joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4010c0
Capabilities:
Accept command line arguments
Link many functions at runtime

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.d3d10.dll
mov esi, eax
call edi
mov dword [0xa54170], eax
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov eax, dword [0xa54170]
test eax, eax
je 0x401215
push str.D3D10CreateStateBlock
push eax
call esi
mov ecx, dword [0xa54170]
push str.D3D10CreateDevice
push ecx
mov dword [0xa5417c], eax
call esi
mov edx, dword [0xa54170]
push str.D3D10StateBlockMaskUnion
push edx
mov dword [0xa54150], eax
call esi
mov dword [0xa54178], eax
mov eax, dword [0xa54170]
push str.D3D10StateBlockMaskIntersect
push eax
call esi
mov ecx, dword [0xa54170]
push str.D3D10StateBlockMaskDifference
push ecx
mov dword [0xa5415c], eax
call esi
mov edx, dword [0xa54170]
push str.D3D10StateBlockMaskEnableCapture
push edx
mov dword [0xa5418c], eax
call esi
mov dword [0xa54174], eax
mov eax, dword [0xa54170]
push str.D3D10StateBlockMaskDisableCapture
push eax
call esi
test ebx, ebx
mov dword [0xa54158], eax
je 0x401192
mov ecx, dword [0x653f44]
push 0x653c78
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edx, dword [0xa54170]
push str.D3D10StateBlockMaskEnableAll
push edx
call esi
mov dword [0xa5414c], eax
mov eax, dword [0xa54170]
push str.D3D10StateBlockMaskDisableAll
push eax
call esi
mov ecx, dword [0xa54170]
push str.D3D10StateBlockMaskGetSetting
push ecx
mov dword [0xa54188], eax
call esi
mov edx, dword [0xa54170]
push str.D3D10CompileEffectFromMemory
push edx
mov dword [0xa54154], eax
call esi
mov dword [0xa54148], eax
mov eax, dword [0xa54170]
push str.D3D10CreateEffectFromMemory
push eax
call esi
mov ecx, dword [0xa54170]
push str.D3D10CreateEffectPoolFromMemory
push ecx
mov dword [0xa54144], eax
call esi
mov edx, dword [0xa54170]
push str.D3D10CreateDeviceAndSwapChain
push edx
mov dword [0xa54180], eax
call esi
mov dword [0x65406c], eax
push str.d3dx10.dll
call edi
test eax, eax
mov dword [0x854138], eax
je 0x401244
push str.D3DXMatrixPerspectiveFovLH
push eax
call esi
mov dword [0x654074], eax
mov eax, dword [0x854138]
push str.D3DXMatrixLookAtLH
push eax
call esi
mov dword [0x654070], eax
push str.dxgi.dll
call edi
test eax, eax
mov dword [0xa54140], eax
je 0x401261
push str.CreateDXGIFactory
push eax
call esi
mov dword [0x854134], eax
push str.d3d10_1.dll
call edi
test eax, eax
mov dword [0xa5413c], eax
je 0x401296
push str.D3D10CreateDevice1
push eax
call esi
mov ecx, dword [0xa5413c]
push str.D3D10CreateDeviceAndSwapChain1
push ecx
mov dword [0x854130], eax
call esi
mov dword [0x654078], eax
mov eax, dword [0xa5413c]
mov ecx, dword [0xa54170]
pop edi
pop esi
pop ebx
test ecx, ecx
je 0x4012bf
mov ecx, dword [0x854138]
test ecx, ecx
je 0x4012bf
mov ecx, dword [0xa54140]
test ecx, ecx
je 0x4012bf
test eax, eax
je 0x4012bf
mov al, 1
pop ecx
ret
xor al, al
pop ecx
ret
Function at 0x64f4c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6506a0
push 0x64f4b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
cld
add bh, bh
adc eax, sym.imp.MSVCRT.dll___set_app_type
pop ecx
or dword [0xa541c4], 0xffffffff
or dword [0xa541c8], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0xa541c0]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0xa541bc]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0xa541cc], eax
call fcn.0064f63f
cmp dword [0x653460], ebx
jne 0x64f543
push 0x64f63c
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.0064f62a
push 0x65300c
push 0x653008
call sub.MSVCRT.dll__initterm
mov eax, dword [0xa541b8]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
push dword [0xa541b4]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x653004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x64f5d6
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x64f5aa
cmp al, 0x22
jne 0x64f59c
cmp byte [esi], 0x22
jne 0x64f5b3
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x64f5bd
cmp al, 0x20
jbe 0x64f5af
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x64f5e1
movzx eax, word [ebp - 0x2c]
jmp 0x64f5e4
cmp byte [esi], 0x20
jbe 0x64f5b3
inc esi
mov dword [ebp - 0x74], esi
jmp 0x64f5d6
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x78], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x401000
Capabilities:
Copy file
Get common file path

Disassembly:
sub esp, 0x500
lea eax, [esp + 0x100]
push esi
push edi
push 0x100
push eax
mov edi, 0x406054
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x108]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x108]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 8]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Uninstal.exe
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 8]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x406040
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0xc]
push eax
call fcn.004012e0
add esp, 8
test eax, eax
jne 0x4010d0
mov eax, 1
pop edi
pop esi
add esp, 0x500
ret 0x10
push eax
call fcn.00401240
lea eax, [esp + 0x20c]
mov ecx, dword [esp + 0x510]
add esp, 4
push 0x100
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x208]
push 0x5c
push ecx
call fcn.00401210
add esp, 8
test eax, eax
je 0x40110d
mov byte [eax], 0
lea edi, [esp + 0x108]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x308]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Uninstal.dll
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x308]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x208]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x408]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Uninstal.dll
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x408]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x30c]
lea ecx, [esp + 0xc]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
push ecx
call esi
lea ecx, [esp + 8]
push 0
lea eax, [esp + 0x40c]
push ecx
push eax
call esi
xor eax, eax
pop edi
pop esi
add esp, 0x500
ret 0x10
Function at 0x401300
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push section..rdata
push 0x402834
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x406080], eax
xor eax, eax
mov al, byte [0x406081]
mov dword [0x40608c], eax
mov eax, dword [0x406080]
shr dword [0x406080], 0x10
and eax, 0xff
mov dword [0x406088], eax
shl eax, 8
add eax, dword [0x40608c]
mov dword [0x406084], eax
call fcn.004027f0
test eax, eax
jne 0x401374
push 0x1c
call fcn.004014a0
add esp, 4
mov dword [ebp - 4], 0
call fcn.00402610
call fcn.00402600
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4084b0], eax
call fcn.004021b0
mov dword [0x406060], eax
test eax, eax
je 0x4013a7
cmp dword [0x4084b0], 0
jne 0x4013b1
push 0xffffffffffffffff
call fcn.00401a50
add esp, 4
call fcn.00401f30
call fcn.00401e40
call fcn.00401a20
mov esi, dword [0x4084b0]
mov al, byte [esi]
cmp al, 0x22
je 0x4013d8
cmp al, 0x20
jbe 0x401405
inc esi
cmp byte [esi], 0x20
ja 0x4013d0
jmp 0x401405
inc esi
cmp byte [esi], 0x22
je 0x401404
mov bl, byte [ebp - 0x28]
mov bl, byte [esi]
test bl, bl
je 0x4013ff
xor eax, eax
mov al, bl
push eax
call fcn.00401de0
add esp, 4
test eax, eax
je 0x4013f9
inc esi
inc esi
cmp byte [esi], 0x22
jne 0x4013e1
cmp byte [esi], 0x22
jne 0x401405
inc esi
cmp byte [esi], 0
je 0x401415
cmp byte [esi], 0x20
ja 0x401415
inc esi
cmp byte [esi], 0
jne 0x40140a
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x44], 1
mov eax, 0xa
je 0x401439
mov eax, dword [ebp - 0x40]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.00401a50
jmp 0x40147a
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401a90
Capabilities:
Terminate process

Disassembly:
cmp dword [0x4060bc], 1
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
jne 0x401aae
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x4060b8], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x4060b4], bl
jne 0x401b08
cmp dword [0x4084a8], 0
je 0x401af6
mov edi, dword [0x4084a4]
sub edi, 4
cmp edi, dword [0x4084a8]
jb 0x401af6
mov eax, dword [edi]
test eax, eax
je 0x401aeb
call eax
sub edi, 4
cmp edi, dword [0x4084a8]
jae 0x401ae3
push 0x40601c
push 0x406014
call fcn.00401b40
add esp, 8
push 0x406024
push 0x406020
call fcn.00401b40
add esp, 8
test ebx, ebx
jne 0x401b2f
mov dword [0x4060bc], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
ret
Function at 0x4021b0
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
push ebx
push esi
push edi
xor ebx, ebx
push ebp
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp dword [0x406160], ebx
jne 0x4021ff
call esi
cmp eax, ebx
mov edi, eax
je 0x4021dd
mov dword [0x406160], 1
jmp 0x4021ff
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
je 0x4021f5
mov dword [0x406160], 2
jmp 0x4021ff
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x406160], 1
jne 0x4022ae
test edi, edi
jne 0x402222
call esi
mov edi, eax
test edi, edi
jne 0x402222
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp word [edi], 0
mov esi, edi
je 0x40223c
add esi, 2
cmp word [esi], 0
jne 0x40222a
add esi, 2
cmp word [esi], 0
jne 0x40222a
sub esi, edi
push 0
sar esi, 1
push 0
inc esi
push 0
push 0
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
test ebp, ebp
je 0x40229d
push ebp
call fcn.00403d20
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x40229d
push 0
push 0
push ebp
push ebx
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x40228c
push ebx
call fcn.004014d0
add esp, 4
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x406160], 2
jne 0x402332
test ebx, ebx
jne 0x4022d1
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
jne 0x4022d1
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ebp, ebx
cmp byte [ebx], 0
je 0x4022e6
inc ebp
cmp byte [ebp], 0
jne 0x4022d8
inc ebp
cmp byte [ebp], 0
jne 0x4022d8
sub ebp, ebx
inc ebp
push ebp
call fcn.00403d20
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x40230b
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov esi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x402950
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1a8
xor ecx, ecx
mov eax, 0x406390
push ebx
mov edx, dword [esp + 0x1b0]
push esi
push edi
push ebp
cmp dword [eax], edx
je 0x402977
add eax, 8
inc ecx
cmp eax, 0x406420
jb 0x402968
cmp dword [ecx*8 + 0x406390], edx
lea ebx, [ecx*8]
jne 0x402b3b
cmp dword [0x40606c], 1
je 0x402af7
cmp dword [0x40606c], 0
jne 0x4029ae
cmp dword [0x406070], 1
je 0x402af7
cmp edx, 0xfc
je 0x402b3b
lea eax, [esp + 0xb4]
push 0x104
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
call ebp
test eax, eax
jne 0x4029eb
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebp, [esp + 0xb4]
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x402a2f
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
push 3
repne scasb al, byte es:[edi]
not ecx
lea ebp, [esp + ecx + 0x7c]
push 0x4052e0
push ebp
call fcn.00403e70
add esp, 0xc
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4052c0
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x406394]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x12010
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x1c]
push eax
call fcn.00403dd0
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
cmp dword [0x4083a0], 0
je 0x402b0d
mov eax, dword [0x4083a0]
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x402b17
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebx + 0x406394]
push 0
lea eax, [esp + 0x14]
mov edi, edx
push eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
Function at 0x4035e0
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x418
cmp dword [0x4084a0], edx
push ebx
push esi
push edi
push ebp
jbe 0x4037e7
mov eax, edx
and eax, 0xffffffe7
sar eax, 3
add eax, 0x4083a0
mov dword [esp + 0x18], eax
mov eax, edx
and eax, 0x1f
mov ecx, dword [esp + 0x18]
shl eax, 3
mov ebx, dword [ecx]
mov ebp, eax
mov dword [esp + 0x1c], eax
mov al, byte [ebx + ebp + 4]
test al, 1
je 0x4037e7
xor esi, esi
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x20], esi
cmp ebp, esi
jne 0x403649
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
test al, 0x20
je 0x40365a
push 2
push 0
push edx
call fcn.00403f70
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add ecx, dword [eax]
test byte [ecx + 4], 0x80
je 0x4036f6
mov dword [esp + 0x10], 0
mov ebx, dword [esp + 0x430]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x40372f
lea edi, [esp + 0x24]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x4036bd
mov al, byte [ebx]
inc ebx
cmp al, 0xa
jne 0x4036ab
mov byte [edi], 0xd
inc esi
inc edi
mov byte [edi], al
inc edi
mov eax, edi
lea ecx, [esp + 0x24]
sub eax, ecx
cmp eax, 0x400
jl 0x403692
lea eax, [esp + 0x24]
push 0
sub edi, eax
lea ecx, [esp + 0x28]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x1c]
push eax
push edi
push ecx
mov eax, dword [edx]
mov ecx, dword [esp + 0x2c]
mov edx, dword [eax + ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403725
mov eax, dword [esp + 0x14]
add dword [esp + 0x20], eax
cmp eax, edi
jge 0x40367d
jmp 0x40372f
lea eax, [esp + 0x14]
push 0
mov edx, dword [esp + 0x434]
push eax
push ebp
mov ecx, dword [ecx]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403725
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
jmp 0x40372f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x20], 0
jne 0x4037d6
cmp dword [esp + 0x10], 0
je 0x403788
cmp dword [esp + 0x10], 5
jne 0x40376b
mov dword [0x406074], 9
mov eax, dword [esp + 0x10]
pop ebp
pop edi
mov dword [0x406078], eax
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x10]
push eax
call fcn.004032b0
add esp, 4
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax]
test byte [edx + ecx + 4], 0x40
je 0x4037b2
mov eax, dword [esp + 0x430]
cmp byte [eax], 0x1a
jne 0x4037b2
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x406074], 0x1c
mov dword [0x406078], 0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x20]
pop ebp
sub eax, esi
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x406074], 9
mov dword [0x406078], 0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
Function at 0x404150
Capabilities:
Clear file content

Disassembly:
mov eax, 0x1004
call fcn.004045e0
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [esp + 0x1014]
push ebp
cmp dword [0x4084a0], esi
jbe 0x40429d
mov eax, esi
mov ecx, esi
and eax, 0xffffffe7
and ecx, 0x1f
sar eax, 3
mov edx, dword [eax + 0x4083a0]
test byte [edx + ecx*8 + 4], 1
je 0x40429d
push 1
push ebx
push esi
call fcn.00403f70
mov dword [esp + 0x1c], eax
add esp, 0xc
cmp eax, 0xffffffff
je 0x40428d
push 2
push ebx
push esi
call fcn.00403f70
add esp, 0xc
cmp eax, 0xffffffff
je 0x40428d
mov ecx, dword [esp + 0x101c]
mov ebp, ecx
sub ebp, eax
test ebp, ebp
jle 0x404233
lea edi, [esp + 0x14]
xor eax, eax
mov ecx, 0x400
push 0x8000
rep stosd dword es:[edi], eax
push esi
call fcn.00404560
add esp, 8
mov edi, eax
mov eax, 0x1000
cmp ebp, eax
jge 0x4041f6
mov eax, ebp
push eax
lea eax, [esp + 0x18]
push eax
push esi
call fcn.004035e0
add esp, 0xc
cmp eax, 0xffffffff
je 0x404212
sub ebp, eax
test ebp, ebp
jg 0x4041eb
jmp 0x404227
cmp dword [0x406078], 5
jne 0x404225
mov dword [0x406074], 0xd
mov ebx, eax
push edi
push esi
call fcn.00404560
add esp, 8
jmp 0x404270
jge 0x404270
push 0
push ecx
push esi
call fcn.00403f70
add esp, 0xc
push esi
call fcn.00403520
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, 1
sbb ebx, ebx
cmp ebx, 0xffffffff
jne 0x404270
mov dword [0x406074], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x406078], eax
mov eax, dword [esp + 0x10]
push 0
push eax
push esi
call fcn.00403f70
add esp, 0xc
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1004
ret
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1004
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x406074], 9
pop edi
pop esi
pop ebx
add esp, 0x1004
ret

Function at 0x4042c0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
cmp dword [0x4084a0], eax
push ebx
push esi
push edi
push ebp
jbe 0x404502
and eax, 0xffffffe7
sar eax, 3
lea ebp, [eax + 0x4083a0]
mov eax, dword [esp + 0x24]
and eax, 0x1f
lea ebx, [eax*8]
mov eax, dword [ebp]
add eax, ebx
test byte [eax + 4], 1
je 0x404502
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x14], 0
test ecx, ecx
je 0x4044f8
test byte [eax + 4], 2
jne 0x4044f8
test byte [eax + 4], 0x48
je 0x404343
mov al, byte [eax + 5]
cmp al, 0xa
je 0x404343
mov byte [edx], al
inc edx
dec ecx
mov eax, dword [ebp]
mov dword [esp + 0x14], 1
mov byte [eax + ebx + 5], 0xa
lea eax, [esp + 0x18]
push 0
push eax
push ecx
push edx
mov ecx, dword [ebp]
mov edx, dword [ecx + ebx]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4043a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x404384
pop ebp
mov dword [0x406078], eax
mov eax, 0xffffffff
pop edi
mov dword [0x406074], 9
pop esi
pop ebx
add esp, 0x10
ret
cmp eax, 0x6d
jne 0x404393
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret
push eax
call fcn.004032b0
add esp, 4
invalid
invalid
invalid