joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405c38
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x405df0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405c99
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x405e0c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405d06
xor eax, eax
push ebp
push 0x405cff
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405ce8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405e2c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405d06
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405de7
cmp byte [ebp - 0xd], 0
jne 0x405d48
cmp byte [ebp - 0x12], 0
je 0x405de7
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405d61
dec ebx
cmp byte [ebx], 0x2e
je 0x405d70
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405d60
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405de7
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405d9d
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405de7
cmp byte [ebp - 0xd], 0
je 0x405de7
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405de7
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4078b8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb

Function at 0x4078c8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda

Function at 0x4078e4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 9], 0xbf
call fcn.00407550
push eax
push esi
push dword [ebp + 8]
call fcn.00407505
invalid
Function at 0x407904
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
inc ebp
wait
xor eax, 0x349c45c6

Function at 0x407918
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
wait
xor eax, 0x349c45c6
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
invalid

Function at 0x407930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
mov eax, dword [0xa245c62e]
xor eax, 0x24a345c6

Function at 0x407964
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ebp
aad 0xc6
inc ebp
salc
aam 0x88
pop ebp
xlatb
Function at 0x40b810
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b849
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403d58
jmp 0x40b852
mov eax, ebx
mov edx, esi
call fcn.00403d0c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x419958
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41995e
ret

Function at 0x41c1f8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41c249
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41c230
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41c220
jmp 0x41c249
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41c231
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4423b8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4817d4
cmp dword [edi], 0
jne 0x442434
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4817d0]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x47e978
mov ecx, 2
call fcn.00402a20
mov edx, 0x442390
lea eax, [esi + 5]
call fcn.004423b0
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004423b0
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x442409
mov dword [0x4817d0], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x462a1f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x47f8c2
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x462a77
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x47f8e3
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x462a6d
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x462a7b
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0xc47700
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x603000]
push edi
or ebp, 0xffffffff
jmp 0xc47722
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xc47729
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc47718
mov eax, 1
add ebx, ebx
jne 0xc4773b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xc4774c
jne 0xc4776b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc4776b
dec eax
add ebx, ebx
jne 0xc47758
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xc47730
add ebx, ebx
jne 0xc47767
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xc477bd
xor ecx, ecx
sub eax, 3
jb 0xc47783
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xc477f2
sar eax, 1
mov ebp, eax
jmp 0xc4778e
add ebx, ebx
jne 0xc4778e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc4775c
inc ecx
add ebx, ebx
jne 0xc4779c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc4775c
add ebx, ebx
jne 0xc477a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xc4779e
jne 0xc477ba
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xc4779e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xc477dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xc477ce
jmp 0xc4771e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xc477dc
add edi, ecx
jmp 0xc4771e
pop esi
mov edi, esi
mov ecx, 0x210b7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xc477fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xc477ff
lea edi, [esi + 0x843000]
mov eax, dword [edi]
or eax, eax
je 0xc47867
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x84b1c8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x84b2f4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xc47825
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x84b2f8]
or eax, eax
je 0xc47861
mov dword [ebx], eax
add ebx, 4
jmp 0xc47842
call dword [esi + 0x84b308]
mov ebp, dword [esi + 0x84b2fc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xc4789b
sub esp, 0xffffff80
jmp 0x9d1b70
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ed0
nop
mov ecx, 0x715712b0
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x5f7f1839
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401180
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x4a7480]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp + 0x1c]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xfc], eax
lea eax, [ebp - 0xf8]
push eax
push 0xf1
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov al, byte [ebp - 0xf8]
mov byte [esi], al
movsx eax, al
sub eax, 0x40
mov dword [edi], eax
lea eax, [ebp - 0xf8]
push eax
push 0x48a240
push ebx
call fcn.004015c0
push dword [ebp - 0xfc]
push dword [ebp - 0x100]
push str._sSDIR_s_
push dword [ebp - 0x104]
call fcn.004015c0
mov ecx, dword [ebp - 4]
add esp, 0x1c
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00426216
mov esp, ebp
pop ebp
ret

Function at 0x4015f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8a0
mov eax, dword [0x4a7480]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x48a470
push str.PDFFONT
call fcn.0044c7ec
add esp, 8
mov dword [ebp - 0x898], eax
cmp dword [ebp - 0x898], 0
je 0x4016ae
mov eax, dword [ebp - 0x898]
push eax
push 1
push 4
lea ecx, [ebp - 0x89c]
push ecx
call fcn.0044ca9e
add esp, 0x10
mov edx, dword [ebp - 0x898]
push edx
push 1
push 4
lea eax, [ebp - 0x8a0]
push eax
call fcn.0044ca9e
add esp, 0x10
mov ecx, dword [ebp - 0x898]
push ecx
call fcn.0044c4fe
add esp, 4
cmp dword [ebp - 0x89c], 0
jne 0x401679
jmp 0x40172c
mov edx, dword [ebp - 0x89c]
push edx
push str._pfs_i
lea eax, [ebp - 0x94]
push eax
call fcn.004015c0
add esp, 0xc
mov ecx, dword [ebp - 0x8a0]
push ecx
push str._plm_i
lea edx, [ebp - 0x34]
push edx
call fcn.004015c0
add esp, 0xc
jmp 0x4016b0
jmp 0x40172c
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str._s_s.txt
lea edx, [ebp - 0x894]
push edx
call fcn.004015c0
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str._s_s.pdf
lea edx, [ebp - 0x494]
push edx
call fcn.004015c0
add esp, 0x10
push str._pfn200
lea eax, [ebp - 0x64]
push eax
call fcn.004015c0
add esp, 8
push 0
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x494]
push ecx
lea edx, [ebp - 0x894]
push edx
push str.TxtToPDF.EXE
push str.TxtToPDF.EXE
push 0
call fcn.00460e15
add esp, 0x24
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00426216
mov esp, ebp
pop ebp
ret
Function at 0x403090
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f8
mov eax, dword [0x4a7480]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xf8]
push 0x4aa200
push str.GL_AS
push 0x4a9c00
push str._s_s_s
push eax
call fcn.004015c0
lea eax, [ebp - 0xf8]
push eax
call fcn.004026f0
lea eax, [ebp - 0xf8]
push 0x48a470
push eax
call fcn.0044c7ec
add esp, 0x20
mov dword [0x630d9c], eax
test eax, eax
je 0x403117
push eax
call fcn.00460ec7
push eax
call fcn.004611c8
push dword [0x630d9c]
cdq
and edx, 7
lea esi, [edx + eax]
sar esi, 3
call fcn.0044c4fe
add esp, 0xc
jmp 0x40311d
mov esi, dword [ebp - 0x1f0]
lea eax, [ebp - 0xf8]
push 0x48a470
push eax
call fcn.0044c7ec
add esp, 8
mov dword [0x630d9c], eax
test eax, eax
je 0x4031da
push edi
push 0x4a9c00
lea eax, [ebp - 0x1ec]
push 0x48b978
push eax
call fcn.004015c0
lea eax, [ebp - 0x1ec]
push 0x48a574
push eax
call fcn.0044c7ec
mov edi, eax
add esp, 0x18
test edi, edi
je 0x4031cc
cmp esi, 1
jl 0x4031c3
nop dword [eax]
nop dword [eax + eax]
push dword [0x630d9c]
lea eax, [ebp - 0x1f8]
push 1
push 8
push eax
call fcn.0044ca9e
movsd xmm0, qword [ebp - 0x1f8]
lea eax, [ebp - 0x1f0]
cvtpd2ps xmm0, xmm0
push edi
push 1
push 4
push eax
movss dword [ebp - 0x1f0], xmm0
call fcn.0044d1b5
add esp, 0x20
sub esi, 1
jne 0x403180
push edi
call fcn.0044c4fe
add esp, 4
push dword [0x630d9c]
call fcn.0044c4fe
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00426216
mov esp, ebp
pop ebp
ret
Function at 0x4032f0
Capabilities:
Read file on windows

Disassembly:
push str.TRANSFERN
push 0x4a9c00
push 0x48b978
push 0x4a9a00
call fcn.004015c0
push 0x48a470
push 0x4a9a00
call fcn.0044c7ec
add esp, 0x18
mov dword [0x630d9c], eax
test eax, eax
je 0x403390
push eax
push 1
push 0x504
push 0x630880
call fcn.0044ca9e
push dword [0x630d9c]
push 1
push 0x28
push 0x630840
call fcn.0044ca9e
push dword [0x630d9c]
call fcn.0044c4fe
movzx eax, byte [0x630d06]
add esp, 0x24
movsd xmm0, qword [0x630cf0]
mov byte [0x630822], al
movzx eax, byte [0x630d09]
movsd qword [0x611818], xmm0
movsd xmm0, qword [0x630cf8]
movsd qword [0x611810], xmm0
mov byte [0x4a7ec4], al
cmp word [0x519122], 0
jle 0x40342b
push edi
push 0x4aa200
push str.GIRDER
push 0x4a9c00
push str._s_s_s
push 0x4a9a00
call fcn.004015c0
push 0x4a9a00
call fcn.004026f0
push 0x48a470
push 0x4a9a00
call fcn.0044c7ec
mov edi, 1
mov dword [0x630d9c], eax
mov ecx, edi
add esp, 0x20
cmp cx, word [0x519122]
jg 0x40341d
push esi
mov esi, 0x5829e0
push eax
push 1
push 0xf200
push esi
call fcn.0044ca9e
movsx eax, word [0x519122]
inc edi
add esp, 0x10
add esi, 0x200
cmp edi, eax
mov eax, dword [0x630d9c]
jle 0x4033f4
pop esi
pop edi
test eax, eax
je 0x40342b
push eax
call fcn.0044c4fe
add esp, 4
push 0x4aa200
push str.UWAENDE
push 0x4a9c00
push str._s_s_s
push 0x4a9a00
call fcn.004015c0
push 0x48a470
push 0x4a9a00
call fcn.0044c7ec
add esp, 0x1c
mov dword [0x630d9c], eax
test eax, eax
je 0x403481
push eax
push 1
push 0x1c
push 0x4aa900
call fcn.0044ca9e
push dword [0x630d9c]
call fcn.0044c4fe
add esp, 0x14
cmp byte [0x630d04], 0
jne 0x4034b3
call fcn.0040ea60
call fcn.00421190
cmp byte [0x630824], 0
je 0x4034a2
call fcn.00403250
push 0x4a9400
call fcn.00407130
push str.Bemessung
jmp 0x4034c7
call fcn.0041e950
push 0x4a9400
call fcn.00407130
push str.Durchstanznachweis
push 0x48a46c
push 0x4a940c
mov dword [0x4a9408], 1
call fcn.004015c0
push 0x4a9c00
push str._sTTABLE
push 0x4a9a00
call fcn.004015c0
push 0x48b9c0
push 0x4a9a00
call fcn.0044c7ec
add esp, 0x24
mov dword [0x630d9c], eax
test eax, eax
je 0x40352f
push eax
push 1
push 0x100
push 0x4a9400
call fcn.0044d1b5
push dword [0x630d9c]
call fcn.0044c4fe
add esp, 0x14
ret
Function at 0x403b00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
push ebx
push str._sLASTD
push edi
call fcn.004015c0
push edi
call fcn.004026f0
push 0x48a470
push edi
call fcn.0044c7ec
mov esi, eax
add esp, 0x18
test esi, esi
je 0x403baf
push esi
push 1
lea eax, [ebp - 4]
push 2
push eax
call fcn.0044ca9e
push esi
call fcn.0044c4fe
add esp, 0x14
cmp word [ebp + 0x14], 1
jne 0x403b8c
inc word [ebp - 4]
push ebx
push str._sLASTD
push edi
call fcn.004015c0
push 0x48a574
push edi
call fcn.0044c7ec
mov esi, eax
lea eax, [ebp - 4]
push esi
push 1
push 2
push eax
call fcn.0044d1b5
add esp, 0x24
test esi, esi
je 0x403b8c
push esi
call fcn.0044c4fe
add esp, 4
movsx eax, word [ebp - 4]
mov esi, dword [ebp + 0xc]
push eax
push 0x48a578
push esi
call fcn.004015c0
push esi
push ebx
push str._s_s.TXT
push edi
call fcn.004015c0
add esp, 0x1c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412d00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x300]
push ebx
mov ebx, dword [ebp + 0x2fc]
push esi
mov esi, dword [ebp + 0x304]
push edi
mov di, word [ebp + 0x14]
test di, di
jle 0x412d96
push eax
push str.PIERS
push esi
push str._s_s_s
push ebx
call fcn.004015c0
push ebx
call fcn.004026f0
push 0x48a470
push ebx
call fcn.0044c7ec
mov ecx, 1
mov dword [0x630d9c], eax
add esp, 0x20
cmp cx, di
jg 0x412d83
mov esi, dword [ebp + 0x2f0]
add esi, 0x64
movzx edi, di
push eax
push 1
push 0x64
push esi
call fcn.0044ca9e
mov eax, dword [0x630d9c]
add esp, 0x10
add esi, 0x64
sub edi, 1
jne 0x412d62
mov esi, dword [ebp + 0x304]
test eax, eax
je 0x412d90
push eax
call fcn.0044c4fe
add esp, 4
mov eax, dword [ebp + 0x300]
push eax
push str.DOMAINS
push esi
push str._s_s_s
push ebx
call fcn.004015c0
push ebx
call fcn.004026f0
push 0x48a470
push ebx
call fcn.0044c7ec
mov dx, word [ebp + 0x3c]
mov edi, 1
add esp, 0x20
mov dword [0x630d9c], eax
cmp di, dx
jg 0x412e06
mov esi, dword [ebp + 0x2f4]
add esi, 0x5c
movzx edi, dx
nop dword [eax + eax]
push eax
push 1
push 0x5c
push esi
call fcn.0044ca9e
mov eax, dword [0x630d9c]
add esp, 0x10
add esi, 0x5c
sub edi, 1
jne 0x412de0
mov esi, dword [ebp + 0x304]
mov edi, 1
test eax, eax
je 0x412e13
push eax
call fcn.0044c4fe
add esp, 4
push dword [ebp + 0x300]
push str.NODES
push esi
push str._s_s_s
push ebx
call fcn.004015c0
push ebx
call fcn.004026f0
push 0x48a470
push ebx
call fcn.0044c7ec
mov dx, word [ebp + 0xa]
add esp, 0x20
mov dword [0x630d9c], eax
cmp di, dx
jg 0x412e79
mov esi, dword [ebp + 0x2f8]
add esi, 0x64
movzx edi, dx
push eax
push 1
push 0x64
push esi
call fcn.0044ca9e
mov eax, dword [0x630d9c]
add esp, 0x10
add esi, 0x64
sub edi, 1
jne 0x412e58
mov esi, dword [ebp + 0x304]
test eax, eax
je 0x412e86
push eax
call fcn.0044c4fe
add esp, 4
mov di, word [ebp + 0xe]
test di, di
jle 0x412ef4
push dword [ebp + 0x300]
push str.SUPPORTS
push esi
push str._s_s_s
push ebx
call fcn.004015c0
push 0x48a470
push ebx
call fcn.0044c7ec
add esp, 0x1c
mov dword [0x630d9c], eax
test eax, eax
je 0x412ef4
mov ecx, 1
cmp cx, di
jg 0x412eeb
mov esi, 0x4cf3a0
movzx edi, di
nop
push eax
push 1
push 0x60
push esi
call fcn.0044ca9e
mov eax, dword [0x630d9c]
add esp, 0x10
add esi, 0x60
sub edi, 1
jne 0x412ed0
push eax
call fcn.0044c4fe
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x425e20
Capabilities:
Create directory
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push 0
mov dword [ebp - 0x4c], 0x30
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x44], 0x426070
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], ebx
call esi
push 0x7f00
push 0
mov dword [ebp - 0x34], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0
mov dword [ebp - 0x30], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0x7f00
push 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], str.SteelN
call esi
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x426048
lea ecx, [ebp + 8]
push ecx
push 0x4a91a0
push eax
call fcn.00401000
push 0x4a91f1
push 0x48a46c
push 0x4aa200
call fcn.004015c0
push 0x4a9242
push 0x48a46c
push 0x4a9500
call fcn.004015c0
push 1
push 1
push 0x4aa200
call fcn.00401530
add esp, 0x30
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [ecx + 0x4aa200]
lea ecx, [ecx + 1]
mov byte [ecx + 0x4aa0ff], al
test al, al
jne 0x425f00
push edi
push 0x48a9c7
push 0x48a9c7
push 0x4aa200
push 0x48b9d8
push 0x4aa200
call fcn.00401430
push 0x48a470
push str.D:TRACEFHTEST
call fcn.0044c7ec
add esp, 0x1c
test eax, eax
je 0x425f95
push eax
mov byte [0x630821], 1
call fcn.0044c4fe
push 0x4aa100
push str.D:TRACETRACE_s
push 0x4a9700
call fcn.004015c0
push 0x4a9700
call fcn.00461965
mov edi, 0x4a9700
add esp, 0x14
dec edi
nop dword [eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x425f80
mov ax, word [0x48b960]
mov word [edi], ax
jmp 0x425f9c
mov byte [0x630821], 0
push str.Bemessung
push 0x48a46c
push 0x4aa800
call fcn.004015c0
add esp, 0xc
push 0
push ebx
push 0
push 0
push dword [0x4a7450]
push dword [0x4a744c]
push 0x80000000
push 0x80000000
push 0xcf0000
push str.Bewehrung
push str.SteelN
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
push dword [ebp + 0x14]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ebx, dword [sym.imp.USER32.dll_GetMessageA]
lea eax, [ebp - 0x1c]
push 0
push 0
push 0
push eax
call ebx
test eax, eax
je 0x42603c
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
nop dword [eax]
lea eax, [ebp - 0x1c]
push eax
call esi
lea eax, [ebp - 0x1c]
push eax
call edi
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call ebx
test eax, eax
jne 0x426020
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0x490d44
push str.Kommandozeile_leer
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10