joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ec020
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5d7c7c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
cmp dword [esi + 0x10], 0
jne 0x4ec205
test edi, edi
je 0x4ec205
mov ecx, dword [esi + 0x20]
mov eax, 0x532ae21d
sub ecx, dword [esi + 0x1c]
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jae 0x4ec205
imul eax, ebx, 0x314
mov ebx, dword [esi + 0x1c]
mov ebx, dword [eax + ebx]
test byte [ebx + 0x26], 0x10
jne 0x4ec205
mov eax, dword [ebp + 0x10]
cmp dword [ebx + 0x18], eax
ja 0x4ec205
mov esi, dword [esi + 0xc]
mov edx, dword [ebx + 0x2a]
movzx eax, word [edx + esi + 0x1c]
movzx ecx, word [edx + esi + 0x1a]
add eax, edx
add ecx, eax
lea eax, [esi + 0x1e]
add eax, ecx
movzx ecx, word [ebx + 0xa]
mov dword [ebp - 8], eax
test cx, cx
jne 0x4ec21a
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebx + 0x14]
mov dword [ebp - 0xc], ecx
test esi, esi
je 0x4ec10d
test eax, eax
je 0x4ec0d9
cmp ecx, esi
jb 0x4ec0d9
push esi
push eax
push edi
call fcn.005130b0
add esp, 0xc
jmp 0x4ec10d
push ecx
push 0
push edi
call fcn.00512920
add esp, 0xc
cmp dword [ebp - 8], 0
jne 0x4ec0f8
call fcn.0052fe4c
mov dword [eax], 0x16
jmp 0x4ec108
cmp dword [ebp - 0xc], esi
jae 0x4ec10d
call fcn.0052fe4c
mov dword [eax], 0x22
call fcn.0052fd26
mov edx, dword [ebx + 0x14]
test edx, edx
je 0x4ec1fe
or eax, 0xffffffff
cmp edx, 8
jb 0x4ec1d6
mov esi, edx
shr esi, 3
nop dword [eax]
movzx ecx, byte [edi]
sub edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a1f10]
movzx ecx, byte [edi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a1f10]
movzx ecx, byte [edi + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a1f10]
movzx ecx, byte [edi + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a1f10]
movzx ecx, byte [edi + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a1f10]
movzx ecx, byte [edi + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a1f10]
movzx ecx, byte [edi + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a1f10]
movzx ecx, byte [edi + 7]
add edi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a1f10]
sub esi, 1
jne 0x4ec130
test edx, edx
je 0x4ec1fa
nop word [eax + eax]
movzx ecx, byte [edi]
lea edi, [edi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a1f10]
sub edx, 1
jne 0x4ec1e0
not eax
jmp 0x4ec200
xor eax, eax
cmp eax, dword [ebx + 0x10]
je 0x4ec246
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004acb88
mov esp, ebp
pop ebp
ret 0xc
cmp ecx, 8
jne 0x4ec205
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push dword [ebp + 0x10]
push edi
push dword [ebx + 0x14]
push eax
call fcn.004f2160
add esp, 0x14
test eax, eax
je 0x4ec205
mov eax, dword [ebp - 8]
cmp eax, dword [ebx + 0x10]
jne 0x4ec205
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004acb88
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ec4f0
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e03f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5d7c7c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x58
call fcn.004ad129
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x4ec547
push 0x58
push 0
push esi
call fcn.00512920
add esp, 0xc
mov ecx, esi
call fcn.004ea170
mov esi, eax
jmp 0x4ec549
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
cmp dword [edi + 0x14], 8
jb 0x4ec55b
mov edi, dword [edi]
test edi, edi
je 0x4ec5f8
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4ec5f8
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x4ec5f8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x14], eax
cmp eax, 0x16
jb 0x4ec5f8
push 0
push 0
push 0
push 2
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp dword [esi + 4], 0
mov dword [esi + 8], eax
je 0x4ec5f8
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
test eax, eax
je 0x4ec5f8
push dword [esi + 0x14]
mov ecx, esi
push eax
call fcn.004eb3a0
test eax, eax
je 0x4ec5f8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x4ec60e
mov ecx, esi
call fcn.004ea2f0
push 0x58
push esi
call fcn.004acb9e
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4edd90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
test edx, edx
je 0x4ede8f
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4ede8f
or eax, 0xffffffff
cmp esi, 8
jb 0x4ede67
push edi
mov edi, esi
shr edi, 3
nop dword [eax]
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a3760]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a3760]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a3760]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a3760]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a3760]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a3760]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a3760]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a3760]
sub edi, 1
jne 0x4eddc0
pop edi
test esi, esi
je 0x4ede8a
nop dword [eax + eax]
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5a3760]
sub esi, 1
jne 0x4ede70
not eax
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4f461b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x556ac5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005566ca

Function at 0x556ad0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0055684b

Function at 0x55da57
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0055d231

Function at 0x55da62
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0055d46c

Function at 0x55def5
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0055dc7c
Function at 0x40151e
Capabilities:
Print debug messages

Disassembly:
jmp 0x40cafb
push esi
mov esi, ecx
call fcn.0040157d
mov eax, 0x400000
mov dword [esi], 0x38
lea ecx, [esi + 0x14]
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], 0xe00
mov dword [esi + 0x10], 0x413b20
call fcn.00401230
test eax, eax
jns 0x40cb4a
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40cb43
push str.ERROR_:_Unable_to_initialize_critical_section_in_CAtlBaseModule_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [0x4501a0], 1
mov eax, esi
pop esi
ret
Function at 0x401410
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x4c6260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
xor ecx, ecx
push eax
mov eax, dword [ebp + 0xc]
lea esi, [ebp - 0x60]
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x60], 0x67452301
mov dword [ebp - 0x5c], 0xefcdab89
mov dword [ebp - 0x58], 0x98badcfe
mov dword [ebp - 0x54], 0x10325476
call fcn.00408820
add esp, 4
mov ecx, esi
call fcn.004088d0
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00461ffa
mov esp, ebp
pop ebp
ret

Function at 0x401480
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x4c6260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
xor ecx, ecx
push eax
mov eax, dword [ebp + 0xc]
lea esi, [ebp - 0x60]
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x60], 0x67452301
mov dword [ebp - 0x5c], 0xefcdab89
mov dword [ebp - 0x58], 0x98badcfe
mov dword [ebp - 0x54], 0x10325476
call fcn.00408820
add esp, 4
mov ecx, esi
call fcn.004088d0
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00461ffa
mov esp, ebp
pop ebp
ret
Function at 0x401610
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x20119
xor edi, edi
push edi
push 0x4ad764
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401788
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [ebp - 4]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [ebp - 8]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0xc]
push str.Operator
mov edi, 0x400
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4016a0
cmp dword [ebp - 8], 1
jne 0x401772
mov eax, ebx
mov ebx, dword [ebp - 4]
sub edi, ebx
mov dword [esi], eax
lea ebx, [ebx + eax]
je 0x401772
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push ebx
lea edx, [ebp - 8]
push edx
push 0
push str.IssueDate
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4016db
cmp dword [ebp - 8], 1
jne 0x401772
mov eax, dword [ebp - 4]
mov dword [esi + 4], ebx
add ebx, eax
sub edi, eax
je 0x401772
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push ebx
lea edx, [ebp - 8]
push edx
push 0
push str.ExpirationDate
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40170e
cmp dword [ebp - 8], 1
jne 0x401772
mov eax, dword [ebp - 4]
mov dword [esi + 8], ebx
add ebx, eax
sub edi, eax
je 0x401772
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push ebx
lea edx, [ebp - 8]
push edx
push 0
push str.SignData
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401772
cmp dword [ebp - 8], 3
jne 0x401772
mov eax, dword [ebp - 4]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x401772
add esi, 0xc
call fcn.004014f0
test eax, eax
je 0x401772
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401d30
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4c6260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov ebx, ecx
mov esi, edx
lea ecx, [ebp - 0x68]
push ecx
lea edx, [ebp - 0x60]
mov dword [ebp - 0x6c], eax
xor eax, eax
push edx
lea edx, [ebp - 0x64]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x67452301
mov dword [ebp - 0x5c], 0xefcdab89
mov dword [ebp - 0x58], 0x98badcfe
mov dword [ebp - 0x54], 0x10325476
call fcn.004058c0
add esp, 8
test eax, eax
jne 0x401d97
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00461ffa
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
test eax, eax
je 0x401daa
push esi
lea esi, [ebp - 0x60]
call fcn.00408820
add esp, 4
mov ebx, dword [ebp - 0x6c]
lea ecx, [ebp - 0x60]
call fcn.004088d0
test edi, edi
je 0x401dc6
mov ecx, dword [ebp - 0x64]
xor eax, eax
cmp ecx, dword [ebp - 0x68]
sete al
mov dword [edi], eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00461ffa
mov esp, ebp
pop ebp
ret

Function at 0x401f50
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x4c6260]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 0x8c], eax
cmp dword [edi + 0x1c], ecx
je 0x401f7f
lea esi, [edi + 0x20]
cmp esi, ecx
jne 0x401f86
mov dword [eax], ecx
jmp 0x402023
mov dword [eax], 1
lea eax, [ebp - 0x84]
push eax
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x84], 0x67452301
mov dword [ebp - 0x80], 0xefcdab89
mov dword [ebp - 0x7c], 0x98badcfe
mov dword [ebp - 0x78], 0x10325476
call fcn.00405ab0
add esp, 4
test eax, eax
je 0x402023
lea ecx, [ebp - 0x84]
lea ebx, [ebp - 0x18]
call fcn.004088d0
lea ecx, [ebp - 0x28]
push esi
push ecx
mov ecx, 0x4ad5b8
mov edi, 0x80
lea ebx, [ebp - 0x88]
mov dword [ebp - 0x88], 0x10
call fcn.00407b60
add esp, 8
test eax, eax
jne 0x402023
lea eax, [edi - 0x70]
xor ecx, ecx
mov edx, dword [ebp + ecx - 0x18]
cmp edx, dword [ebp + ecx - 0x28]
jne 0x402023
sub eax, 4
add ecx, 4
cmp eax, 4
jae 0x402002
mov eax, dword [ebp - 0x8c]
mov dword [eax], 3
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00461ffa
mov esp, ebp
pop ebp
ret
Function at 0x402040
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x4c6260]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
movzx edx, word [eax + 0x84]
push ebx
xor ebx, ebx
xor eax, eax
push edi
mov edi, ecx
mov dword [ebp - 0x18], 0x9302d30
mov dword [ebp - 0x14], 0xe2b0506
mov dword [ebp - 0x10], 0x51a0203
mov word [ebp - 0xc], 0x400
mov byte [ebp - 0xa], 0x20
mov dword [ebp - 0xdc], 0x2f
cmp esi, ebx
je 0x4020a0
mov dword [esi], 1
jmp 0x4020a0
movzx ecx, ax
lea ecx, [ecx + ecx*2]
cmp word [ecx*4 + 0x4ad194], dx
je 0x4020bc
inc eax
cmp ax, 1
jb 0x4020a0
jmp 0x4021e0
cmp ax, 1
jae 0x4021e0
movzx eax, ax
lea edx, [eax + eax*2]
mov eax, dword [edx*4 + 0x4ad198]
lea ecx, [ebp - 0xd4]
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb0], ebx
push ecx
mov ebx, edi
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], 0x6a09e667
mov dword [ebp - 0xd0], 0xbb67ae85
mov dword [ebp - 0xcc], 0x3c6ef372
mov dword [ebp - 0xc8], 0xa54ff53a
mov dword [ebp - 0xc4], 0x510e527f
mov dword [ebp - 0xc0], 0x9b05688c
mov dword [ebp - 0xbc], 0x1f83d9ab
mov dword [ebp - 0xb8], 0x5be0cd19
call fcn.00405ba0
add esp, 4
test eax, eax
je 0x4021e0
lea eax, [ebp - 0x68]
lea edi, [ebp - 0xd4]
call fcn.00407960
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0xd8]
add edx, 0x90
push edx
lea edi, [ebp - 0xdc]
lea ebx, [ebp - 0x48]
call fcn.00406660
add esp, 4
test eax, eax
jne 0x4021e0
lea edx, [eax + 0xf]
mov eax, ebx
lea ecx, [ebp - 0x18]
lea esp, [esp]
mov edi, dword [ecx]
cmp edi, dword [eax]
jne 0x4021e0
sub edx, 4
add eax, 4
add ecx, 4
cmp edx, 4
jae 0x402190
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4021e0
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4021e0
mov al, byte [eax + 2]
cmp al, byte [ecx + 2]
jne 0x4021e0
mov eax, 0x20
xor ecx, ecx
mov edx, dword [ebp + ecx - 0x68]
cmp edx, dword [ebp + ecx - 0x39]
jne 0x4021e0
sub eax, 4
add ecx, 4
cmp eax, 4
jae 0x4021c1
test esi, esi
je 0x4021e0
mov dword [esi], 3
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00461ffa
mov esp, ebp
pop ebp
ret

Function at 0x403720
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x403756
push str.ReadFile__
push 0xfc
push str.QHImageHlp.c
xor edx, edx
call fcn.00409960
add esp, 0xc
xor eax, eax
mov esp, ebp
pop ebp
ret
cmp esi, dword [ebp - 4]
je 0x40377d
push 0x4ad8f8
push 0xfe
push str.QHImageHlp.c
mov edx, 1
call fcn.00409d60
add esp, 0xc
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x403790
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4037c6
push str.WriteFile__
push 0x111
push str.QHImageHlp.c
xor edx, edx
call fcn.00409960
add esp, 0xc
xor eax, eax
mov esp, ebp
pop ebp
ret
cmp esi, dword [ebp - 4]
je 0x4037ed
push 0x4ad924
push 0x113
push str.QHImageHlp.c
mov edx, 1
call fcn.00409d60
add esp, 0xc
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x403870
Capabilities:
Clear file content

Disassembly:
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x403897
push str.SetEndOfFile__
push 0x132
push str.QHImageHlp.c
xor edx, edx
call fcn.00409960
add esp, 0xc
xor eax, eax
ret
mov eax, 1
ret
Function at 0x4038a0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x20
push ebx
push esi
push edi
lea eax, [ebp - 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x4038dd
push str.GetFileSizeEx__
push 0x11e
push str.QHImageHlp.c
xor edx, edx
call fcn.00409960
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp - 0x1c]
cmp esi, edi
ja 0x403ab9
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x20]
jb 0x4038fb
cmp ecx, edx
jae 0x403ab9
mov eax, edx
sub eax, ecx
mov ecx, edi
sbb ecx, esi
mov ebx, eax
shrd ebx, ecx, 0xf
shr ecx, 0xf
and eax, 0x7fff
mov dword [ebp - 4], ebx
mov esi, eax
jne 0x40391f
mov esi, 0x8000
jmp 0x403923
inc ebx
mov dword [ebp - 4], ebx
xor eax, eax
sub edx, esi
sbb edi, eax
mov eax, dword [ebp + 0x14]
mov ecx, edi
xor edi, edi
mov ebx, edx
add eax, ebx
adc edi, ecx
cmp dword [ebp - 4], 0
mov dword [ebp + 0x10], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], 0
jbe 0x403ab9
lea ecx, [ecx]
push 0
push 0
push ecx
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x403a00
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 8]
push 0
lea edx, [ebp - 0xc]
push edx
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403a22
cmp esi, dword [ebp - 0xc]
jne 0x403a44
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
push 0
push 0
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x403a50
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 8]
push 0
lea ecx, [ebp - 0x10]
push ecx
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403a72
cmp esi, dword [ebp - 0x10]
jne 0x403a94
mov eax, dword [ebp - 8]
add ebx, 0xffff8000
adc dword [ebp + 0x10], 0xffffffff
add dword [ebp - 0x18], 0xffff8000
mov esi, 0x8000
adc edi, 0xffffffff
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ebp - 4]
jae 0x403ab9
mov ecx, dword [ebp + 0x10]
jmp 0x403950
push str.SetFilePointerEx__
push 0xf9
push str.QHImageHlp.c
xor edx, edx
call fcn.00409960
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push str.ReadFile__
push 0xfc
push str.QHImageHlp.c
xor edx, edx
call fcn.00409960
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0x4ad8f8
push 0xfe
jmp 0x403a9e
push str.SetFilePointerEx__
push 0x10e
push str.QHImageHlp.c
xor edx, edx
call fcn.00409960
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push str.WriteFile__
push 0x111
push str.QHImageHlp.c
xor edx, edx
call fcn.00409960
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0x4ad924
push 0x113
push str.QHImageHlp.c
mov edx, 1
call fcn.00409d60
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403ad0
Capabilities:
Clear file content
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor ecx, ecx
mov esi, eax
sub esi, dword [ebp + 0x14]
push edi
mov edi, ebx
sbb edi, ecx
mov dword [ebp - 0x18], esi
cmp ebx, edi
ja 0x403b1c
jb 0x403af7
cmp eax, esi
jae 0x403b1c
push 0x4ad97c
push 0x16d
push str.QHImageHlp.c
mov edx, 1
call fcn.00409d60
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x403b3d
push str.GetFileSizeEx__
push 0x11e
jmp 0x403c6b
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
cmp ebx, eax
jb 0x403b90
ja 0x403b4e
cmp dword [ebp + 0xc], ecx
jb 0x403b90
cmp edi, eax
ja 0x403b84
jb 0x403b58
cmp esi, ecx
jae 0x403b84
push edi
mov dword [ebp - 0x10], esi
push esi
mov esi, dword [ebp + 8]
mov edx, esi
mov dword [ebp - 0xc], edi
call fcn.00403830
add esp, 8
test eax, eax
je 0x403c7a
mov eax, esi
call fcn.00403870
test eax, eax
je 0x403c7a
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
sub ecx, dword [ebp + 0xc]
sbb eax, ebx
mov esi, ecx
shrd ecx, eax, 0xf
shr eax, 0xf
and esi, 0x7fff
mov dword [ebp - 4], ecx
jne 0x403bb0
mov esi, 0x8000
jmp 0x403bb4
inc ecx
mov dword [ebp - 4], ecx
mov dword [ebp + 0x14], 0
test ecx, ecx
je 0x403c4f
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push 0
push 0
push ebx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x403c83
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 8]
push 0
lea eax, [ebp - 8]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403c8f
cmp esi, dword [ebp - 8]
jne 0x403c9b
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
push 0
push 0
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x403cc0
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 8]
call fcn.00403790
test eax, eax
je 0x403c7a
xor eax, eax
add dword [ebp + 0xc], esi
adc ebx, eax
add dword [ebp - 0x18], esi
mov esi, 0x8000
adc edi, eax
mov eax, dword [ebp + 0x14]
inc eax
mov dword [ebp + 0x14], eax
cmp eax, dword [ebp - 4]
jb 0x403bc3
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x403b84
push str.SetEndOfFile__
push 0x132
push str.QHImageHlp.c
xor edx, edx
call fcn.00409960
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push str.SetFilePointerEx__
push 0xf9
jmp 0x403c6b
push str.ReadFile__
push 0xfc
jmp 0x403c6b
push 0x4ad8f8
push 0xfe
push str.QHImageHlp.c
mov edx, 1
call fcn.00409d60
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push str.SetFilePointerEx__
push 0x10e
jmp 0x403c6b