joyce8/EMBER2024-capa huggingface dataset:
Function at 0x20e05a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
mov dword [esp + 0x20], 0x6d293b
mov dword [esp + 0x24], 0x468ef5
push ebx
push ebp
push esi
push edi
xor edi, edi
mov esi, edx
mov dword [esp + 0x38], edi
xor edx, edx
mov dword [esp + 0x3c], edi
mov ebp, ecx
mov dword [esp + 0x18], 0x7b4e
add dword [esp + 0x18], 0xffff3b83
add dword [esp + 0x18], 0xffffa7a8
xor dword [esp + 0x18], 0xffff5e78
mov dword [esp + 0x2c], 0xb6a1
mov eax, dword [esp + 0x2c]
push 0x38
pop ecx
div ecx
push 0xe
mov dword [esp + 0x30], eax
xor edx, edx
xor dword [esp + 0x30], 0x7f71
mov dword [esp + 0x18], 0x997f
xor dword [esp + 0x18], 0xba9196e9
xor dword [esp + 0x18], 0x66374254
mov eax, dword [esp + 0x18]
pop ecx
div ecx
push 0x42
mov dword [esp + 0x18], eax
xor edx, edx
xor dword [esp + 0x18], 0xfc29c0d
mov dword [esp + 0x14], 0x4c26
or dword [esp + 0x14], 0xfd76fef6
shr dword [esp + 0x14], 3
xor dword [esp + 0x14], 0x1faed217
mov dword [esp + 0x2c], 0xc5b2
imul eax, dword [esp + 0x2c], 0x67
pop ecx
push 6
mov dword [esp + 0x2c], eax
shl dword [esp + 0x2c], 9
xor dword [esp + 0x2c], 0x9f1566f7
mov dword [esp + 0x28], 0x55d
shl dword [esp + 0x28], 0xb
mov eax, dword [esp + 0x28]
div ecx
xor edx, edx
mov dword [esp + 0x28], eax
xor dword [esp + 0x28], 0xf55e
mov dword [esp + 0x24], 0x8f6f
imul eax, dword [esp + 0x24], 0x4f
pop ecx
mov dword [esp + 0x20], eax
add dword [esp + 0x20], 0xffffe8fc
xor dword [esp + 0x20], 0x2c0f4c
mov dword [esp + 0x1c], 0xd672
mov eax, dword [esp + 0x1c]
div ecx
mov dword [esp + 0x1c], eax
add dword [esp + 0x1c], 0xffffc0a7
xor dword [esp + 0x1c], 0xffffa997
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + eax*8 + 0x78]
test ecx, ecx
je 0x20e21c
cmp dword [esi + eax*8 + 0x7c], edi
je 0x20e21c
lea esi, [ecx + ebp]
jmp 0x20e215
push dword [esp + 0x10]
lea ecx, [eax + ebp]
push dword [esp + 0x18]
mov edx, dword [esp + 0x34]
call fcn.00214aaf
pop ecx
pop ecx
mov ecx, eax
mov dword [esp + 0x18], ecx
test ecx, ecx
je 0x20e227
mov edi, dword [esi]
mov ebx, dword [esi + 0x10]
add edi, ebp
add ebx, ebp
jmp 0x20e20c
jns 0x20e1dd
movzx eax, ax
jmp 0x20e1e2
add eax, 2
add eax, ebp
push eax
push ecx
push dword [esp + 0x24]
push dword [esp + 0x2c]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
call fcn.00206228
add esp, 0x10
test eax, eax
je 0x20e227
mov ecx, dword [esp + 0x18]
add edi, 4
mov dword [ebx], eax
add ebx, 4
mov eax, dword [edi]
test eax, eax
jne 0x20e1d6
add esi, 0x14
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x20e1ab
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
xor eax, eax
jmp 0x20e21f
Function at 0x20f85d
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
mov eax, 0x21c7c0
push ebp
push edi
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push ebx
push edx
push eax
call fcn.0020602b
push ebx
push eax
call fcn.0020602b
mov dword [esp + 0x30], 0xa7d7
xor edx, edx
imul eax, dword [esp + 0x30], 0x38
push 0x44
pop ecx
mov dword [esp + 0x30], eax
imul eax, dword [esp + 0x30], 0x2d
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
div ecx
mov dword [esp + 0x30], eax
xor dword [esp + 0x30], 0x18010b
mov dword [esp + 0x34], 0x525c
or dword [esp + 0x34], 0x8a511e96
xor dword [esp + 0x34], 0x8a51741b
mov dword [esp + 0x2c], 0xdf8c
shl dword [esp + 0x2c], 4
imul eax, dword [esp + 0x2c], 0x5b
mov dword [esp + 0x2c], eax
imul eax, dword [esp + 0x2c], 0x24
mov dword [esp + 0x2c], eax
xor dword [esp + 0x2c], 0xb2cb278b
mov eax, dword [0x21c7c0]
mov edx, dword [0x21c7c4]
xor edx, eax
mov dword [esp + 0x38], eax
mov eax, edx
mov dword [esp + 0x3c], edx
and eax, 0xfffffffc
mov ecx, edx
add eax, 4
mov edi, edx
and cl, 3
cmovne edi, eax
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
add esp, 0x18
mov eax, dword [esp + 0x18]
mov ecx, edi
call fcn.00208736
mov ebp, eax
pop ecx
pop ecx
test ebp, ebp
je 0x20f983
shr edi, 2
xor eax, eax
push esi
mov esi, 0x21c7c8
lea ecx, [edi*4 + 0x21c7c8]
xor edi, edi
mov edx, ecx
sub edx, esi
add edx, 3
shr edx, 2
cmp ecx, esi
cmovb edx, eax
test edx, edx
je 0x20f978
mov ecx, ebp
sub ecx, esi
mov eax, dword [esi]
xor eax, dword [esp + 0x1c]
inc edi
mov dword [ecx + esi], eax
lea esi, [esi + 4]
cmp edi, edx
jb 0x20f967
pop esi
test ebx, ebx
je 0x20f983
mov eax, dword [esp + 0x1c]
mov dword [ebx], eax
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x210126
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
push edi
push dword [esp + 0x3c]
push ebp
push edx
push ecx
call fcn.0020602b
mov dword [esp + 0x34], 0x549fa2
xor esi, esi
mov dword [esp + 0x38], 0x3101fe
add esp, 0x10
mov dword [esp + 0x2c], 0x619cf0
xor edx, edx
mov dword [esp + 0x30], esi
mov edi, esi
mov dword [esp + 0x10], 0x967d
xor dword [esp + 0x10], 0xcc63c068
add dword [esp + 0x10], 0x1ff
shl dword [esp + 0x10], 1
xor dword [esp + 0x10], 0x98c69dd6
mov dword [esp + 0x38], 0xb8e5
shr dword [esp + 0x38], 8
shr dword [esp + 0x38], 0xc
mov eax, dword [esp + 0x38]
push 0x78
pop ecx
div ecx
mov dword [esp + 0x38], eax
xor dword [esp + 0x38], 0x1898
mov eax, dword [ebp + 0x3c]
mov dword [esp + 0x20], eax
mov ebx, dword [eax + ebp + 0x78]
add ebx, ebp
mov eax, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x20]
add eax, ebp
mov dword [esp + 0x1c], eax
add ecx, ebp
mov eax, dword [ebx + 0x24]
add eax, ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp dword [ebx + 0x18], esi
jbe 0x210230
mov edx, dword [ecx + edi*4]
push dword [esp + 0x38]
mov ecx, dword [esp + 0x14]
add edx, ebp
call fcn.00218634
xor eax, 0x762b677b
pop ecx
cmp eax, dword [esp + 0x3c]
je 0x210204
mov ecx, dword [esp + 0x14]
inc edi
cmp edi, dword [ebx + 0x18]
jb 0x2101da
jmp 0x210230
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
movzx eax, word [eax + edi*2]
mov esi, dword [esi + eax*4]
add esi, ebp
cmp esi, ebx
jb 0x210230
mov eax, dword [esp + 0x20]
mov eax, dword [eax + ebp + 0x7c]
add eax, ebx
cmp esi, eax
jae 0x210230
mov ecx, esi
call fcn.00218adc
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x213811
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push dword [ebp + 0x14]
mov esi, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push edx
push ecx
call fcn.0020602b
and dword [ebp - 0xc], 0
add esp, 0x18
and dword [ebp - 8], 0
mov dword [ebp - 0x10], 0x430482
mov dword [ebp - 4], 0xa9de
shr dword [ebp - 4], 3
imul eax, dword [ebp - 4], 0x35
mov dword [ebp - 4], eax
xor dword [ebp - 4], 0x4643c
cmp ecx, 0x40
jae 0x213860
xor eax, eax
jmp 0x213885
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x21385c
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x21385c
movzx edx, word [eax + 0x18]
xor esi, esi
mov ecx, dword [ebp - 4]
cmp edx, ecx
cmovne eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x216965
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
push dword [esp + 0x3c]
mov ebx, edx
mov edx, ecx
push dword [esp + 0x3c]
mov dword [esp + 0x24], edx
push ebx
push edx
call fcn.0020602b
mov dword [esp + 0x3c], 0x1d278d
xor esi, esi
mov dword [esp + 0x40], esi
add esp, 0x10
mov dword [esp + 0x10], 0x8ea6
mov ebp, esi
imul eax, dword [esp + 0x10], 0xf
mov dword [esp + 0x10], eax
add dword [esp + 0x10], 0xfbcc
xor dword [esp + 0x10], 0x50c7df06
xor dword [esp + 0x10], 0x50ced575
mov dword [esp + 0x14], 0x5d4
xor dword [esp + 0x14], 0x5075cd52
add dword [esp + 0x14], 0xffffa7e1
xor dword [esp + 0x14], 0x507554a4
mov eax, dword [ebx + 0x3c]
mov dword [esp + 0x28], eax
mov edi, dword [eax + ebx + 0x78]
add edi, ebx
mov eax, dword [edi + 0x1c]
mov ecx, dword [edi + 0x20]
add eax, ebx
mov dword [esp + 0x24], eax
add ecx, ebx
mov eax, dword [edi + 0x24]
add eax, ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], eax
cmp dword [edi + 0x18], esi
jbe 0x216a5b
mov eax, dword [ecx + ebp*4]
add eax, ebx
push eax
push dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
call fcn.002141c0
pop ecx
pop ecx
test eax, eax
je 0x216a35
mov ecx, dword [esp + 0x18]
inc ebp
mov edx, dword [esp + 0x1c]
cmp ebp, dword [edi + 0x18]
jb 0x216a0c
jmp 0x216a5b
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
movzx eax, word [eax + ebp*2]
mov esi, dword [esi + eax*4]
add esi, ebx
cmp esi, edi
jb 0x216a5b
mov ecx, dword [esp + 0x28]
xor eax, eax
mov ecx, dword [ecx + ebx + 0x7c]
add ecx, edi
cmp esi, ecx
cmovb esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x218634
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push dword [ebp + 8]
mov ebx, edx
push ebx
push ecx
call fcn.0020602b
and dword [ebp - 0xc], 0
add esp, 0xc
mov dword [ebp - 0x14], 0x35e2df
mov dword [ebp - 0x10], 0x52290
mov dword [ebp - 4], 0xdbb2
xor dword [ebp - 4], 0xd5385f4b
xor dword [ebp - 4], 0xd53884f9
mov dword [ebp - 8], 0x6576
add dword [ebp - 8], 0xfffffa8c
or dword [ebp - 8], 0x95d8e2a6
xor dword [ebp - 8], 0x95d8e2a0
mov dword [ebp - 8], 0xe475
shr dword [ebp - 8], 9
xor dword [ebp - 8], 0x62
cmp byte [ebx], 0
je 0x2186f8
push esi
push edi
mov edi, dword [ebp - 4]
mov dword [ebp - 8], 0x6576
add dword [ebp - 8], 0xfffffa8c
or dword [ebp - 8], 0x95d8e2a6
xor dword [ebp - 8], 0x95d8e2a0
mov cl, byte [ebp - 8]
mov esi, dword [ebp - 4]
mov dword [ebp - 8], 0xe475
shr dword [ebp - 8], 9
xor dword [ebp - 8], 0x62
shl esi, cl
mov cl, byte [ebp - 8]
mov edx, dword [ebp - 4]
movsx eax, byte [ebx]
mov dword [ebp - 4], eax
add dword [ebp - 4], esi
shl edx, cl
add dword [ebp - 4], edx
sub dword [ebp - 4], edi
inc ebx
cmp byte [ebx], 0
jne 0x2186a3
pop edi
pop esi
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x21878f
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push esi
push edi
push eax
push dword [esp + 0x24]
push edx
push ecx
call fcn.0020602b
mov dword [esp + 0x34], 0x2399
lea edi, [eax + 4]
xor dword [esp + 0x34], 0xb4bbd3b6
add dword [esp + 0x34], 0xfffffbe3
xor dword [esp + 0x34], 0xb4bbb717
mov dword [esp + 0x20], 0xf668
or dword [esp + 0x20], 0x7255987b
xor dword [esp + 0x20], 0x7255e635
mov dword [esp + 0x1c], 0x6aea
add dword [esp + 0x1c], 0xffff3e88
xor dword [esp + 0x1c], 0xffff96c8
mov ecx, dword [eax]
mov eax, dword [edi]
add edi, 4
xor eax, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
lea esi, [eax + 1]
mov eax, esi
mov ecx, esi
and eax, 0xfffffffc
add eax, 4
and cl, 3
cmovne esi, eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
add esp, 8
mov eax, dword [esp + 0x2c]
mov ecx, esi
call fcn.00208736
mov ebx, eax
mov dword [esp + 0x2c], ebx
pop ecx
pop ecx
test ebx, ebx
je 0x218894
shr esi, 2
xor eax, eax
push ebp
xor ebp, ebp
mov edx, ebx
lea ecx, [edi + esi*4]
mov esi, ecx
sub esi, edi
add esi, 3
shr esi, 2
cmp edi, ecx
cmova esi, eax
test esi, esi
je 0x21888b
mov ebx, dword [esp + 0x18]
mov ecx, dword [edi]
lea edi, [edi + 4]
xor ecx, ebx
mov byte [edx], cl
mov eax, ecx
shr eax, 8
lea edx, [edx + 4]
shr ecx, 0x10
mov byte [edx - 3], al
mov byte [edx - 2], cl
shr ecx, 8
inc ebp
mov byte [edx - 1], cl
cmp ebp, esi
jb 0x218862
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
pop ebp
mov byte [ebx + eax], 0
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x10
ret
Function at 0x21889d
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
push dword [esp + 0x30]
push edx
push ecx
call fcn.0020602b
mov dword [esp + 0x30], 0x3e4ab4
lea edi, [ecx + 4]
xor ebp, ebp
xor edx, edx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x24], 0xc5f8
add dword [esp + 0x24], 0x6051
xor dword [esp + 0x24], 0x10c1f
mov dword [esp + 0x1c], 0x21c8
mov eax, dword [esp + 0x1c]
push 0x48
pop esi
div esi
xor edx, edx
mov dword [esp + 0x1c], eax
add dword [esp + 0x1c], 0xffffac68
xor dword [esp + 0x1c], 0xffffa2cd
mov dword [esp + 0x20], 0xf93e
mov eax, dword [esp + 0x20]
push 0xe
pop esi
div esi
mov dword [esp + 0x20], eax
xor dword [esp + 0x20], 0x4b7b
mov edx, dword [ecx]
mov eax, dword [edi]
add edi, 4
xor eax, edx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], eax
lea esi, [eax + 1]
mov eax, esi
mov ecx, esi
and eax, 0xfffffffc
add eax, 4
and cl, 3
cmovne esi, eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
add esp, 4
mov eax, dword [esp + 0x20]
lea ecx, [esi + esi]
call fcn.00208736
mov ebx, eax
mov dword [esp + 0x20], ebx
pop ecx
pop ecx
test ebx, ebx
je 0x2189c9
shr esi, 2
xor eax, eax
mov edx, ebx
lea ecx, [edi + esi*4]
mov esi, ecx
sub esi, edi
add esi, 3
shr esi, 2
cmp edi, ecx
cmova esi, eax
test esi, esi
je 0x2189bf
mov ebx, dword [esp + 0x1c]
mov ecx, dword [edi]
lea edi, [edi + 4]
xor ecx, ebx
movzx eax, cl
mov word [edx], ax
mov eax, ecx
shr eax, 8
lea edx, [edx + 8]
movzx eax, al
mov word [edx - 6], ax
shr ecx, 0x10
movzx eax, cl
shr ecx, 8
inc ebp
mov word [edx - 4], ax
movzx eax, cl
mov word [edx - 2], ax
cmp ebp, esi
jb 0x218986
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov word [ebx + eax*2], cx
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x1c
ret
Function at 0x401ab0
Capabilities:
Allocate thread local storage

Disassembly:
push 0xffffffffffffffff
push 0x771422
mov eax, dword fs:[0]
push eax
sub esp, 0x620
mov eax, dword [0x84dea4]
xor eax, esp
mov dword [esp + 0x61c], eax
push esi
push edi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0x62c]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, 1
call fcn.004b85e0
mov ecx, esi
call fcn.00401430
test eax, eax
jne 0x401b77
mov ecx, str.Warcraft_III_World_Editor_Application
call fcn.004171a0
test eax, eax
je 0x401b7e
call fcn.004297a0
mov ecx, 5
call fcn.00429780
mov esi, eax
test esi, esi
je 0x401b77
cmp byte [esi], 0
je 0x401b77
lea ecx, [esp + 0x14]
call fcn.00417370
push str.Warcraft_III_World_Editor_File
push 0x104
lea ecx, [esp + 0x1c]
mov dword [esp + 0x63c], 0
call fcn.00417380
mov eax, dword [esp + 0x18]
test eax, eax
je 0x401b63
push 0x104
push esi
push eax
call sub.Storm.dll_Ordinal_501
lea ecx, [esp + 0x14]
mov dword [esp + 0x634], 0xffffffff
call fcn.00417420
xor eax, eax
jmp 0x401cb8
mov ecx, str.Warcraft_III_World_Editor_Application
call fcn.00417190
call fcn.004cd490
mov edi, eax
mov ecx, edi
call fcn.004cd2d0
test eax, eax
jne 0x401be0
push 0x104
lea edx, [esp + 0x128]
lea ecx, [eax + 1]
call fcn.004bf670
push str.War3.mpq
lea eax, [esp + 0x128]
push eax
lea ecx, [esp + 0x28]
push 0x104
push ecx
call sub.Storm.dll_Ordinal_578
add esp, 0x10
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call fcn.004011c0
xor eax, eax
jmp 0x401cb8
call fcn.004022a0
mov ecx, 1
call fcn.00402170
xor ecx, ecx
test eax, eax
setne cl
push 1
mov dword [0x8271ec], ecx
mov ecx, edi
call fcn.004cd3c0
call fcn.006d2f00
push 0
push 0x196
push str..SourceCommonCWorldEditApp.cpp
push 0xc
call sub.Storm.dll_Ordinal_401
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
test eax, eax
mov dword [esp + 0x634], 1
je 0x401c40
mov edx, dword [esi]
push edx
mov ecx, eax
call fcn.00402020
jmp 0x401c42
xor eax, eax
mov dword [esi + 4], eax
cmp dword [eax], 0
mov dword [esp + 0x634], 0xffffffff
jne 0x401cac
push 0x400
lea edx, [esp + 0x22c]
mov ecx, 2
call fcn.004bf670
lea eax, [esp + 0x228]
push eax
mov ecx, esi
call fcn.004011c0
call fcn.006d2f10
mov edi, dword [esi + 4]
test edi, edi
je 0x401ca3
mov ecx, edi
call fcn.004020b0
push 0
push 0xffffffffffffffff
push 0x7987b8
push edi
call sub.Storm.dll_Ordinal_403
mov dword [esi + 4], 0
call fcn.004cd5a0
xor eax, eax
jmp 0x401cb8
mov ecx, esi
call fcn.00401380
mov eax, 1
mov ecx, dword [esp + 0x62c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x61c]
xor ecx, esp
call fcn.00735f58
add esp, 0x62c
ret
Function at 0x402630
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x328
mov eax, dword [0x84dea4]
xor eax, esp
mov dword [esp + 0x324], eax
push ebx
push ebp
push esi
mov ebx, ecx
mov esi, dword [ebx + 0xc]
push edi
xor edi, edi
cmp dword [ebx + 0x18], edi
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], edi
je 0x40267f
mov ecx, dword [ebx + 0x18]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
call edx
mov ecx, dword [ebx + 0x18]
mov eax, dword [ecx]
mov eax, dword [eax + 0x24]
push edi
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x20]
push edx
call eax
lea ebp, [esi + 4]
cmp ebp, 0x40
jge 0x40268c
mov ebp, 0x40
push 2
call fcn.00405ae0
mov ecx, dword [esp + 0x10]
mov edx, dword [ebx]
push ecx
push 1
push ebp
push 0x88
push edx
call fcn.00402bb0
mov ebp, eax
cmp ebp, edi
mov dword [esp + 0x14], ebp
jne 0x40272c
call fcn.004187c0
push edi
push 0x104
lea edx, [esp + 0x134]
mov ecx, str.WESTRING_ERROR_CANTCREATEARCHIVE
mov esi, eax
call fcn.004da2f0
push edi
push 0x104
lea edx, [esp + 0x30]
mov ecx, str.WESTRING_ERROR_SYSTEMERROR
call fcn.004da2f0
mov ecx, dword [ebx]
push esi
lea eax, [esp + 0x2c]
push eax
push ecx
lea edx, [esp + 0x138]
push edx
push str._s:_n_s_n_n_s:__s
lea eax, [esp + 0x244]
push 0x104
push eax
call sub.Storm.dll_Ordinal_578
add esp, 0x1c
push edi
xor edx, edx
lea ecx, [esp + 0x234]
call fcn.004bd7e0
mov ecx, esi
call fcn.004187f0
xor eax, eax
jmp 0x40284e
push 0
xor edx, edx
xor ecx, ecx
mov edi, 1
call fcn.004bd140
test esi, esi
jle 0x402804
xor ebp, ebp
mov dword [esp + 0x20], 0x64
mov dword [esp + 0x1c], esi
mov ecx, dword [ebx + 4]
mov esi, dword [ebx + 0x10]
push Ordinal_2
push ecx
lea edx, [esp + 0x30]
push edx
add esi, ebp
call sub.Storm.dll_Ordinal_501
push Ordinal_2
push esi
lea eax, [esp + 0x30]
push eax
call sub.Storm.dll_Ordinal_503
mov al, byte [esi + 0x104]
test al, 1
je 0x40279d
mov edx, dword [esp + 0x14]
push 0
push 0x201
push esi
lea ecx, [esp + 0x34]
push ecx
push edx
call fcn.00404aa0
jmp 0x4027bc
test al, 2
mov ecx, 1
jne 0x4027ab
mov ecx, 0x201
push ecx
mov ecx, dword [esp + 0x18]
push esi
lea eax, [esp + 0x30]
push eax
push ecx
call fcn.00403950
mov edi, eax
test edi, edi
jne 0x4027d2
push esi
mov edx, str.WESTRING_ERROR_CANTADDTOMPQ
mov ecx, 0x798b6c
call fcn.004bd8a0
mov esi, dword [esp + 0x20]
mov eax, esi
cdq
idiv dword [esp + 0x24]
push 0
xor ecx, ecx
mov edx, eax
call fcn.004bd140
add esi, 0x64
add ebp, 0x105
sub dword [esp + 0x1c], 1
mov dword [esp + 0x20], esi
jne 0x402752
mov ebp, dword [esp + 0x14]
push 0
push 1
push ebp
call fcn.00406450
test edi, edi
je 0x40284c
cmp dword [esp + 0x18], 0
je 0x40284c
mov ecx, dword [ebx]
mov edx, 0x798b68
call fcn.004bde00
mov esi, eax
test esi, esi
je 0x402725
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
push esi
push 1
push edx
push eax
call dword [sym.imp.MSVCR80.dll_fwrite]
push esi
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 0x14
mov eax, edi
mov ecx, dword [esp + 0x334]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00735f58
add esp, 0x328
ret
Function at 0x402fe0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x20c
push ebx
mov ebx, dword [esp + 0x220]
push ebp
mov ebp, dword [esp + 0x218]
push esi
push edi
push 0
push ebp
mov dword [ebx], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, eax
mov eax, dword [esp + 0x224]
mov ecx, eax
and ecx, 4
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
je 0x403030
test edx, edx
jne 0x403030
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20c
ret
test al, 0x64
mov esi, dword [esp + 0x228]
je 0x4030de
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebx]
push 0
push 0
push eax
push ebp
call edi
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0x20
push esi
push ebp
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x18]
mov eax, 0x20
cmp ecx, eax
jne 0x40309b
cmp dword [esi], 0x1a51504d
jne 0x403087
test byte [esp + 0x224], 0x40
je 0x4030bb
add dword [ebx], 0x200
cmp dword [esi], 0x1a51504d
je 0x40309b
sub dword [esp + 0x14], eax
jne 0x403045
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4030de
push 0x85200064
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20c
ret
cmp word [esi + 0xc], 0
jbe 0x403176
push 0x85200065
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20c
ret
mov edx, dword [esp + 0x230]
test edx, edx
je 0x403154
xor eax, eax
mov byte [esp + 0x1c], 0
mov ecx, 0x7f
lea edi, [esp + 0x1d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [edx + 0x1ff]
and eax, 0xfffffe00
mov edi, eax
shr edi, 9
test edi, edi
mov dword [esp + 0x230], eax
je 0x403152
lea esp, [esp]
push 0
lea edx, [esp + 0x14]
push edx
push 0x200
lea eax, [esp + 0x28]
push eax
push ebp
dec edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403186
cmp dword [esp + 0x10], 0x200
jne 0x403186
test edi, edi
jne 0x403120
mov eax, dword [esp + 0x230]
mov dword [ebx], eax
xor eax, eax
mov ecx, 8
mov edi, esi
rep stosd dword es:[edi], eax
mov dword [esi], 0x1a51504d
mov dword [esi + 4], 0x20
mov word [esi + 0xe], 3
mov word [esi + 0xc], ax
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20c
ret
push 0x85200068
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20c
ret

Function at 0x4038f0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x114]
mov ecx, dword [esi + 8]
push edi
mov edi, dword [esp + 0x10]
mov edx, dword [edi]
push 0
push 0
add eax, edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [edi + 4]
mov ecx, dword [esp + 0x14]
push 0
lea edx, [esp + 0x10]
push edx
mov edx, dword [esi + 8]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x403934
pop edi
pop esi
ret
mov edx, dword [edi + 4]
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, edx
pop edi
sete al
pop esi
ret
Function at 0x4039f0
Capabilities:
Get file size

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
push str._attributes_
push ebp
call dword [sym.imp.MSVCR80.dll__stricmp]
mov ecx, dword [esp + 0x30]
mov edi, eax
mov eax, dword [0x851f08]
push eax
neg edi
sbb edi, edi
push ebp
push ecx
inc edi
call fcn.004037d0
add esp, 0x14
cmp eax, 0xffffffff
je 0x403a56
cmp eax, 0xfffffffe
jne 0x403a41
push 0x85200069
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
push 0x8520006a
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
push ebp
call fcn.00403b70
push 3
push eax
call fcn.00407220
mov edx, dword [esp + 0x38]
add esp, 0xc
push 0
push 0x8000000
push 3
push 0
push 1
push Ordinal_2
push edx
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x403a97
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 4
mov dword [esp + 0x18], eax
jae 0x403ab1
and dword [esp + 0x34], 0xffff00ff
mov ecx, dword [esp + 0x38]
xor eax, eax
cmp ecx, eax
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], eax
je 0x403af1
mov eax, dword [esp + 0x34]
test ah, 2
je 0x403af1
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
push esi
push eax
call fcn.00407560
add esp, 0x14
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x403b11
xor ecx, ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], eax
jmp 0x403b19
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x34]
test dl, 2
push ebp
push edi
push ecx
mov ecx, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x28]
push ebx
push eax
mov eax, dword [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x4c]
push eax
push edx
push esi
push ecx
je 0x403b57
call fcn.00403bc0
add esp, 0x34
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
call fcn.00404320
add esp, 0x34
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret