joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4181e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x484
mov eax, dword [0x45a074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x480], 0
mov dword [ebp - 0x448], 0x44
push 0x40
push 0
lea eax, [ebp - 0x444]
push eax
call fcn.00423e70
add esp, 0xc
push 0x400
push 0
lea ecx, [ebp - 0x404]
push ecx
call fcn.00423e70
add esp, 0xc
push str.byod_agent
push str.taskkill__f__im___s.exe_
push 0x400
lea edx, [ebp - 0x404]
push edx
call dword [sym.imp.libnac_base.dll_str_snprintf]
add esp, 0x10
mov dword [ebp - 0x41c], 1
xor eax, eax
mov word [ebp - 0x418], ax
lea ecx, [ebp - 0x458]
push ecx
lea edx, [ebp - 0x448]
push edx
push 0
push 0
mov eax, dword [ebp - 0x480]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x404]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x418311
mov dword [ebp - 0x460], 0x454178
push 0x5c
mov edx, dword [ebp - 0x460]
push edx
call fcn.00423700
add esp, 8
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 0
je 0x4182cf
mov eax, dword [ebp - 0x45c]
add eax, 1
mov dword [ebp - 0x464], eax
jmp 0x4182db
mov ecx, dword [ebp - 0x460]
mov dword [ebp - 0x464], ecx
lea edx, [ebp - 0x404]
push edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4541d8
push 0xa3
mov eax, dword [ebp - 0x464]
push eax
push 1
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x18
xor ecx, ecx
jne 0x418294
or eax, 0xffffffff
jmp 0x418422
push 0xffffffffffffffff
mov edx, dword [ebp - 0x458]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x484], 0
jne 0x418398
mov dword [ebp - 0x46c], 0x454208
push 0x5c
mov eax, dword [ebp - 0x46c]
push eax
call fcn.00423700
add esp, 8
mov dword [ebp - 0x468], eax
cmp dword [ebp - 0x468], 0
je 0x41836a
mov ecx, dword [ebp - 0x468]
add ecx, 1
mov dword [ebp - 0x470], ecx
jmp 0x418376
mov edx, dword [ebp - 0x46c]
mov dword [ebp - 0x470], edx
push str.kill_agent_success
push 0xa9
mov eax, dword [ebp - 0x470]
push eax
push 2
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x10
xor ecx, ecx
jne 0x41832f
jmp 0x418406
mov dword [ebp - 0x478], 0x454268
push 0x5c
mov edx, dword [ebp - 0x478]
push edx
call fcn.00423700
add esp, 8
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0
je 0x4183d3
mov eax, dword [ebp - 0x474]
add eax, 1
mov dword [ebp - 0x47c], eax
jmp 0x4183df
mov ecx, dword [ebp - 0x478]
mov dword [ebp - 0x47c], ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4542c8
push 0xac
mov edx, dword [ebp - 0x47c]
push edx
push 1
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x14
xor eax, eax
jne 0x418398
mov ecx, dword [ebp - 0x458]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x454]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421c00
mov esp, ebp
pop ebp
ret
Function at 0x418430
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x484
mov eax, dword [0x45a074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x480], 0
mov dword [ebp - 0x448], 0x44
push 0x40
push 0
lea eax, [ebp - 0x444]
push eax
call fcn.00423e70
add esp, 0xc
push 0x400
push 0
lea ecx, [ebp - 0x404]
push ecx
call fcn.00423e70
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push str.taskkill__pid___d___f
push 0x400
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.libnac_base.dll_str_snprintf]
add esp, 0x10
mov dword [ebp - 0x41c], 1
xor ecx, ecx
mov word [ebp - 0x418], cx
lea edx, [ebp - 0x458]
push edx
lea eax, [ebp - 0x448]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x480]
push ecx
push 0
push 0
push 0
lea edx, [ebp - 0x404]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x418560
mov dword [ebp - 0x460], 0x4542f0
push 0x5c
mov eax, dword [ebp - 0x460]
push eax
call fcn.00423700
add esp, 8
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 0
je 0x41851e
mov ecx, dword [ebp - 0x45c]
add ecx, 1
mov dword [ebp - 0x464], ecx
jmp 0x41852a
mov edx, dword [ebp - 0x460]
mov dword [ebp - 0x464], edx
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x454350
push 0xc1
mov ecx, dword [ebp - 0x464]
push ecx
push 1
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x18
xor edx, edx
jne 0x4184e3
or eax, 0xffffffff
jmp 0x418675
push 0xffffffffffffffff
mov eax, dword [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x484], 0
jne 0x4185eb
mov dword [ebp - 0x46c], 0x454380
push 0x5c
mov ecx, dword [ebp - 0x46c]
push ecx
call fcn.00423700
add esp, 8
mov dword [ebp - 0x468], eax
cmp dword [ebp - 0x468], 0
je 0x4185b9
mov edx, dword [ebp - 0x468]
add edx, 1
mov dword [ebp - 0x470], edx
jmp 0x4185c5
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x470], eax
mov ecx, dword [ebp + 8]
push ecx
push str.kill_pid__d_success
push 0xc7
mov edx, dword [ebp - 0x470]
push edx
push 2
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x14
xor eax, eax
jne 0x41857e
jmp 0x418659
mov dword [ebp - 0x478], 0x4543e0
push 0x5c
mov ecx, dword [ebp - 0x478]
push ecx
call fcn.00423700
add esp, 8
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0
je 0x418626
mov edx, dword [ebp - 0x474]
add edx, 1
mov dword [ebp - 0x47c], edx
jmp 0x418632
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x47c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.kill_fail_:__d
push 0xca
mov ecx, dword [ebp - 0x47c]
push ecx
push 1
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x14
xor edx, edx
jne 0x4185eb
mov eax, dword [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x454]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421c00
mov esp, ebp
pop ebp
ret
Function at 0x418690
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x67c
mov eax, dword [0x45a074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x668], 0x454450
push 0x5c
mov eax, dword [ebp - 0x668]
push eax
call fcn.00423700
add esp, 8
mov dword [ebp - 0x664], eax
cmp dword [ebp - 0x664], 0
je 0x4186de
mov ecx, dword [ebp - 0x664]
add ecx, 1
mov dword [ebp - 0x66c], ecx
jmp 0x4186ea
mov edx, dword [ebp - 0x668]
mov dword [ebp - 0x66c], edx
push str.service_not_installed
push 0xd4
mov eax, dword [ebp - 0x66c]
push eax
push 1
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x10
xor ecx, ecx
jne 0x4186a3
mov dword [ebp - 0x67c], 0
mov dword [ebp - 0x650], 0x44
push 0x40
push 0
lea edx, [ebp - 0x64c]
push edx
call fcn.00423e70
add esp, 0xc
push 0x400
push 0
lea eax, [ebp - 0x60c]
push eax
call fcn.00423e70
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x108]
push ecx
call fcn.00423e70
add esp, 0xc
push 0x104
lea edx, [ebp - 0x108]
push edx
push 0x453d44
call dword [sym.imp.libnac_base.dll_dirutils_path_transform]
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.00423e70
add esp, 0xc
push str.byod_monitor
lea ecx, [ebp - 0x108]
push ecx
push str._s_s
push 0x104
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.libnac_base.dll_str_snprintf]
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
push str.__s.exe___install
push 0x400
lea ecx, [ebp - 0x60c]
push ecx
call dword [sym.imp.libnac_base.dll_str_snprintf]
add esp, 0x10
mov dword [ebp - 0x624], 1
xor edx, edx
mov word [ebp - 0x620], dx
lea eax, [ebp - 0x660]
push eax
lea ecx, [ebp - 0x650]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x67c]
push edx
push 0
push 0
push 0
lea eax, [ebp - 0x60c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x418890
mov dword [ebp - 0x674], 0x4544d0
push 0x5c
mov ecx, dword [ebp - 0x674]
push ecx
call fcn.00423700
add esp, 8
mov dword [ebp - 0x670], eax
cmp dword [ebp - 0x670], 0
je 0x418854
mov edx, dword [ebp - 0x670]
add edx, 1
mov dword [ebp - 0x678], edx
jmp 0x418860
mov eax, dword [ebp - 0x674]
mov dword [ebp - 0x678], eax
lea ecx, [ebp - 0x60c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.create_process_failed_with_error__d___cmd:_s_n
push 0xe1
mov edx, dword [ebp - 0x678]
push edx
push 1
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x18
xor eax, eax
jne 0x418819
jmp 0x4188aa
mov ecx, dword [ebp - 0x660]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x65c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421c00
mov esp, ebp
pop ebp
ret
Function at 0x419100
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x45a074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x134], 0
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x4191ca
mov dword [ebp - 0x13c], 0x454b70
push 0x5c
mov edx, dword [ebp - 0x13c]
push edx
call fcn.00423700
add esp, 8
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
je 0x41918a
mov eax, dword [ebp - 0x138]
add eax, 1
mov dword [ebp - 0x140], eax
jmp 0x419196
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x140], ecx
push str.Process32First_failed_
push 0x183
mov edx, dword [ebp - 0x140]
push edx
push 1
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x10
xor eax, eax
jne 0x41914f
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x41926a
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x108]
push eax
call fcn.0042a928
add esp, 8
test eax, eax
jne 0x41920d
mov ecx, dword [ebp - 0x124]
cmp ecx, dword [ebp + 0xc]
je 0x41920d
mov edx, dword [ebp - 0x124]
mov dword [ebp - 0x134], edx
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x134]
jmp 0x41926a
lea ecx, [ebp - 0x12c]
push ecx
mov edx, dword [ebp - 0x130]
push edx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x419257
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.0042a928
add esp, 8
test eax, eax
jne 0x419255
mov edx, dword [ebp - 0x124]
cmp edx, dword [ebp + 0xc]
je 0x419255
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x134], eax
jmp 0x419257
jmp 0x41920d
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421c00
mov esp, ebp
pop ebp
ret
Function at 0x419830
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4198a8
mov dword [ebp - 0x10], 0x4551e8
push 0x5c
mov eax, dword [ebp - 0x10]
push eax
call fcn.00423700
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x419877
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0x14], ecx
jmp 0x41987d
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Couldnt_open_service_manager_:__d
push 0x1f4
mov eax, dword [ebp - 0x14]
push eax
push 1
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x14
xor ecx, ecx
jne 0x41984e
xor eax, eax
jmp 0x4199fa
push 0x10000
push str.byod_monitor
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x419929
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x1c], 0x455248
push 0x5c
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00423700
add esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4198f8
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x20], edx
jmp 0x4198fe
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Couldnt_open_service_:__d
push 0x1fb
mov ecx, dword [ebp - 0x20]
push ecx
push 1
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x14
xor edx, edx
jne 0x4198cf
xor eax, eax
jmp 0x4199fa
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x3c], 0
je 0x41999e
mov dword [ebp - 0x28], 0x4552e0
push 0x5c
mov eax, dword [ebp - 0x28]
push eax
call fcn.00423700
add esp, 8
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x419979
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x2c], ecx
jmp 0x41997f
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edx
push str.service_delete_success
push 0x203
mov eax, dword [ebp - 0x2c]
push eax
push 2
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x10
xor ecx, ecx
jne 0x419950
jmp 0x4199f5
mov dword [ebp - 0x34], 0x455358
push 0x5c
mov edx, dword [ebp - 0x34]
push edx
call fcn.00423700
add esp, 8
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x4199c7
mov eax, dword [ebp - 0x30]
add eax, 1
mov dword [ebp - 0x38], eax
jmp 0x4199cd
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x38], ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Couldnt_delete_service_:__d
push 0x206
mov edx, dword [ebp - 0x38]
push edx
push 1
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x14
xor eax, eax
jne 0x41999e
xor eax, eax
jmp 0x4199fa
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x41ac50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, 1
test eax, eax
je 0x41ad6e
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 0
je 0x41ac88
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0041b6b0
jmp 0x41ad82
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
call fcn.0041c9e0
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x41ad1c
jg 0x41acb0
cmp dword [ebp + 0xc], 0
jbe 0x41ad1c
cmp dword [ebp - 8], 0
jl 0x41ad1c
jg 0x41acbe
cmp dword [ebp - 0xc], 0
jbe 0x41ad1c
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jg 0x41acdc
jl 0x41acd0
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0xc]
jae 0x41acdc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.0041cbe0
push eax
call fcn.00416250
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x10]
sbb eax, dword [ebp - 8]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0041ca60
cmp dword [ebp + 0x10], 0
jl 0x41ad5e
jg 0x41ad2a
cmp dword [ebp + 0xc], 0
jbe 0x41ad5e
mov edx, dword [ebp - 4]
cmp dword [edx + 0x4c], 0
je 0x41ad5e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0042b472
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
jmp 0x41ad82
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.0041b6b0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41ad90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, 1
test eax, eax
je 0x41aeb6
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 0
je 0x41adc8
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0041b7d0
jmp 0x41aeca
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
call fcn.0041caa0
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x41ae5c
jg 0x41adf0
cmp dword [ebp + 0xc], 0
jbe 0x41ae5c
cmp dword [ebp - 8], 0
jl 0x41ae5c
jg 0x41adfe
cmp dword [ebp - 0xc], 0
jbe 0x41ae5c
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jg 0x41ae1c
jl 0x41ae10
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0xc]
jae 0x41ae1c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 4]
call fcn.0041cc00
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00416250
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x10]
sbb eax, dword [ebp - 8]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0041cb80
cmp dword [ebp + 0x10], 0
jl 0x41aea6
jg 0x41ae6a
cmp dword [ebp + 0xc], 0
jbe 0x41aea6
mov edx, dword [ebp - 4]
cmp dword [edx + 0x4c], 0
je 0x41aea6
mov ecx, dword [ebp - 4]
call fcn.0041c4b0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0042b6bf
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
jmp 0x41aeca
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.0041b7d0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41b340
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x45a074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov dword [ebp - 0x38], ecx
call fcn.00416340
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x4c]
push ecx
call fcn.004162c0
add esp, 8
movzx edx, al
test edx, edx
je 0x41b385
lea eax, [ebp + 8]
push eax
call fcn.004162f0
add esp, 4
jmp 0x41b506
mov ecx, dword [ebp - 0x38]
call fcn.0041cbe0
test eax, eax
je 0x41b3c7
mov ecx, dword [ebp - 0x38]
call fcn.0041cbe0
mov esi, eax
mov ecx, dword [ebp - 0x38]
call fcn.0041cb60
cmp esi, eax
jae 0x41b3c7
lea ecx, [ebp + 8]
push ecx
call fcn.004162a0
add esp, 4
mov bl, al
mov ecx, dword [ebp - 0x38]
call fcn.0041ca10
mov byte [eax], bl
mov eax, dword [ebp + 8]
jmp 0x41b506
mov edx, dword [ebp - 0x38]
cmp dword [edx + 0x4c], 0
jne 0x41b3da
call fcn.00416340
jmp 0x41b506
mov ecx, dword [ebp - 0x38]
call fcn.0041c4b0
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x38], 0
jne 0x41b429
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x4c]
push edx
lea eax, [ebp + 8]
push eax
call fcn.004162a0
add esp, 4
movzx ecx, al
push ecx
call fcn.00417ac0
add esp, 8
movzx edx, al
test edx, edx
je 0x41b419
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
jmp 0x41b421
call fcn.00416340
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
jmp 0x41b506
mov dword [ebp - 0x50], 0x20
lea ecx, [ebp + 8]
push ecx
call fcn.004162a0
add esp, 4
mov byte [ebp - 0x2a], al
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x29]
push eax
lea ecx, [ebp - 0x2a]
push ecx
mov edx, dword [ebp - 0x38]
add edx, 0x40
push edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x38]
call fcn.0041bc90
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x41b501
cmp dword [ebp - 0x3c], 1
jle 0x41b484
cmp dword [ebp - 0x3c], 3
je 0x41b4d1
jmp 0x41b501
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x40], ecx
je 0x41b4b6
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x40]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.0042b472
add esp, 0x10
cmp dword [ebp - 0x40], eax
je 0x41b4b6
call fcn.00416340
jmp 0x41b506
mov ecx, dword [ebp - 0x38]
mov byte [ecx + 0x3d], 1
lea edx, [ebp - 0x2a]
cmp dword [ebp - 0x34], edx
je 0x41b4ca
mov eax, dword [ebp + 8]
jmp 0x41b506
call fcn.00416340
jmp 0x41b506
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
movzx edx, byte [ebp - 0x2a]
push edx
call fcn.00417ac0
add esp, 8
movzx eax, al
test eax, eax
je 0x41b4f4
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x48], ecx
jmp 0x41b4fc
call fcn.00416340
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
jmp 0x41b506
call fcn.00416340
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421c00
mov esp, ebp
pop ebp
ret 4
Function at 0x41c540
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x45a074]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x38], 0
je 0x41c567
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x41c56e
mov al, 1
jmp 0x41c642
call fcn.00416340
push eax
mov eax, dword [ebp - 0x30]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x30]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x40], eax
call fcn.00416340
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x44]
push edx
call fcn.004162c0
add esp, 8
movzx eax, al
test eax, eax
je 0x41c5aa
xor al, al
jmp 0x41c642
mov dword [ebp - 0x48], 0x20
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x30]
mov ecx, dword [edx + 0x38]
call fcn.0041cda0
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x41c5e6
cmp dword [ebp - 0x34], 1
je 0x41c5ed
cmp dword [ebp - 0x34], 3
je 0x41c63c
jmp 0x41c640
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x3d], 0
mov ecx, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x38], ecx
je 0x41c61c
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.0042b472
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x41c61c
xor al, al
jmp 0x41c642
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x41c630
mov dword [ebp - 0x3c], 1
jmp 0x41c637
mov dword [ebp - 0x3c], 0
mov al, byte [ebp - 0x3c]
jmp 0x41c642
mov al, 1
jmp 0x41c642
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421c00
mov esp, ebp
pop ebp
ret