joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417d30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x484
mov eax, dword [0x459074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x480], 0
mov dword [ebp - 0x448], 0x44
push 0x40
push 0
lea eax, [ebp - 0x444]
push eax
call fcn.00423990
add esp, 0xc
push 0x400
push 0
lea ecx, [ebp - 0x404]
push ecx
call fcn.00423990
add esp, 0xc
push str.byod_agent
push str.taskkill__f__im___s.exe_
push 0x400
lea edx, [ebp - 0x404]
push edx
call dword [sym.imp.libnac_base.dll_str_snprintf]
add esp, 0x10
mov dword [ebp - 0x41c], 1
xor eax, eax
mov word [ebp - 0x418], ax
lea ecx, [ebp - 0x458]
push ecx
lea edx, [ebp - 0x448]
push edx
push 0
push 0
mov eax, dword [ebp - 0x480]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x404]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x417e61
mov dword [ebp - 0x460], 0x453018
push 0x5c
mov edx, dword [ebp - 0x460]
push edx
call fcn.00423220
add esp, 8
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 0
je 0x417e1f
mov eax, dword [ebp - 0x45c]
add eax, 1
mov dword [ebp - 0x464], eax
jmp 0x417e2b
mov ecx, dword [ebp - 0x460]
mov dword [ebp - 0x464], ecx
lea edx, [ebp - 0x404]
push edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x45307c
push 0xa2
mov eax, dword [ebp - 0x464]
push eax
push 1
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x18
xor ecx, ecx
jne 0x417de4
or eax, 0xffffffff
jmp 0x417f72
push 0xffffffffffffffff
mov edx, dword [ebp - 0x458]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x484], 0
jne 0x417ee8
mov dword [ebp - 0x46c], 0x4530e8
push 0x5c
mov eax, dword [ebp - 0x46c]
push eax
call fcn.00423220
add esp, 8
mov dword [ebp - 0x468], eax
cmp dword [ebp - 0x468], 0
je 0x417eba
mov ecx, dword [ebp - 0x468]
add ecx, 1
mov dword [ebp - 0x470], ecx
jmp 0x417ec6
mov edx, dword [ebp - 0x46c]
mov dword [ebp - 0x470], edx
push str.kill_agent_success
push 0xa8
mov eax, dword [ebp - 0x470]
push eax
push 2
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x10
xor ecx, ecx
jne 0x417e7f
jmp 0x417f56
mov dword [ebp - 0x478], 0x453198
push 0x5c
mov edx, dword [ebp - 0x478]
push edx
call fcn.00423220
add esp, 8
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0
je 0x417f23
mov eax, dword [ebp - 0x474]
add eax, 1
mov dword [ebp - 0x47c], eax
jmp 0x417f2f
mov ecx, dword [ebp - 0x478]
mov dword [ebp - 0x47c], ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x452f04
push 0xab
mov edx, dword [ebp - 0x47c]
push edx
push 1
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x14
xor eax, eax
jne 0x417ee8
mov ecx, dword [ebp - 0x458]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x454]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421720
mov esp, ebp
pop ebp
ret
Function at 0x417f80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x484
mov eax, dword [0x459074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x480], 0
mov dword [ebp - 0x448], 0x44
push 0x40
push 0
lea eax, [ebp - 0x444]
push eax
call fcn.00423990
add esp, 0xc
push 0x400
push 0
lea ecx, [ebp - 0x404]
push ecx
call fcn.00423990
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push str.taskkill__pid___d___f
push 0x400
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.libnac_base.dll_str_snprintf]
add esp, 0x10
mov dword [ebp - 0x41c], 1
xor ecx, ecx
mov word [ebp - 0x418], cx
lea edx, [ebp - 0x458]
push edx
lea eax, [ebp - 0x448]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x480]
push ecx
push 0
push 0
push 0
lea edx, [ebp - 0x404]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4180b0
mov dword [ebp - 0x460], 0x453260
push 0x5c
mov eax, dword [ebp - 0x460]
push eax
call fcn.00423220
add esp, 8
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 0
je 0x41806e
mov ecx, dword [ebp - 0x45c]
add ecx, 1
mov dword [ebp - 0x464], ecx
jmp 0x41807a
mov edx, dword [ebp - 0x460]
mov dword [ebp - 0x464], edx
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4532c4
push 0xc0
mov ecx, dword [ebp - 0x464]
push ecx
push 1
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x18
xor edx, edx
jne 0x418033
or eax, 0xffffffff
jmp 0x4181c5
push 0xffffffffffffffff
mov eax, dword [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x484], 0
jne 0x41813b
mov dword [ebp - 0x46c], 0x453340
push 0x5c
mov ecx, dword [ebp - 0x46c]
push ecx
call fcn.00423220
add esp, 8
mov dword [ebp - 0x468], eax
cmp dword [ebp - 0x468], 0
je 0x418109
mov edx, dword [ebp - 0x468]
add edx, 1
mov dword [ebp - 0x470], edx
jmp 0x418115
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x470], eax
mov ecx, dword [ebp + 8]
push ecx
push str.kill_pid__d_success
push 0xc6
mov edx, dword [ebp - 0x470]
push edx
push 2
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x14
xor eax, eax
jne 0x4180ce
jmp 0x4181a9
mov dword [ebp - 0x478], 0x4533d8
push 0x5c
mov ecx, dword [ebp - 0x478]
push ecx
call fcn.00423220
add esp, 8
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0
je 0x418176
mov edx, dword [ebp - 0x474]
add edx, 1
mov dword [ebp - 0x47c], edx
jmp 0x418182
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x47c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.kill_fail_:__d
push 0xc9
mov ecx, dword [ebp - 0x47c]
push ecx
push 1
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x14
xor edx, edx
jne 0x41813b
mov eax, dword [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x454]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421720
mov esp, ebp
pop ebp
ret
Function at 0x4181e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x67c
mov eax, dword [0x459074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x668], 0x453478
push 0x5c
mov eax, dword [ebp - 0x668]
push eax
call fcn.00423220
add esp, 8
mov dword [ebp - 0x664], eax
cmp dword [ebp - 0x664], 0
je 0x41822e
mov ecx, dword [ebp - 0x664]
add ecx, 1
mov dword [ebp - 0x66c], ecx
jmp 0x41823a
mov edx, dword [ebp - 0x668]
mov dword [ebp - 0x66c], edx
push str.service_not_installed
push 0xd3
mov eax, dword [ebp - 0x66c]
push eax
push 1
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x10
xor ecx, ecx
jne 0x4181f3
mov dword [ebp - 0x67c], 0
mov dword [ebp - 0x650], 0x44
push 0x40
push 0
lea edx, [ebp - 0x64c]
push edx
call fcn.00423990
add esp, 0xc
push 0x400
push 0
lea eax, [ebp - 0x60c]
push eax
call fcn.00423990
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x108]
push ecx
call fcn.00423990
add esp, 0xc
push 0x104
lea edx, [ebp - 0x108]
push edx
push 0x452f9c
call dword [sym.imp.libnac_base.dll_dirutils_path_transform]
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.00423990
add esp, 0xc
push str.byod_monitor
lea ecx, [ebp - 0x108]
push ecx
push str._s_s
push 0x104
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.libnac_base.dll_str_snprintf]
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
push str.__s.exe___install
push 0x400
lea ecx, [ebp - 0x60c]
push ecx
call dword [sym.imp.libnac_base.dll_str_snprintf]
add esp, 0x10
mov dword [ebp - 0x624], 1
xor edx, edx
mov word [ebp - 0x620], dx
lea eax, [ebp - 0x660]
push eax
lea ecx, [ebp - 0x650]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x67c]
push edx
push 0
push 0
push 0
lea eax, [ebp - 0x60c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4183e0
mov dword [ebp - 0x674], 0x453568
push 0x5c
mov ecx, dword [ebp - 0x674]
push ecx
call fcn.00423220
add esp, 8
mov dword [ebp - 0x670], eax
cmp dword [ebp - 0x670], 0
je 0x4183a4
mov edx, dword [ebp - 0x670]
add edx, 1
mov dword [ebp - 0x678], edx
jmp 0x4183b0
mov eax, dword [ebp - 0x674]
mov dword [ebp - 0x678], eax
lea ecx, [ebp - 0x60c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.create_process_failed_with_error__d___cmd:_s_n
push 0xe0
mov edx, dword [ebp - 0x678]
push edx
push 1
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x18
xor eax, eax
jne 0x418369
jmp 0x4183fa
mov ecx, dword [ebp - 0x660]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x65c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421720
mov esp, ebp
pop ebp
ret
Function at 0x418c20
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x459074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x134], 0
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x418cea
mov dword [ebp - 0x13c], 0x453d00
push 0x5c
mov edx, dword [ebp - 0x13c]
push edx
call fcn.00423220
add esp, 8
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
je 0x418caa
mov eax, dword [ebp - 0x138]
add eax, 1
mov dword [ebp - 0x140], eax
jmp 0x418cb6
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x140], ecx
push str.Process32First_failed_
push 0x180
mov edx, dword [ebp - 0x140]
push edx
push 1
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x10
xor eax, eax
jne 0x418c6f
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x418d8a
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x108]
push eax
call fcn.0042a254
add esp, 8
test eax, eax
jne 0x418d2d
mov ecx, dword [ebp - 0x124]
cmp ecx, dword [ebp + 0xc]
je 0x418d2d
mov edx, dword [ebp - 0x124]
mov dword [ebp - 0x134], edx
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x134]
jmp 0x418d8a
lea ecx, [ebp - 0x12c]
push ecx
mov edx, dword [ebp - 0x130]
push edx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x418d77
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.0042a254
add esp, 8
test eax, eax
jne 0x418d75
mov edx, dword [ebp - 0x124]
cmp edx, dword [ebp + 0xc]
je 0x418d75
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x134], eax
jmp 0x418d77
jmp 0x418d2d
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421720
mov esp, ebp
pop ebp
ret
Function at 0x419350
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4193c8
mov dword [ebp - 0x10], 0x454468
push 0x5c
mov eax, dword [ebp - 0x10]
push eax
call fcn.00423220
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x419397
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0x14], ecx
jmp 0x41939d
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Couldnt_open_service_manager_:__d
push 0x1f1
mov eax, dword [ebp - 0x14]
push eax
push 1
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x14
xor ecx, ecx
jne 0x41936e
xor eax, eax
jmp 0x41951a
push 0x10000
push str.byod_monitor
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x419449
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x1c], 0x4544d8
push 0x5c
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00423220
add esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x419418
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x20], edx
jmp 0x41941e
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Couldnt_open_service_:__d
push 0x1f8
mov ecx, dword [ebp - 0x20]
push ecx
push 1
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x14
xor edx, edx
jne 0x4193ef
xor eax, eax
jmp 0x41951a
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x3c], 0
je 0x4194be
mov dword [ebp - 0x28], 0x454550
push 0x5c
mov eax, dword [ebp - 0x28]
push eax
call fcn.00423220
add esp, 8
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x419499
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x2c], ecx
jmp 0x41949f
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edx
push str.service_delete_success
push 0x200
mov eax, dword [ebp - 0x2c]
push eax
push 2
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x10
xor ecx, ecx
jne 0x419470
jmp 0x419515
mov dword [ebp - 0x34], 0x4545c8
push 0x5c
mov edx, dword [ebp - 0x34]
push edx
call fcn.00423220
add esp, 8
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x4194e7
mov eax, dword [ebp - 0x30]
add eax, 1
mov dword [ebp - 0x38], eax
jmp 0x4194ed
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x38], ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Couldnt_delete_service_:__d
push 0x203
mov edx, dword [ebp - 0x38]
push edx
push 1
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x14
xor eax, eax
jne 0x4194be
xor eax, eax
jmp 0x41951a
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x41a770
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, 1
test eax, eax
je 0x41a88e
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 0
je 0x41a7a8
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0041b1d0
jmp 0x41a8a2
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
call fcn.0041c500
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x41a83c
jg 0x41a7d0
cmp dword [ebp + 0xc], 0
jbe 0x41a83c
cmp dword [ebp - 8], 0
jl 0x41a83c
jg 0x41a7de
cmp dword [ebp - 0xc], 0
jbe 0x41a83c
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jg 0x41a7fc
jl 0x41a7f0
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0xc]
jae 0x41a7fc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.0041c700
push eax
call fcn.00415ea0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x10]
sbb eax, dword [ebp - 8]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0041c580
cmp dword [ebp + 0x10], 0
jl 0x41a87e
jg 0x41a84a
cmp dword [ebp + 0xc], 0
jbe 0x41a87e
mov edx, dword [ebp - 4]
cmp dword [edx + 0x4c], 0
je 0x41a87e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0042ad9e
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
jmp 0x41a8a2
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.0041b1d0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41a8b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, 1
test eax, eax
je 0x41a9d6
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 0
je 0x41a8e8
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0041b2f0
jmp 0x41a9ea
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
call fcn.0041c5c0
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x41a97c
jg 0x41a910
cmp dword [ebp + 0xc], 0
jbe 0x41a97c
cmp dword [ebp - 8], 0
jl 0x41a97c
jg 0x41a91e
cmp dword [ebp - 0xc], 0
jbe 0x41a97c
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jg 0x41a93c
jl 0x41a930
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0xc]
jae 0x41a93c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 4]
call fcn.0041c720
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00415ea0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x10]
sbb eax, dword [ebp - 8]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0041c6a0
cmp dword [ebp + 0x10], 0
jl 0x41a9c6
jg 0x41a98a
cmp dword [ebp + 0xc], 0
jbe 0x41a9c6
mov edx, dword [ebp - 4]
cmp dword [edx + 0x4c], 0
je 0x41a9c6
mov ecx, dword [ebp - 4]
call fcn.0041bfd0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0042afeb
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
jmp 0x41a9ea
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.0041b2f0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41ae60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x459074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov dword [ebp - 0x38], ecx
call fcn.00415f90
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x4c]
push ecx
call fcn.00415f10
add esp, 8
movzx edx, al
test edx, edx
je 0x41aea5
lea eax, [ebp + 8]
push eax
call fcn.00415f40
add esp, 4
jmp 0x41b026
mov ecx, dword [ebp - 0x38]
call fcn.0041c700
test eax, eax
je 0x41aee7
mov ecx, dword [ebp - 0x38]
call fcn.0041c700
mov esi, eax
mov ecx, dword [ebp - 0x38]
call fcn.0041c680
cmp esi, eax
jae 0x41aee7
lea ecx, [ebp + 8]
push ecx
call fcn.00415ef0
add esp, 4
mov bl, al
mov ecx, dword [ebp - 0x38]
call fcn.0041c530
mov byte [eax], bl
mov eax, dword [ebp + 8]
jmp 0x41b026
mov edx, dword [ebp - 0x38]
cmp dword [edx + 0x4c], 0
jne 0x41aefa
call fcn.00415f90
jmp 0x41b026
mov ecx, dword [ebp - 0x38]
call fcn.0041bfd0
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x38], 0
jne 0x41af49
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x4c]
push edx
lea eax, [ebp + 8]
push eax
call fcn.00415ef0
add esp, 4
movzx ecx, al
push ecx
call fcn.00417710
add esp, 8
movzx edx, al
test edx, edx
je 0x41af39
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
jmp 0x41af41
call fcn.00415f90
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
jmp 0x41b026
mov dword [ebp - 0x50], 0x20
lea ecx, [ebp + 8]
push ecx
call fcn.00415ef0
add esp, 4
mov byte [ebp - 0x2a], al
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x29]
push eax
lea ecx, [ebp - 0x2a]
push ecx
mov edx, dword [ebp - 0x38]
add edx, 0x40
push edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x38]
call fcn.0041b7b0
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x41b021
cmp dword [ebp - 0x3c], 1
jle 0x41afa4
cmp dword [ebp - 0x3c], 3
je 0x41aff1
jmp 0x41b021
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x40], ecx
je 0x41afd6
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x40]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.0042ad9e
add esp, 0x10
cmp dword [ebp - 0x40], eax
je 0x41afd6
call fcn.00415f90
jmp 0x41b026
mov ecx, dword [ebp - 0x38]
mov byte [ecx + 0x3d], 1
lea edx, [ebp - 0x2a]
cmp dword [ebp - 0x34], edx
je 0x41afea
mov eax, dword [ebp + 8]
jmp 0x41b026
call fcn.00415f90
jmp 0x41b026
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
movzx edx, byte [ebp - 0x2a]
push edx
call fcn.00417710
add esp, 8
movzx eax, al
test eax, eax
je 0x41b014
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x48], ecx
jmp 0x41b01c
call fcn.00415f90
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
jmp 0x41b026
call fcn.00415f90
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421720
mov esp, ebp
pop ebp
ret 4
Function at 0x41c060
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x459074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x38], 0
je 0x41c087
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x41c08e
mov al, 1
jmp 0x41c162
call fcn.00415f90
push eax
mov eax, dword [ebp - 0x30]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x30]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x40], eax
call fcn.00415f90
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x44]
push edx
call fcn.00415f10
add esp, 8
movzx eax, al
test eax, eax
je 0x41c0ca
xor al, al
jmp 0x41c162
mov dword [ebp - 0x48], 0x20
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x30]
mov ecx, dword [edx + 0x38]
call fcn.0041c8c0
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x41c106
cmp dword [ebp - 0x34], 1
je 0x41c10d
cmp dword [ebp - 0x34], 3
je 0x41c15c
jmp 0x41c160
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x3d], 0
mov ecx, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x38], ecx
je 0x41c13c
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.0042ad9e
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x41c13c
xor al, al
jmp 0x41c162
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x41c150
mov dword [ebp - 0x3c], 1
jmp 0x41c157
mov dword [ebp - 0x3c], 0
mov al, byte [ebp - 0x3c]
jmp 0x41c162
mov al, 1
jmp 0x41c162
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421720
mov esp, ebp
pop ebp
ret