joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004abd
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10010030]
jne 0x10004ac7
repz ret
jmp fcn.100057f2

Function at 0x1000653e
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x10006579

Function at 0x100066fb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp eax, ebx
je 0x10006cf7
mov edi, dword [eax + 0x3c]
add edi, eax
movzx eax, word [edi + 0x14]
lea esi, [eax + edi + 0x18]
mov dword [ebp - 0x44], esi
call fcn.100064fe
inc esp
mov esi, 0xb70fed00
inc edi
push es
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.100064fe
xchg dword [eax + 0x6d], ebp
test byte [esi - 0x75], ah
inc edi
push es
cmp ax, bx
jbe 0x10006758
lea ecx, [esi + 0xc]
movzx edx, ax
invalid
inc ecx

Function at 0x1000690c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp + 8]
call fcn.100064c3
mov dword [ebp - 0xbc], eax
invalid

Function at 0x100069b1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.100064fe
pop eax
push ds
fldenv [eax - 0x837a73]
invalid
Function at 0x10006bea
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x10006bb2
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x10006bad
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
or byte [edi], cl
mov bh, 9
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x10006b97
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x10006b9f
cmp edx, ebx
jne 0x10006ced
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x10006b6e
add eax, dword [eax + 4]
jmp 0x10006b5b
mov dword [ebp + 0xc], ebx
jmp 0x10006bbd
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10006bd5
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10006bf3
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
test bh, al
clc
add byte [eax], al
invalid
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10006c51
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10006c38
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10006c41
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10006c4b
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10006c2d
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10006bb7
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10006c9e
dec eax
je 0x10006c95
sub eax, 3
je 0x10006c8c
mov dword [ebp - 4], 0x40
jmp 0x10006cbb
mov dword [ebp - 4], 4
jmp 0x10006ca1
mov dword [ebp - 4], 0x20
jmp 0x10006ca1
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10006ced
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10006c6d
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.100064fe
pop ss
sahf
cmc
js 0x10006ce1
push dword [ebp + 0x14]
jne 0x10006cf8
push 1
push esi
call edi
mov eax, esi
jmp 0x10006cf9
push 0x8000
push ebx
push esi
call dword [ebp - 8]
rcr byte [edi + 0x5e], 0x5b
Function at 0x10007994
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec ecx
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.100064fe
in al, dx
mov ah, al
salc
lea eax, [ebp - 0x72c]
push eax
call fcn.1000650e
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100064c3
add esp, 0xc
mov dword [ebp - 0x6e4], eax
call fcn.100064fe
sub eax, 0x8d7b4950
test eax, ebp
clc
invalid
Function at 0x4013f0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
lea ebp, [ebx + 0x1c]
shr ebx, 2
mov eax, ebx
shr eax, 1
add eax, 3
push esi
mov dword [ecx], eax
add ecx, 0x10
xor esi, esi
mov dword [esp + 0xc], ebp
test ebx, ebx
jbe 0x401421
mov eax, dword [edx]
mov dword [ecx + esi*4], eax
inc esi
add edx, 4
cmp esi, ebx
jb 0x401414
cmp esi, ebp
jae 0x401512
mov edx, esi
sub edx, ebx
lea eax, [ecx + edx*4]
mov dword [esp + 0x14], eax
push edi
xor edx, edx
mov eax, esi
div ebx
mov edi, dword [ecx + esi*4 - 4]
test edx, edx
jne 0x40149e
movzx eax, byte [eax + 0x43d18c]
mov edx, edi
and edx, 0xff
movzx edx, byte [edx + str.cw]
mov ebp, edi
shr ebp, 0x18
movzx ebp, byte [ebp + str.cw]
shl edx, 8
or edx, ebp
mov ebp, edi
shr ebp, 0x10
shr edi, 8
and ebp, 0xff
movzx ebp, byte [ebp + str.cw]
and edi, 0xff
movzx edi, byte [edi + str.cw]
shl edx, 8
or edx, ebp
mov ebp, dword [esp + 0x10]
shl edx, 8
xor edi, eax
or edi, edx
jmp 0x4014f6
cmp ebx, 6
jbe 0x4014f6
cmp edx, 4
jne 0x4014f6
mov edx, edi
shr edx, 0x10
and edx, 0xff
movzx eax, byte [edx + str.cw]
mov edx, edi
shr edx, 0x18
movzx edx, byte [edx + str.cw]
shl edx, 8
or eax, edx
mov edx, edi
shr edx, 8
and edx, 0xff
movzx edx, byte [edx + str.cw]
shl eax, 8
and edi, 0xff
or eax, edx
movzx edx, byte [edi + str.cw]
shl eax, 8
or eax, edx
mov edi, eax
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
xor edx, edi
mov dword [ecx + esi*4], edx
inc esi
add eax, 4
mov dword [esp + 0x18], eax
cmp esi, ebp
jb 0x401435
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x402170
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esp + 0xc]
sub esp, 8
push ebp
push esi
mov esi, dword [ecx]
xor ebp, ebp
and esi, 7
cmp eax, 5
jae 0x40218f
pop esi
xor eax, eax
pop ebp
add esp, 8
ret 0xc
mov edx, dword [esp + 0x14]
add dword [esp + 0x18], 5
push ebx
lea ebx, [edx + eax - 4]
push edi
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], ebx
lea ebx, [ebx]
lea edi, [edx + ebp]
cmp edi, ebx
jae 0x4021c4
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x4021c4
inc edi
cmp edi, ebx
jb 0x4021b7
mov ebp, edi
sub ebp, edx
mov eax, ebp
sub eax, dword [esp + 0x10]
cmp edi, ebx
jae 0x4022c6
cmp eax, 3
jbe 0x4021f7
xor esi, esi
mov al, byte [edi + 4]
mov dword [esp + 0x10], ebp
test al, al
je 0x40222f
cmp al, 0xff
je 0x40222f
and esi, 3
add esi, esi
or esi, 1
inc ebp
jmp 0x4021b0
lea ecx, [eax - 1]
shl esi, cl
and esi, 7
je 0x4021dd
movzx ecx, byte [esi + 0x433f10]
mov eax, edi
sub eax, ecx
cmp byte [esi + 0x433f08], 0
mov al, byte [eax + 4]
je 0x402220
test al, al
je 0x402220
cmp al, 0xff
jne 0x4021dd
and esi, 3
add esi, esi
mov dword [esp + 0x10], ebp
or esi, 1
inc ebp
jmp 0x4021b0
movzx ecx, byte [edi + 3]
movzx edx, al
movzx eax, byte [edi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, eax
shl edx, 8
or edx, ecx
lea ecx, [ecx]
sub edx, ebp
sub edx, dword [esp + 0x20]
mov eax, edx
test esi, esi
je 0x402298
movzx edx, byte [esi + 0x433f10]
add edx, edx
add edx, edx
add edx, edx
mov ecx, 0x18
sub ecx, edx
mov ebx, eax
shr ebx, cl
test bl, bl
je 0x40227d
cmp bl, 0xff
jne 0x402294
mov ebx, dword [esp + 0x14]
mov ecx, 0x20
sub ecx, edx
mov edx, 1
shl edx, cl
dec edx
xor edx, eax
jmp 0x402250
mov ebx, dword [esp + 0x14]
mov edx, eax
shr edx, 0x18
and dl, 1
dec dl
not dl
mov byte [edi + 4], dl
mov edx, eax
shr edx, 8
mov ecx, eax
shr ecx, 0x10
mov byte [edi + 2], dl
mov edx, dword [esp + 0x1c]
mov byte [edi + 3], cl
mov byte [edi + 1], al
add ebp, 5
jmp 0x4021b0
pop edi
pop ebx
cmp eax, 3
jbe 0x4022df
mov eax, dword [esp + 0x1c]
xor esi, esi
mov dword [eax], esi
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret 0xc
lea ecx, [eax - 1]
mov eax, dword [esp + 0x1c]
shl esi, cl
and esi, 7
mov dword [eax], esi
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret 0xc
Function at 0x4068c0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 8]
cmp eax, 0x105
push edi
jg 0x4068df
cmp eax, 0x106
je 0x4068df
push 0x106
call fcn.00404e70
mov eax, dword [esi]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x406902
mov edx, edi
add edx, 2
inc ecx
cmp word [edx], 0
jne 0x4068f8
xor edx, edx
mov word [edi + ecx*2], dx
mov dword [esi + 4], ecx
dec eax
mov ecx, 0x103
cmp ecx, eax
sbb eax, eax
pop edi
inc eax
pop esi
ret

Function at 0x406a10
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x430508
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
mov eax, dword [0x43c024]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, ecx
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
push ebx
call ebp
test eax, eax
je 0x406a5b
mov al, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
xor eax, eax
push 4
lea esi, [esp + 0x14]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
call fcn.00404e70
mov eax, esi
push eax
push ebx
mov dword [esp + 0x2c], 0
call fcn.004081c0
test al, al
je 0x406ac8
cmp dword [esp + 0x14], 0
setne al
test al, al
je 0x406ac8
mov esi, dword [esp + 0x10]
push edi
push esi
call ebp
test eax, eax
push esi
setne bl
mov dword [esp + 0x28], 0xffffffff
call fcn.00421dee
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov dword [esp + 0x24], 0xffffffff
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00421dee
add esp, 4
xor al, al
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x406b00
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x42ebd8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43c024]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push ebp
call edi
test eax, eax
je 0x406b3c
mov al, 1
jmp 0x406ba9
xor ebx, ebx
push 4
lea esi, [esp + 0x18]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.00404e70
mov eax, esi
push eax
push ebp
mov dword [esp + 0x30], ebx
call fcn.004081c0
test al, al
je 0x406b92
cmp dword [esp + 0x18], ebx
setne al
cmp al, bl
je 0x406b92
mov esi, dword [esp + 0x14]
push esi
call edi
cmp eax, ebx
push esi
setne bl
mov dword [esp + 0x2c], 0xffffffff
call fcn.00421dee
add esp, 4
mov al, bl
jmp 0x406ba9
mov dword [esp + 0x28], 0xffffffff
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00421dee
add esp, 4
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x406bc0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x42ebd8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43c024]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor ebx, ebx
push ebx
push ebp
call edi
test eax, eax
je 0x406bff
mov al, 1
jmp 0x406c78
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x406c76
push 4
lea esi, [esp + 0x18]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.00404e70
mov eax, esi
push eax
push ebp
mov dword [esp + 0x30], ebx
call fcn.004081c0
test al, al
je 0x406c61
cmp dword [esp + 0x18], ebx
setne al
cmp al, bl
je 0x406c61
mov esi, dword [esp + 0x14]
push ebx
push esi
call edi
cmp eax, ebx
push esi
setne bl
mov dword [esp + 0x2c], 0xffffffff
call fcn.00421dee
add esp, 4
mov al, bl
jmp 0x406c78
mov dword [esp + 0x28], 0xffffffff
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00421dee
add esp, 4
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x4070d0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x42ebd8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43c024]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebp
call ebx
test eax, eax
jne 0x407181
mov eax, ebp
call fcn.00407070
cmp eax, 1
jne 0x407125
xor edi, edi
mov ecx, ebp
call fcn.00406a10
test al, al
je 0x4071f8
push ebp
call ebx
test eax, eax
jne 0x407181
xor edi, edi
push 4
lea esi, [esp + 0x18]
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call fcn.00404e70
mov eax, esi
push eax
push ebp
mov dword [esp + 0x30], edi
call fcn.004081c0
test al, al
je 0x4071e3
cmp dword [esp + 0x18], edi
setne al
test al, al
je 0x4071e3
mov esi, dword [esp + 0x14]
push esi
call ebx
test eax, eax
je 0x407185
push esi
mov dword [esp + 0x2c], 0xffffffff
call fcn.00421dee
add esp, 4
mov al, 1
jmp 0x4071fa
mov eax, esi
call fcn.00407070
cmp eax, 1
jne 0x4071ab
xor edi, edi
mov ecx, esi
call fcn.00406a10
test al, al
jne 0x4071a9
mov dword [esp + 0x28], 0xffffffff
push esi
jmp 0x4071f0
xor edi, edi
push esi
call ebx
push esi
test eax, eax
je 0x4071c7
mov dword [esp + 0x2c], 0xffffffff
call fcn.00421dee
add esp, 4
mov al, 1
jmp 0x4071fa
call ebx
cmp eax, edi
push esi
setne bl
mov dword [esp + 0x2c], 0xffffffff
call fcn.00421dee
add esp, 4
mov al, bl
jmp 0x4071fa
mov dword [esp + 0x28], 0xffffffff
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00421dee
add esp, 4
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4

Function at 0x4078e0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 8]
cmp eax, 0x105
push edi
jg 0x4078ff
cmp eax, 0x106
je 0x4078ff
push 0x106
call fcn.00404e70
mov eax, dword [esi]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x407922
mov edx, edi
add edx, 2
inc ecx
cmp word [edx], 0
jne 0x407918
xor edx, edx
mov word [edi + ecx*2], dx
mov dword [esi + 4], ecx
dec eax
mov ecx, 0x103
cmp ecx, eax
sbb eax, eax
pop edi
inc eax
pop esi
ret

Function at 0x407940
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 8]
cmp eax, 0x105
jg 0x40795e
cmp eax, 0x106
je 0x40795e
push 0x106
call fcn.00404e70
mov eax, dword [esi]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, dword [esi]
xor eax, eax
cmp word [edx], ax
je 0x40798a
mov ecx, edx
lea ebx, [ebx]
add ecx, 2
inc eax
cmp word [ecx], 0
jne 0x407980
xor ecx, ecx
mov word [edx + eax*2], cx
mov dword [esi + 4], eax
mov al, 1
pop esi
ret
Function at 0x4079a0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 8]
cmp eax, 0x105
push edi
jg 0x4079bf
cmp eax, 0x106
je 0x4079bf
push 0x106
call fcn.00404e70
mov eax, dword [esi]
push eax
mov eax, dword [esp + 0x10]
push 0
push 0x434980
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x4079ea
mov edx, edi
nop
add edx, 2
inc ecx
cmp word [edx], 0
jne 0x4079e0
xor edx, edx
mov word [edi + ecx*2], dx
pop edi
mov dword [esi + 4], ecx
pop esi
ret 4

Function at 0x4081c0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x42fdd0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43c024]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x54]
mov eax, dword [esp + 0x58]
xor ecx, ecx
mov dword [eax + 4], ecx
mov eax, dword [eax]
xor edx, edx
mov word [eax], dx
movzx eax, word [ebp]
xor edi, edi
cmp ax, cx
je 0x40820e
inc edi
cmp word [ebp + edi*2], cx
jne 0x408206
cmp edi, 1
movzx ebx, ax
jl 0x408379
cmp bx, 0x5c
je 0x408379
cmp bx, 0x2e
jne 0x408242
cmp edi, 1
je 0x408379
cmp edi, 2
jne 0x408242
cmp word [ebp + 2], bx
je 0x408379
push 4
lea esi, [esp + 0x18]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
call fcn.00404e70
cmp edi, 3
mov dword [esp + 0x4c], 0
jle 0x408289
cmp word [ebp + 2], 0x3a
jne 0x408289
cmp word [ebp + 4], 0x5c
jne 0x408289
cmp bx, 0x61
jb 0x408280
cmp bx, 0x7a
jbe 0x4082f1
add ebx, 0xffffffbf
cmp bx, 0x19
jbe 0x4082f1
mov eax, dword [esp + 0x1c]
cmp eax, 0x105
jg 0x4082a9
cmp eax, 0x106
je 0x4082a9
push 0x106
lea esi, [esp + 0x18]
call fcn.00404e70
mov eax, dword [esp + 0x14]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea esi, [esp + 0x14]
mov edi, eax
call fcn.00406200
test edi, edi
je 0x408391
cmp edi, 0x104
ja 0x408391
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
cmp word [edx + ecx*2 - 2], 0x5c
je 0x4082f1
push 0x5c
mov eax, esi
call fcn.00404c40
mov ebx, 0x433f88
lea eax, [esp + 0x38]
call fcn.00404b30
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x30]
push edx
mov edi, eax
mov byte [esp + 0x54], 1
call fcn.00407ca0
push ebp
lea ecx, [esp + 0x24]
mov bl, 2
push ecx
mov edi, eax
mov byte [esp + 0x54], bl
call fcn.00408600
mov edi, eax
mov eax, dword [esp + 0x58]
mov byte [esp + 0x4c], 3
call fcn.00404bf0
mov byte [esp + 0x4c], bl
mov edx, dword [esp + 0x20]
push edx
call fcn.00421dee
mov byte [esp + 0x50], 1
mov eax, dword [esp + 0x30]
push eax
call fcn.00421dee
mov byte [esp + 0x54], 0
mov ecx, dword [esp + 0x40]
push ecx
call fcn.00421dee
mov dword [esp + 0x58], 0xffffffff
mov edx, dword [esp + 0x20]
push edx
call fcn.00421dee
add esp, 0x10
mov al, 1
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 8
mov dword [esp + 0x4c], 0xffffffff
mov eax, dword [esp + 0x14]
push eax
call fcn.00421dee
add esp, 4
xor al, al
jmp 0x40837b
Function at 0x408520
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, eax
mov dword [esi], 0
mov eax, ebp
cmp ebp, 0x400000
jbe 0x408544
mov eax, 0x400000
mov edx, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [edx]
push edi
push eax
mov dword [esp + 0x28], 0
call ebx
mov ecx, dword [esp + 0x14]
add dword [esi], ecx
test eax, eax
je 0x40857a
test ecx, ecx
je 0x408572
add edi, ecx
sub ebp, ecx
jne 0x408535
pop edi
pop ebp
mov al, 1
pop ebx
ret 8
pop edi
pop ebp
xor al, al
pop ebx
ret 8

Function at 0x408a00
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi]
mov dword [esi + 4], 0
xor ecx, ecx
mov word [eax], cx
mov edx, dword [ebx]
push edi
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
test edi, edi
jne 0x408a2f
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
ret
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x408a43
lea ecx, [edi + 1]
cmp ecx, eax
je 0x408a43
push ecx
call fcn.00404e70
mov eax, dword [esi]
inc edi
push edi
push eax
mov eax, dword [ebx]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x408a6a
mov edx, edi
lea esp, [esp]
add edx, 2
inc ecx
cmp word [edx], 0
jne 0x408a60
xor edx, edx
mov word [edi + ecx*2], dx
mov dword [esi + 4], ecx
test eax, eax
jne 0x408a86
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
ret
pop edi
mov al, 1
pop esi
ret
Function at 0x4139d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42f818
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x43c024]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 8], 0
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
mov dword [esp + 0x24], 0
call fcn.00413850
mov esi, eax
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esp + 8]
test eax, eax
je 0x413a39
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x10

Function at 0x413ba0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
cmp eax, 0x400000
jbe 0x413bb0
mov eax, 0x400000
mov edx, dword [esp + 8]
push 0
lea ecx, [esp + 0x10]
push ecx
push eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0xc]
push edx
push ecx
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x10]
test eax, eax
setne al
test ecx, ecx
je 0x413be6
mov edx, dword [esp + 0xc]
mov dword [ecx], edx
test al, al
je 0x413bef
xor eax, eax
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x413c01
mov eax, 0x80004005
ret 0x10
jle 0x413c0d
and eax, 0xffff
or eax, 0x80070000
ret 0x10

Function at 0x413cc0
Capabilities:
Get file size

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx + 8]
push esi
push edi
lea eax, [esp + 0xc]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x413ce8
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jne 0x413d10
mov eax, dword [esp + 0xc]
push 1
push 0
push 0
push eax
call fcn.0042aeb0
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [esp + 0x10]
pop edi
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
pop esi
ret 8
call edi
test eax, eax
jne 0x413d20
pop edi
mov eax, 0x80004005
pop esi
ret 8
jle 0x413d2c
and eax, 0xffff
or eax, 0x80070000
pop edi
pop esi
ret 8

Function at 0x413d40
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
cmp eax, 0x400000
jbe 0x413d50
mov eax, 0x400000
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
mov eax, dword [esi + 8]
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x14]
test eax, eax
mov eax, dword [esp + 0x10]
setne dl
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
pop esi
test ecx, ecx
je 0x413d8f
mov dword [ecx], eax
test dl, dl
je 0x413d98
xor eax, eax
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x413daa
mov eax, 0x80004005
ret 0x10
jle 0x413db6
and eax, 0xffff
or eax, 0x80070000
ret 0x10