esi, dword [eax + 0xc]
push 5
mov ecx, ebp
call fcn.10007a5a
mov eax, dword [eax + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x10003a2b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
cmp esi, edi
je 0x10003a2b
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
add eax, 0x1a
lea edx, [edi + 2]
movzx ecx, word [eax]
cmp cx, di
je 0x10003a08
mov ebp, 0xffff
cmp cx, bp
jne 0x10003a00
add eax, 4
jmp 0x10003a0b
add eax, 2
cmp word [eax], di
jne 0x10003a00
add eax, 2
sub edx, 1
jne 0x100039e6
push eax
push 0x1000ac20
push ebx
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ebp, dword [esp + 0x18]
mov ecx, ebp
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], edi
call fcn.10007a5a
mov ecx, dword [eax + 0xc]
push ecx
push str.PropertyPage
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x2c]
push eax
push ebx
call sym.RTMUI.dll_int___cdecl_LoadStringA_class_ATL::CStringT_char__class_StrTraitMFC_DLL_char__class_ATL::ChTraitsCRT_char______long_int___long_int___char_const___unsigned_int_
add esp, 0x14
mov eax, ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4

Function at 0x10003f80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ecx], vtable.CLocalizedPropertySheet.0
jmp 0x10007a8a
push eax
call fcn.10005ae4
pop ecx
push eax
push dword [ebp - 0x3a4]
invalid
invalid
push dword [ebp + 0x14]
call fcn.10005a99
stc
invalid
invalid
inc dword [ebx - 0x7a76f33c]
or al, 0x89
test dword [esp + edi*8 - 0x427c0001], eax
inc dword [ebx - 0x37b43]
inc dword [eax]
jne 0x10007ab7
jmp 0x10007476
cmp dword [ebp - 0x37c], 0
je 0x10007ac5
jmp 0x10007b7a
push 0
push 0
push 2
push 0
add byte [edx + 2], ch
push 0x40000000
push dword [ebp - 0x3a0]
invalid
invalid
invalid
xchg ebp, eax
cmp ah, bh

Function at 0x10005cd0
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections

Disassembly:
mov edi, dword [eax + 0x3c]
add edi, eax
movzx eax, word [edi + 0x14]
lea esi, [eax + edi + 0x18]
mov dword [ebp - 0x44], esi
call fcn.10005ad4
invalid

Function at 0x10007c87
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x10007c98
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.10005ad4
scasd eax, dword es:[edi]
invalid
Function at 0x401455
Capabilities:
Check for time delay via gettickcount
Delete directory
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
call sub.KERNEL32.DLL_GetTickCount
cmp al, 0xe9
je 0x401474
mov byte [ebp - 8], dl
call sub.KERNEL32.DLL_GetTickCount
add ebx, ecx
lea eax, [ebp - 0x20]
push eax
push 0x18
push 0x40d05c
call sub.gdi32.dll_GetObjectA
mov dword [0x40d060], edx
xor dword [0x40d060], eax
bswap ax
push 0x6c
call sub.USER32.dll_GetKeyState
and ebx, dword [0x40d024]
push str.Rseuejx_Xhgb._Mugeu
push 0x40d064
call sub.USER32.dll_LoadCursorA
push 0x40d068
call sub.ole32.dll_RevokeDragDrop
or ecx, edi
mov dword [section..data], 0x451ab0
xor dword [section..data], 0xffffffff
mov byte [ebp - 7], dl
push str.Enjfmg__Rev._Mk
call sub.msvcrt.dll_printf
pop ecx
sbb dword [ebp - 4], 0x64
mov byte [ebp - 7], ah
call sub.ole32.dll_OleFlushClipboard
mov ch, byte [ebp - 8]
mov ax, word [0x40d006]
call sub.KERNEL32.DLL_GetACP
push 0x40d06c
call sub.gdi32.dll_CreateCompatibleDC
push 0
lea eax, [ebp - 4]
push eax
call sub.ole32.dll_CreateBindCtx
sbb edx, 0x20f7e4
mov edi, dword [0x40d018]
call sub.msvcrt.dll_rand
mov dword [ebp - 0x24], 0xffffffff
push 0xffffffffffffffff
push 0x40d070
call sub.gdi32.dll_GetDeviceCaps
mov dword [0x40d018], 0xac
or esi, dword [ebp - 0x24]
adc esi, dword [ebp - 0x24]
mov cx, word [0x40d022]
call sub.KERNEL32.DLL_GetOEMCP
mov dword [0x40d060], 0xffffffff
nop
push str.Hysmroi_Ubafdge_Xwn
call sub.KERNEL32.DLL_RemoveDirectoryW
adc dword [0x40d074], 1
mov ch, byte [ebp - 8]
and edx, dword [0x40d078]
call sub.KERNEL32.DLL_GetACP
mov word [0x40d07c], ax
push 0x40d00c
call sub.USER32.dll_GetCursorPos
mov word [0x40d07c], 0x150
cmp ecx, eax
je 0x40159a
adc edi, edi
push 0
push 0x40d080
call sub.gdi32.dll_SetTextColor
mov word [ebp - 0x28], 0
push 0x40d084
call sub.ole32.dll_RevokeDragDrop
mov dword [ebp - 4], 0x2470a8
mov dword [0x40d088], edi
not edi
mov byte [ebp - 8], ch
mov word [0x40d004], di
push str.Bapswxgjmu_Bosglxa
call sub.msvcrt.dll_strlen
pop ecx
lea eax, [ebp - 0x20]
push eax
push 0x18
push 0x40d08c
call sub.gdi32.dll_GetObjectA
mov dword [0x40d078], eax
push 0x284
push 0x40d090
call sub.gdi32.dll_SetTextColor
and byte [0x40d014], 0xff
mov dword [ebp - 0x2c], 0
or dword [ebp - 0x24], 0x164
push 0x40d094
call sub.gdi32.dll_DeleteObject
mov word [ebp - 0x30], ax
call fcn.00401340
adc dx, word [0x40d022]
push 0
push 0
push 0x11
push 0
push 0x401005
push 0
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_CreateTimerQueueTimer
push 0xffffffffffffffff
call sub.KERNEL32.DLL_Sleep
cmp dword [ebp - 0x24], ecx
jno 0x401654
not di
lea eax, [ebp - 0x38]
push eax
call sub.KERNEL32.DLL_QueryPerformanceCounter
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401c70
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [0x444040]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx + 4]
xor dl, dl
mov byte [esp + 3], dl
test eax, eax
je 0x401cb0
push eax
push 1
lea eax, [esp + 0xb]
push 1
push eax
call fcn.0041e4e9
mov al, byte [esp + 0x13]
add esp, 0x10
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00414ac0
add esp, 8
ret
mov ecx, dword [esp + 4]
mov al, dl
xor ecx, esp
call fcn.00414ac0
add esp, 8
ret

Function at 0x401cd0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [0x444040]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx + 4]
xor edx, edx
mov dword [esp], edx
test eax, eax
je 0x401d10
push eax
push 2
lea eax, [esp + 8]
push 1
push eax
call fcn.0041e4e9
mov ax, word [esp + 0x10]
add esp, 0x10
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00414ac0
add esp, 8
ret
mov ecx, dword [esp + 4]
mov ax, dx
xor ecx, esp
call fcn.00414ac0
add esp, 8
ret

Function at 0x406e90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
mov eax, dword [0x444040]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, ecx
mov byte [esp + 4], 0
push edi
xor edi, edi
cmp byte [esi + 0x28], 0
jne 0x406f3d
cmp dword [esi + 0x30], 0x100
jl 0x406ed5
inc dword [esi + 0x2c]
call fcn.00406b30
mov ecx, esi
call fcn.00406d50
test al, al
je 0x406f39
mov eax, dword [esi + 4]
test eax, eax
je 0x406f05
push eax
push 1
lea eax, [esp + 0x10]
push 1
push eax
call fcn.0041e4e9
add esp, 0x10
cmp eax, 1
jne 0x406f39
inc dword [esi + 0x30]
cmp byte [esp + 8], 0x1a
jne 0x406f19
mov byte [esi + 0x28], al
mov edi, 0x1a
mov ax, di
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00414ac0
mov esp, ebp
pop ebp
ret
push dword [esp + 8]
call fcn.00402320
movzx edi, ax
mov ax, di
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00414ac0
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x28], 1
mov ecx, dword [esp + 0xc]
mov eax, 0x1a
pop edi
pop esi
xor ecx, esp
call fcn.00414ac0
mov esp, ebp
pop ebp
ret

Function at 0x4078d0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [0x444040]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx + 4]
mov byte [esp], 0
test eax, eax
je 0x407912
push eax
push 1
lea eax, [esp + 8]
push 1
push eax
call fcn.0041e4e9
add esp, 0x10
push dword [esp]
call fcn.00402320
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00414ac0
add esp, 8
ret
mov ecx, dword [esp + 4]
xor eax, eax
xor ecx, esp
call fcn.00414ac0
add esp, 8
ret
Function at 0x40b330
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x434893
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x444040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x14], edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea edx, [edi + 0x40]
mov dword [edx], 0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x20]
mov byte [ebp - 4], 2
mov dword [edi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x58], esi
mov dword [edi + 0x60], ecx
mov byte [edi + 0x64], 0
mov dword [edi + 0x68], eax
test byte [esi + 8], 8
je 0x40b41b
test cl, 0x10
jne 0x40b41b
mov al, 1
jmp 0x40b41d
xor al, al
mov byte [edi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x70], eax
mov ebx, dword [edx + 4]
mov ecx, ebx
mov esi, dword [esi + 0x18]
sar ecx, 3
cmp esi, ecx
jae 0x40b441
lea ecx, [esi*8]
mov dword [edx + 4], ecx
jmp 0x40b476
jbe 0x40b476
mov eax, dword [edx + 8]
sar eax, 3
cmp esi, eax
jbe 0x40b45b
push ecx
push esi
mov ecx, edx
lfence
call fcn.0040c6e0
jmp 0x40b476
sub esi, ecx
je 0x40b473
shl esi, 3
push esi
push 0
push ebx
call fcn.004167a0
add esp, 0xc
lea edx, [edi + 0x40]
add ebx, esi
mov dword [edx + 4], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x40b7a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
xor ecx, ecx
push esi
push edi
mov edi, dword [esp + 0xc]
mov edx, 0x811c9dc5
lea esi, [eax + eax]
test esi, esi
je 0x40b7c9
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x40b7b8
pop edi
mov eax, edx
pop esi
ret
Function at 0x412a70
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x444040]
xor eax, esp
mov dword [esp + 8], eax
mov edx, ecx
xor eax, eax
mov word [esp], ax
mov dword [esp + 4], eax
mov ecx, dword [edx + 4]
test ecx, ecx
je case.default.0x412aa2
mov eax, dword [edx + 0x28]
dec eax
cmp eax, 4
ja case.default.0x412aa2
jmp dword [eax*4 + 0x412ba0]
push ecx
push 1
lea eax, [esp + 8]
push 1
push eax
call fcn.0041e4e9
mov ax, word [esp + 0x10]
add esp, 0x10
cmp al, 0x80
movzx eax, al
jb 0x412b8e
movzx eax, word [eax*2 + 0x43e4f0]
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00414ac0
add esp, 0xc
ret
push ecx
push 1
lea eax, [esp + 8]
push 1
push eax
call fcn.0041e4e9
add esp, 0x10
lea eax, [esp + 4]
push 1
push eax
push 1
lea eax, [esp + 0xc]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ax, word [esp + 4]
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00414ac0
add esp, 0xc
ret
push ecx
push 1
lea eax, [esp + 8]
push 1
push eax
call fcn.0041e4e9
add esp, 0x10
lea eax, [esp + 4]
push 1
push eax
push 1
lea eax, [esp + 0xc]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ax, word [esp + 4]
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00414ac0
add esp, 0xc
ret
mov ecx, edx
call fcn.00413550
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00414ac0
add esp, 0xc
ret
push ecx
call fcn.00420293
add esp, 4
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00414ac0
add esp, 0xc
ret
xor eax, eax
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00414ac0
add esp, 0xc
ret

Function at 0x412aa9
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x444040]
xor eax, esp
mov dword [esp + 8], eax
mov edx, ecx
xor eax, eax
mov word [esp], ax
mov dword [esp + 4], eax
mov ecx, dword [edx + 4]
test ecx, ecx
je case.default.0x412aa2
mov eax, dword [edx + 0x28]
dec eax
cmp eax, 4
ja case.default.0x412aa2
jmp dword [eax*4 + 0x412ba0]
push ecx
push 1
lea eax, [esp + 8]
push 1
push eax
call fcn.0041e4e9
mov ax, word [esp + 0x10]
add esp, 0x10
cmp al, 0x80
movzx eax, al
jb 0x412b8e
movzx eax, word [eax*2 + 0x43e4f0]
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00414ac0
add esp, 0xc
ret
push ecx
push 1
lea eax, [esp + 8]
push 1
push eax
call fcn.0041e4e9
add esp, 0x10
lea eax, [esp + 4]
push 1
push eax
push 1
lea eax, [esp + 0xc]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ax, word [esp + 4]
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00414ac0
add esp, 0xc
ret
push ecx
push 1
lea eax, [esp + 8]
push 1
push eax
call fcn.0041e4e9
add esp, 0x10
lea eax, [esp + 4]
push 1
push eax
push 1
lea eax, [esp + 0xc]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ax, word [esp + 4]
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00414ac0
add esp, 0xc
ret
mov ecx, edx
call fcn.00413550
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00414ac0
add esp, 0xc
ret
push ecx
call fcn.00420293
add esp, 4
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00414ac0
add esp, 0xc
ret
xor eax, eax
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00414ac0
add esp, 0xc
ret
Function at 0x412ae2
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x444040]
xor eax, esp
mov dword [esp + 8], eax
mov edx, ecx
xor eax, eax
mov word [esp], ax
mov dword [esp + 4], eax
mov ecx, dword [edx + 4]
test ecx, ecx
je case.default.0x412aa2
mov eax, dword [edx + 0x28]
dec eax
cmp eax, 4
ja case.default.0x412aa2
jmp dword [eax*4 + 0x412ba0]
push ecx
push 1
lea eax, [esp + 8]
push 1
push eax
call fcn.0041e4e9
mov ax, word [esp + 0x10]
add esp, 0x10
cmp al, 0x80
movzx eax, al
jb 0x412b8e
movzx eax, word [eax*2 + 0x43e4f0]
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00414ac0
add esp, 0xc
ret
push ecx
push 1
lea eax, [esp + 8]
push 1
push eax
call fcn.0041e4e9
add esp, 0x10
lea eax, [esp + 4]
push 1
push eax
push 1
lea eax, [esp + 0xc]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ax, word [esp + 4]
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00414ac0
add esp, 0xc
ret
push ecx
push 1
lea eax, [esp + 8]
push 1
push eax
call fcn.0041e4e9
add esp, 0x10
lea eax, [esp + 4]
push 1
push eax
push 1
lea eax, [esp + 0xc]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ax, word [esp + 4]
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00414ac0
add esp, 0xc
ret
mov ecx, edx
call fcn.00413550
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00414ac0
add esp, 0xc
ret
push ecx
call fcn.00420293
add esp, 4
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00414ac0
add esp, 0xc
ret
xor eax, eax
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00414ac0
add esp, 0xc
ret

Function at 0x412b20
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x444040]
xor eax, esp
mov dword [esp + 8], eax
mov edx, ecx
xor eax, eax
mov word [esp], ax
mov dword [esp + 4], eax
mov ecx, dword [edx + 4]
test ecx, ecx
je case.default.0x412aa2
mov eax, dword [edx + 0x28]
dec eax
cmp eax, 4
ja case.default.0x412aa2
jmp dword [eax*4 + 0x412ba0]
push ecx
push 1
lea eax, [esp + 8]
push 1
push eax
call fcn.0041e4e9
mov ax, word [esp + 0x10]
add esp, 0x10
cmp al, 0x80
movzx eax, al
jb 0x412b8e
movzx eax, word [eax*2 + 0x43e4f0]
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00414ac0
add esp, 0xc
ret
push ecx
push 1
lea eax, [esp + 8]
push 1
push eax
call fcn.0041e4e9
add esp, 0x10
lea eax, [esp + 4]
push 1
push eax
push 1
lea eax, [esp + 0xc]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ax, word [esp + 4]
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00414ac0
add esp, 0xc
ret
push ecx
push 1
lea eax, [esp + 8]
push 1
push eax
call fcn.0041e4e9
add esp, 0x10
lea eax, [esp + 4]
push 1
push eax
push 1
lea eax, [esp + 0xc]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ax, word [esp + 4]
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00414ac0
add esp, 0xc
ret
mov ecx, edx
call fcn.00413550
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00414ac0
add esp, 0xc
ret
push ecx
call fcn.00420293
add esp, 4
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00414ac0
add esp, 0xc
ret
xor eax, eax
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00414ac0
add esp, 0xc
ret
Function at 0x412cc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x434eed
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x444040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov edi, 1
mov word [ebp - 0x14], ax
mov byte [ebp - 0x12], al
mov eax, dword [esi]
call dword [eax + 0x14]
push 2
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 0x43e958
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x2c], xmm0
call fcn.00405790
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
lea eax, [esi + 8]
push eax
call fcn.004023e0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
mov dword [esi + 4], eax
cmp ecx, 7
jbe 0x412d7b
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x412d71
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412e15
push ecx
push edx
call fcn.00414ace
add esp, 8
xor eax, eax
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
mov eax, dword [esi + 4]
mov dword [ebp - 0x18], 7
test eax, eax
je 0x412df8
push eax
push 3
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.0041e4e9
mov al, byte [ebp - 0x14]
add esp, 0x10
cmp al, 0xff
jne 0x412dbb
cmp byte [ebp - 0x13], 0xfe
jne 0x412dd2
mov edi, 5
jmp 0x412df1
cmp al, 0xef
jne 0x412dd2
cmp byte [ebp - 0x13], 0xbb
jne 0x412dd2
cmp byte [ebp - 0x12], 0xbf
jne 0x412dd2
mov edi, 4
jmp 0x412df1
push 0
push 0
push dword [esi + 4]
call fcn.0041f261
add esp, 8
mov dword [esi + 0x2c], 0
mov ecx, esi
call fcn.00412ef0
mov edi, eax
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x14]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00414ac0
mov esp, ebp
pop ebp
ret
call fcn.0041e16a
int3

Function at 0x412e80
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [0x444040]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, ecx
mov byte [esp + 7], 0
push dword [esi + 4]
call fcn.0041f29b
add esp, 4
test eax, eax
jne 0x412ed1
push dword [esi + 4]
lea eax, [esp + 0xb]
push 1
push 1
push eax
call fcn.0041e4e9
add esp, 0x10
add dword [esi + 0x2c], eax
movzx eax, byte [esp + 7]
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00414ac0
add esp, 8
ret
mov ecx, dword [esp + 8]
or eax, 0xffffffff
pop esi
xor ecx, esp
call fcn.00414ac0
add esp, 8
ret