joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4098c4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409997
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4099b0
push ebx
push 0x4099bc
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409944
mov al, 0x62
call fcn.0040949c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409898
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x40994d
call fcn.00409898
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40999e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a50
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409b04
jmp 0x409af9
cmp dword [esi + 0x10], 0x1000
jne 0x409ae5
test byte [esi + 0x15], 1
jne 0x409ae5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409aa4
cmp eax, 2
je 0x409aa4
cmp eax, 0x10
je 0x409aa4
cmp eax, 0x20
jne 0x409ab9
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409ab9
mov bl, 1
xor ebp, ebp
jmp 0x409aca
mov eax, dword [esi]
add eax, ebp
call fcn.00409a48
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409abd
test bl, bl
je 0x409ae5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409b04
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a7c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4088f0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
call fcn.0040890a
dec edx
xor dword [eax], ecx
add eax, 1
cmp eax, edi
jne fcn.004088f0
inc ebx
dec ebx
ret
Function at 0xa5edb8
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a5ef08
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa5edde
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa5edca
add dl, dl
jne 0xa5ede9
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa5ee3c
xor eax, eax
add dl, dl
jne 0xa5edf6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa5eedd
add dl, dl
jne 0xa5ee05
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa5ee10
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa5ee1b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa5ee26
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa5ee32
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa5edd5
mov eax, 1
add dl, dl
jne 0xa5ee4a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa5ee55
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa5ee41
sub eax, ebx
mov ebx, 1
jne 0xa5ee88
mov ecx, 1
add dl, dl
jne 0xa5ee6e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa5ee79
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa5ee65
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa5edd5
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa5ee9f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa5eeaa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa5ee96
cmp eax, 0x7d00
jae 0xa5eecd
cmp eax, 0x500
jb 0xa5eec8
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa5edd5
cmp eax, 0x7f
ja 0xa5eed0
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa5edd5
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa5eefe
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa5edd5
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0xbacd10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x162000]
mov dword [edi + 0x7952ac], 0xb527299e
push edi
or ebp, 0xffffffff
jmp 0xbacd3a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xbacd41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xbacd30
mov eax, 1
add ebx, ebx
jne 0xbacd53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xbacd64
jne 0xbacd83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xbacd83
dec eax
add ebx, ebx
jne 0xbacd70
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xbacd48
add ebx, ebx
jne 0xbacd7f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xbacdd5
xor ecx, ecx
sub eax, 3
jb 0xbacd9b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xbace0a
sar eax, 1
mov ebp, eax
jmp 0xbacda6
add ebx, ebx
jne 0xbacda6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xbacd74
inc ecx
add ebx, ebx
jne 0xbacdb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xbacd74
add ebx, ebx
jne 0xbacdc1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xbacdb6
jne 0xbacdd2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xbacdb6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xbacdf4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xbacde6
jmp 0xbacd36
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xbacdf4
add edi, ecx
jmp 0xbacd36
pop esi
mov edi, esi
mov ecx, 0x47b6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xbace12
cmp byte [edi], 0x19
jne 0xbace12
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xbace17
lea edi, [esi + 0x7a7000]
mov eax, dword [edi]
or eax, eax
je 0xbace86
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7ad000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7ad044]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xbace44
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7ad04c]
or eax, eax
je 0xbace80
mov dword [ebx], eax
add ebx, 4
jmp 0xbace61
call dword [esi + 0x7ad048]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0xbacec0
cmp al, 0xef
ja 0xbaceaa
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0xbace8c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
or eax, eax
jne 0xbace99
mov eax, dword [edi]
add edi, 4
jmp 0xbace99
mov ebp, dword [esi + 0x7ad050]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xbacef4
sub esp, 0xffffff80
jmp 0x4011d6
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x16bb7d94
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x66b71140
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401d4a
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [0x418714], 0
mov eax, dword [0x418714]
mov ebx, 0xffffffff
push ebx
call dword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov dword [0x418ebf], eax
mov dword [0x418174], 0
mov eax, dword [0x418174]
lea edx, [edx + 0x418977]
add dword [0x4195a1], edx
sub edx, eax
shr edx, 1
add edx, eax
mov ecx, edx
add ecx, 0x94e
add dword [0x418b51], ecx
ror ecx, 2
shr ecx, 1
sub ecx, eax
add dword [0x418e06], ecx
call fcn.00402f28
mov dword [0x41818c], eax
push 0x2547545c
pop edi
push edi
mov esi, 0x1eeae871
mov eax, esi
push eax
mov eax, 0x535b7a47
mov esi, eax
push esi
mov edi, 0x174cf46c
mov ebp, edi
push ebp
push 0x418ab134
pop ebx
push ebx
push 0x21ff1beb
pop eax
push eax
push 0x67cf697b
pop edx
push edx
mov edx, 0x47777e77
push edx
mov esi, 0
mov edi, esi
push edi
push 0x30a185
pop ebx
add ebx, 0x103f1b
push dword [ebx]
pop dword [0x41855f]
mov ebx, dword [0x41855f]
call ebx
mov dword [0x418f49], eax
or eax, eax
je 0x401e19
sub ebp, edi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x408925
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4085d8
call fcn.00408939
dec edi
inc esi
xor dword [ecx], edx
inc ecx
cmp ecx, eax
jne fcn.00408925
ret
Function at 0x404740
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7433
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x4d6fd0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
lea eax, [ebp + 8]
mov dword [ebp - 4], 3
push eax
call fcn.00404030
lea eax, [ebp + 0x20]
mov byte [ebp - 4], 4
lea ecx, [esi + 0x18]
push eax
call fcn.00404030
lea eax, [ebp + 0x38]
mov byte [ebp - 4], 5
lea ecx, [esi + 0x30]
push eax
call fcn.00404030
lea eax, [ebp + 0x50]
mov byte [ebp - 4], 6
push eax
lea ecx, [esi + 0x48]
call fcn.00404030
mov eax, dword [ebp + 0x68]
mov edx, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x70]
mov dword [esi + 0x60], eax
mov eax, dword [ebp + 0x6c]
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], ecx
cmp edx, 0x10
jb 0x4047f4
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4047ea
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4048d2
push edx
push ecx
call fcn.00496a48
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x40483a
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404830
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4048d2
push edx
push ecx
call fcn.00496a48
add esp, 8
mov edx, dword [ebp + 0x4c]
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0xf
mov byte [ebp + 0x20], 0
cmp edx, 0x10
jb 0x40487c
mov ecx, dword [ebp + 0x38]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404872
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4048d2
push edx
push ecx
call fcn.00496a48
add esp, 8
mov edx, dword [ebp + 0x64]
mov dword [ebp + 0x48], 0
mov dword [ebp + 0x4c], 0xf
mov byte [ebp + 0x38], 0
cmp edx, 0x10
jb 0x4048be
mov ecx, dword [ebp + 0x50]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4048b4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4048d2
push edx
push ecx
call fcn.00496a48
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x6c
call fcn.0049b42f
int3
Function at 0x40a650
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4d6fd0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40a70c
cmp byte [esi + 0x3d], 0
je 0x40a70c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40a6fa
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x40a6c2
sub eax, 1
je 0x40a6c6
sub eax, 2
jne 0x40a6fa
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00496cac
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40a6e3
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0049d638
add esp, 0x10
cmp edi, eax
jne 0x40a6fa
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00496cac
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00496cac
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00496cac
mov esp, ebp
pop ebp
ret

Function at 0x40de90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x40dec1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x40deb0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x413280
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4d6fd0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x4132b0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00496cac
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4132ec
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x4132ec
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00496cac
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x4133d4
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x413314
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x413347
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0049ccc1
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00496cac
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x28], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x4133a7
sub eax, 1
je 0x4133a7
sub eax, 2
jne 0x4133d4
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.00402390
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00496cac
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4133c4
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0049d638
add esp, 0x10
cmp edi, eax
jne 0x4133d4
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x4132d7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00496cac
mov esp, ebp
pop ebp
ret 4
Function at 0x413f60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], edi
test eax, eax
jg 0x413f8c
jl 0x413f80
test ecx, ecx
jne 0x413f8c
pop edi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
push esi
je 0x41403e
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
nop dword [eax]
mov ecx, ebx
call fcn.0040abe0
mov esi, eax
mov eax, edx
mov dword [ebp - 0xc], eax
test eax, eax
jl 0x413ff3
jg 0x413fb8
test esi, esi
je 0x413ff3
mov ecx, dword [ebp - 4]
cmp ecx, eax
jg 0x413fcd
mov eax, dword [ebp - 8]
jl 0x413fc8
cmp eax, esi
jae 0x413fcd
mov esi, eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.004986f0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
sub ecx, esi
sbb edx, dword [ebp - 0xc]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x414012
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x414028
mov ecx, dword [ebp - 8]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
test edx, edx
jg 0x413fa0
jl 0x414028
test ecx, ecx
jne 0x413fa0
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
pop esi
sbb ecx, edx
pop edi
mov edx, ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x414075
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x414075
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push dword [ebp - 4]
call fcn.004986f0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
add dword [ebp - 4], esi
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x4140eb
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x41409b
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [ebp - 4]
mov ecx, edi
cmp edi, 0xfff
jbe 0x4140d4
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.0049cfb1
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x4140ff
cmp edi, eax
ja 0x4140b0
test ecx, ecx
je 0x4140eb
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.0049cfb1
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
pop esi
pop edi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop esi
pop edi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4141f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x4142bd
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test esi, esi
jl 0x4142ac
jg 0x414228
test edx, edx
je 0x4142ac
call fcn.0040bdb0
mov esi, eax
mov eax, edx
mov dword [ebp - 8], eax
test eax, eax
jl 0x414275
jg 0x41423e
test esi, esi
je 0x414275
cmp ebx, eax
jg 0x41424d
jl 0x414248
cmp edi, esi
jae 0x41424d
mov esi, edi
mov dword [ebp - 8], ebx
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 8]
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.004986f0
mov ecx, dword [ebp - 4]
add esp, 0xc
sub edi, esi
sbb ebx, dword [ebp - 8]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x414299
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x4142a6
mov ecx, dword [ebp - 4]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [ebp + 8], esi
test ebx, ebx
jg 0x414228
jl 0x4142a6
test edi, edi
jne 0x414228
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
pop edi
sbb esi, ebx
mov eax, edx
mov edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov eax, dword [eax]
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x4142dc
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x4142de
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [ebp + 0x10], eax
test edi, edi
jl 0x414357
jg 0x4142f0
test esi, esi
je 0x414357
test eax, eax
jl 0x41433b
jg 0x4142fa
test ebx, ebx
je 0x41433b
cmp edi, eax
jg 0x414309
jl 0x414304
cmp esi, ebx
jae 0x414309
mov ebx, esi
mov dword [ebp + 0x10], edi
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.004986f0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [ebp + 0x10]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x414357
jg 0x41433e
test esi, esi
je 0x414357
jmp 0x41433e
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x414357
push eax
push esi
push 1
push edx
call fcn.0049d638
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc