joyce8/EMBER2024-capa huggingface dataset:
Function at 0x909f010
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90ace1d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xb20
mov eax, dword [0x90e6610]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0x18]
push eax
mov dword [ebp - 0xb2c], eax
call fcn.09041741
add esp, 4
lea ecx, [ebp - 0xb24]
push eax
call fcn.09041741
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
push dword [ebp - 0xb24]
mov dword [ebp - 4], 0
push esi
call fcn.09008247
add esp, 0x3c
lea ecx, [ebp - 0xb20]
push eax
call fcn.09041741
mov byte [ebp - 4], 1
xor eax, eax
nop dword [eax]
nop dword [eax + eax]
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jb 0x909f0c0
mov ecx, dword [ebp - 0xb20]
lea eax, [ebp - 0x918]
push 0
push 0x5058595a
push 0x67386b30
push 0x100
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.09041741
movzx ecx, word [ebp - 0x11c]
movzx edi, word [ebp - 0x914]
mov dword [ebp - 0xb28], ecx
cmp ecx, edi
jbe 0x909f23a
mov edx, ecx
sub edx, edi
xor esi, esi
mov dword [ebp - 0xb1c], edx
movzx eax, word [ebp + esi*8 - 0x914]
cmp eax, edi
ja 0x909f131
xor eax, eax
jmp 0x909f15e
cmp eax, ecx
jb 0x909f13c
mov eax, 0x8000
jmp 0x909f15e
sub eax, edi
mov ecx, edx
shl eax, 0xf
xor edx, edx
shr ecx, 1
add eax, ecx
mov ecx, dword [ebp - 0xb28]
div dword [ebp - 0xb1c]
mov edx, dword [ebp - 0xb1c]
movzx eax, ax
mov word [ebp + esi*2 - 0xb18], ax
inc esi
cmp esi, 0x100
jb 0x909f121
lea ecx, [ebp - 0xb20]
mov byte [ebp - 4], 0
call fcn.09017177
lea ecx, [ebp - 0xb24]
mov dword [ebp - 4], 0xffffffff
call fcn.0901b295
mov esi, dword [ebp - 0xb2c]
lea eax, [esi + 8]
push eax
push 0x278
mov dword [ebp - 0xb2c], eax
call fcn.09041741
add esp, 8
mov dword [ebp - 0xb28], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x909f1ca
push esi
mov ecx, eax
call fcn.09041741
mov edx, eax
jmp 0x909f1cc
xor edx, edx
mov ecx, dword [ebx + 0xc]
xorps xmm0, xmm0
movsd xmm1, qword [ebx + 0x10]
mulsd xmm1, qword [0x90bee38]
mov eax, dword [ecx]
mov dword [edx + 0x68], eax
mov eax, dword [ecx + 4]
comisd xmm0, xmm1
mov dword [edx + 0x6c], eax
jbe 0x909f1fa
subsd xmm1, qword [0x90b4780]
jmp 0x909f202
addsd xmm1, qword [0x90b4780]
cvttsd2si eax, xmm1
lea edi, [edx + 0x72]
mov ecx, 0x80
lea esi, [ebp - 0xb18]
rep movsd dword es:[edi], dword [esi]
mov word [edx + 0x70], ax
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001f80
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x6250726f
call fcn.09041741
int3
Function at 0x404504
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
cmp byte [0x443268], 0
jne 0x40464b
call sub.kernel32.dll_GetCurrentProcessId
mov ebx, eax
xor eax, eax
mov ecx, eax
add ecx, ecx
add ecx, ecx
mov edx, ebx
shr edx, cl
and edx, 0xf
movzx edx, byte [edx + str.0123456789ABCDEFp__]
mov ecx, 0x18
sub ecx, eax
mov byte [ecx + str.LocalFastMM_PID_________], dl
inc eax
cmp eax, 8
jne 0x404520
push str.LocalFastMM_PID_________
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov dword [0x443264], eax
cmp dword [0x443264], 0
jne 0x4045ee
mov eax, dword [sym.imp.rtl160.bpl__System_IsLibrary]
cmp byte [eax], 0
jne 0x4045a9
push str.LocalFastMM_PID_________
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov dword [0x443264], eax
push 0
push 0
push 0
push 2
mov eax, dword [0x443264]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [eax], 0x44324c
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov dword [0x44324c], fcn.00402f14
mov dword [0x443250], 0x4031f8
mov dword [0x443254], 0x403378
mov dword [0x443258], 0x403608
mov dword [0x44325c], 0x4037e0
mov dword [0x443260], 0x40382c
mov byte [0x443269], 1
jmp 0x404630
push 0
push 0
jmp 0x49ec30
mov eax, 0x443234
call sub.rtl160.bpl__System_GetMemoryManager_qqrr23System_TMemoryManagerEx
mov eax, 0x44324c
call sub.rtl160.bpl__System_SetMemoryManager_qqrrx23System_TMemoryManagerEx
mov byte [0x443268], 1
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x409de8
Capabilities:
Inspect section memory permissions

Disassembly:
xor eax, eax
test edx, 0x20000000
je 0x409e20
test edx, 0x40000000
je 0x409e0c
test edx, 0x80000000
je 0x409e07
or eax, 0x40
jmp 0x409e4a
or eax, 0x20
jmp 0x409e4a
test edx, 0x80000000
je 0x409e1b
or eax, 0x80
jmp 0x409e4a
or eax, 0x10
jmp 0x409e4a
test edx, 0x40000000
je 0x409e3a
test edx, 0x80000000
je 0x409e35
or eax, 4
jmp 0x409e4a
or eax, 2
jmp 0x409e4a
test edx, 0x80000000
je 0x409e47
or eax, 8
jmp 0x409e4a
or eax, 1
test edx, 0x4000000
je 0x409e57
or eax, 0x200
ret

Function at 0x409f64
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, eax
lea eax, [ebx + 0x44]
mov edx, 0xf8
call fcn.00402400
lea edx, [ebx + 4]
mov ecx, 0x40
mov eax, dword [ebx + 0x140]
mov esi, dword [eax]
call dword [esi + 0xc]
xor ecx, ecx
mov edx, dword [ebx + 0x40]
mov eax, dword [ebx + 0x140]
mov esi, dword [eax]
call dword [esi + 0x14]
lea edx, [ebx + 0x44]
mov ecx, 4
mov eax, dword [ebx + 0x140]
mov esi, dword [eax]
call dword [esi + 0xc]
lea edx, [ebx + 0x48]
mov ecx, 0x14
mov eax, dword [ebx + 0x140]
mov esi, dword [eax]
call dword [esi + 0xc]
movzx ecx, word [ebx + 0x58]
lea edx, [ebx + 0x5c]
mov eax, dword [ebx + 0x140]
mov esi, dword [eax]
call dword [esi + 0xc]
cmp word [ebx + 4], 0x5a4d
jne 0x409fec
cmp dword [ebx + 0x44], 0x4550
jne 0x409fec
cmp word [ebx + 0x48], 0x14c
je 0x40a002
mov ecx, 0x40a014
mov dl, 1
mov eax, dword [sym.imp.rtl160.bpl__System_Sysutils_Exception_]
call sub.rtl160.bpl__System_Sysutils_Exception__bctr_qqrx20System_UnicodeString
call sub.rtl160.bpl__System__RaiseExcept_qqrv
pop esi
pop ebx
pop ebp
ret
Function at 0x409151
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x409195
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x409164
jmp 0x409195
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x409185
pop esi
pop ebp
ret

Function at 0x409d2d
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x409d62
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x409d8c
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x409d8c
test edi, edi
je 0x409d59
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x409d59
test edi, edi
je 0x409d94
mov eax, edi
jmp 0x409d5b
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x409d5b
int3
Function at 0x40ce61
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestIntegerPrintfMacros.exe_gMozillaPoisonSize], eax
call fcn.00409d2d
pop ecx
mov ecx, dword [sym.TestIntegerPrintfMacros.exe_gMozillaPoisonSize]
mov dword [sym.TestIntegerPrintfMacros.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40ce99
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestIntegerPrintfMacros.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x4015f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x4722c4]
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x328], ecx
mov eax, dword [ebp - 0x328]
cmp dword [eax], 0
jne 0x40161b
xor al, al
jmp 0x401723
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0x13c], 0
mov ecx, 0x69
mov esi, str._html__head__meta_http_equiv_content_type__content_text_html__charsetISO_8859_1_____meta_http_equiv_Cache_Control__content_no_cache_____meta_http_equiv_Pragma__content_no_cache_____link_type_text_css__rel_stylesheet__href_EasyInfo.css____title_EasyInfo_2_169__2004_Electronic_Arts_Inc._All_Rights_Reserved.__title___head__body_bgcolor_f5f5f5__topmargin_3__bottommargin_3__leftmargin_3__rightmargin_3__
lea edi, [ebp - 0x2e8]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x2b
mov esi, str._table_border_0__cellspacing_0__cellpadding_0__width_100___bgcolor_DBE0E5____tr__td_bgcolor_FFFFFF__style_background:_url_imageslogoeab.bmp______td___tr___table_
lea edi, [ebp - 0xb8]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x1d
mov esi, str._table_border_0__cellspacing_0__cellpadding_4__height_100___width_100___bgcolor_DBE0E5__id_overlord___tr__td_
lea edi, [ebp - 0x138]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ecx, [ebp - 0xbc]
push ecx
push SysReAllocString
lea edx, [ebp - 0x2e8]
push edx
call fcn.00403ec0
push 0
lea eax, [ebp - 0x13c]
push eax
mov ecx, dword [ebp - 0xbc]
push ecx
lea edx, [ebp - 0x2e8]
push edx
mov eax, dword [ebp - 0x328]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [ebp - 0xbc]
push edx
push SysReAllocString
lea eax, [ebp - 0xb8]
push eax
call fcn.00403ec0
push 0
lea ecx, [ebp - 0x13c]
push ecx
mov edx, dword [ebp - 0xbc]
push edx
lea eax, [ebp - 0xb8]
push eax
mov ecx, dword [ebp - 0x328]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0xbc]
push eax
push SysReAllocString
lea ecx, [ebp - 0x138]
push ecx
call fcn.00403ec0
push 0
lea edx, [ebp - 0x13c]
push edx
mov eax, dword [ebp - 0xbc]
push eax
lea ecx, [ebp - 0x138]
push ecx
mov edx, dword [ebp - 0x328]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov al, 1
mov ecx, dword [ebp - 4]
call fcn.0042fcee
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401740
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x4722c4]
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
cmp dword [eax], 0
jne 0x40175f
xor al, al
jmp 0x4017ab
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
mov ecx, 8
mov esi, str.__td___tr___table___body___html_
lea edi, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2c]
push ecx
push SysReAllocString
lea edx, [ebp - 0x28]
push edx
call fcn.00403ec0
push 0
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov al, 1
mov ecx, dword [ebp - 4]
call fcn.0042fcee
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x403290
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x4722c4]
mov dword [ebp - 0x10], eax
push edi
mov dword [ebp - 0x470], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0x400
mov byte [ebp - 0x418], 0
mov ecx, 0x100
xor eax, eax
lea edi, [ebp - 0x417]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x470]
add ecx, 4
mov eax, dword [ebp - 0x470]
mov edx, dword [eax + 4]
call dword [edx + 0x10]
push eax
push str._table_border_0__cellspacing_1__cellpadding_4__width_100____bgcolor_DBE0E5___tr__th__s__th___tr__tr__td_style_background:_F4F6F7___
push 0x400
lea eax, [ebp - 0x418]
push eax
call fcn.00403f50
add esp, 0x10
lea ecx, [ebp - 4]
push ecx
push SysReAllocString
lea edx, [ebp - 0x418]
push edx
call fcn.00403ec0
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x418]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x41c], 0
jmp 0x40334d
mov ecx, dword [ebp - 0x41c]
add ecx, 1
mov dword [ebp - 0x41c], ecx
mov edx, dword [ebp - 0x470]
add edx, 0x14
mov dword [ebp - 0x434], edx
mov eax, dword [ebp - 0x434]
cmp dword [eax + 4], 0
jne 0x403374
mov dword [ebp - 0x474], 0
jmp 0x40338f
mov ecx, dword [ebp - 0x434]
mov edx, dword [ebp - 0x434]
mov eax, dword [ecx + 8]
sub eax, dword [edx + 4]
sar eax, 2
mov dword [ebp - 0x474], eax
mov ecx, dword [ebp - 0x41c]
cmp ecx, dword [ebp - 0x474]
jae 0x4033fb
mov edx, dword [ebp - 0x470]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x440], eax
mov ecx, dword [ebp - 0x440]
mov dword [ebp - 0x438], ecx
mov edx, dword [ebp - 0x438]
mov dword [ebp - 0x444], edx
mov eax, dword [ebp - 0x41c]
mov ecx, dword [ebp - 0x444]
lea edx, [ecx + eax*4]
mov dword [ebp - 0x444], edx
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x43c], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x43c]
mov ecx, dword [edx]
call fcn.004038e0
jmp 0x40333e
push 0x45685c
push 0x400
lea eax, [ebp - 0x418]
push eax
call fcn.004041d0
lea ecx, [ebp - 4]
push ecx
push SysReAllocString
lea edx, [ebp - 0x418]
push edx
call fcn.00403ec0
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x418]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov al, 1
mov ecx, dword [ebp - 0x10]
call fcn.0042fcee
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x406670
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x4722c4]
mov dword [ebp - 4], eax
push edi
mov byte [ebp - 0x110], 0
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push 0x104
lea eax, [ebp - 0x110]
push eax
call fcn.004041d0
push str._ereg
lea ecx, [ebp - 0x110]
push ecx
call fcn.004313c0
add esp, 8
test eax, eax
je 0x4066cf
mov eax, 3
jmp 0x4066d4
mov eax, 2
mov ecx, dword [ebp - 4]
call fcn.0042fcee
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x406a70
Capabilities:
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x10], eax
push 0
movzx eax, word [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x406aa6
xor al, al
jmp 0x406b61
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x406ac4
xor al, al
jmp 0x406b61
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x406ae5
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor al, al
jmp 0x406b61
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x406b0a
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor al, al
jmp 0x406b61
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x406d60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x14]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x406d8c
jmp 0x406eae
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x18]
movzx eax, word [edx + 8]
push eax
push 0
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x18]
push edx
call dword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
jne 0x406db7
jmp 0x406eae
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x406de1
jmp 0x406eae
mov word [ebp - 0x28], 0x4d42
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x20]
lea edx, [edx + ecx*4 + 0xe]
mov eax, dword [ebp - 0x18]
add edx, dword [eax + 0x14]
mov dword [ebp - 0x26], edx
mov word [ebp - 0x22], 0
mov word [ebp - 0x20], 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x20]
lea edx, [edx + ecx*4 + 0xe]
mov dword [ebp - 0x1e], edx
push 0
lea eax, [ebp - 8]
push eax
push 0xe
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x406e39
jmp 0x406eae
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x20]
lea eax, [edx*4 + 0x28]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x406e61
jmp 0x406eae
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x406e94
jmp 0x406eae
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x406ea4
jmp 0x406eae
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40b950
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4527e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
call fcn.0040b1b0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
push 0
push 0x80
push 2
push 0
push 3
push 2
mov eax, dword [0x473894]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x40b9e0
movzx edx, byte [0x47121c]
test edx, edx
jne 0x40b9e0
push 0x10
push str.Internal_Error
push str.Unable_to_create_open_error_log.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x473894]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x60], ecx
mov edx, dword [0x473894]
mov eax, dword [edx + 8]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x40ba06
cmp dword [ebp - 0x60], 0x7fffffff
jbe 0x40ba0f
mov dword [ebp - 0x4c], 0x80070057
jmp 0x40ba75
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x54], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x58], 0
je 0x40ba4c
mov ecx, dword [ebp - 0x5c]
movsx edx, byte [ecx]
test edx, edx
je 0x40ba4c
mov eax, dword [ebp - 0x5c]
add eax, 1
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x58]
sub ecx, 1
mov dword [ebp - 0x58], ecx
jmp 0x40ba28
cmp dword [ebp - 0x58], 0
jne 0x40ba59
mov dword [ebp - 0x54], 0x80070057
cmp dword [ebp - 0x54], 0
jl 0x40ba6f
lea edx, [ebp - 0x14]
test edx, edx
je 0x40ba6f
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x58]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x4c], ecx
push 0
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [0x473894]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x40babb
movzx ecx, byte [0x47121c]
test ecx, ecx
jne 0x40babb
push 0x10
push str.Internal_Error
push str.Unable_to_write_buffer_to_error_log.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x18]
je 0x40bae2
movzx eax, byte [0x47121c]
test eax, eax
jne 0x40bae2
push 0x10
push str.Internal_Error
push str.Some_error_information_was_not_written_to_the_error_log._r_nThe_number_of_bytes_written_does_not_match_the_length_of_the_buffer.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40baea
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], 0xffffffff
je 0x40bb01
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40bb20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4527f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0xa0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0xac], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xac]
add eax, 4
mov dword [ebp - 0x30], eax
cmp dword [ebp + 8], 0
je 0x40bb71
mov ecx, SysReAllocString
cmp ecx, 0x7fffffff
jbe 0x40bb7a
mov dword [ebp - 0x1c], 0x80070057
jmp 0x40bbe2
mov dword [ebp - 0x28], SysReAllocString
mov edx, dword [ebp + 8]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x28], 0
je 0x40bbb8
mov ecx, dword [ebp - 0x2c]
movsx edx, byte [ecx]
test edx, edx
je 0x40bbb8
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x28]
sub ecx, 1
mov dword [ebp - 0x28], ecx
jmp 0x40bb94
cmp dword [ebp - 0x28], 0
jne 0x40bbc5
mov dword [ebp - 0x24], 0x80070057
cmp dword [ebp - 0x24], 0
jl 0x40bbdc
cmp dword [ebp - 0x30], 0
je 0x40bbdc
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov dword [eax], edx
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0xac]
mov eax, dword [edx + 4]
add eax, 0xe
mov ecx, dword [ebp - 0xac]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0xac]
mov eax, dword [edx + 4]
push eax
call fcn.00445d54
add esp, 4
mov dword [ebp - 0xb0], eax
mov ecx, dword [ebp - 0xb0]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0x14]
mov dword [edx], eax
mov ecx, dword [ebp + 8]
push ecx
push str.FATAL_ERROR:__s
mov edx, dword [ebp - 0xac]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0xac]
mov edx, dword [ecx]
push edx
call fcn.00403f50
add esp, 0x10
mov eax, dword [ebp - 0xac]
mov ecx, dword [eax]
push ecx
mov ecx, dword [ebp - 0xac]
call fcn.0040b3f0
mov edx, dword [ebp - 0xac]
mov eax, dword [edx]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00445d4f
add esp, 4
mov edx, dword [ebp - 0xac]
mov dword [edx], 0
call fcn.0040b1b0
mov eax, dword [0x473894]
mov ecx, dword [eax + 0x10]
push ecx
call fcn.0040b950
add esp, 4
jmp 0x40bc9c
mov dword [ebp - 4], 0xffffffff
movzx edx, byte [0x47121c]
test edx, edx
jne 0x40bcc1
push 0x10
push str.Fatal_Error
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.004316b8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4