joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406060
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi + 0x58]
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push eax
call edi
test eax, eax
sete byte [ebp - 1]
xor ebx, ebx
cmp dword [esi + 0x14], ebx
je 0x4060c1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [esi + 0x20]
cmp eax, ecx
je 0x4060b0
mov edx, dword [esi + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x14]
push 0xffffffffffffffff
push eax
call edi
test eax, eax
je 0x4060b0
mov ecx, dword [esi + 0x14]
push 0xfffffffffffffffe
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov dword [esi + 0x14], ebx
jmp 0x4060c7
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x4060d4
push eax
call edi
mov dword [esi + 8], ebx
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x4060e1
push eax
call edi
mov dword [esi + 0xc], ebx
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x406116
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x10]
lea edi, [esi + 0x28]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x406109
mov dword [edi], 0xffffffff
mov ecx, dword [esi + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], ebx
mov edx, dword [esi + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push edx
call edi
mov eax, dword [esi + 0x1c]
push eax
call edi
cmp byte [ebp - 1], bl
mov dword [esi + 0x20], ebx
pop edi
mov dword [esi + 0x24], ebx
pop ebx
je 0x40613f
mov ecx, dword [esi + 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esp, ebp
pop ebp
ret
Function at 0x406150
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x4ed310]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push ebx
lea eax, [ebp - 0x88]
push eax
push ebx
push ebx
mov esi, ecx
push ebx
push esi
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x88], ebx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x4062fe
nop
mov eax, dword [ebp - 0x88]
cmp eax, ebx
je 0x406310
mov dword [ebp - 0x8c], ebx
cmp eax, 0x7f
jb 0x4061ae
mov eax, 0x7f
push ebx
lea ecx, [ebp - 0x8c]
push ecx
push eax
lea edx, [ebp - 0x84]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4062fe
mov ecx, dword [ebp - 0x8c]
cmp ecx, ebx
je 0x4062fe
xor eax, eax
mov byte [ebp + ecx - 0x84], 0
mov dword [ebp - 0x90], eax
cmp ecx, ebx
jbe 0x4062de
mov edx, dword [edi + 0x30]
mov ecx, dword [edx]
cmp ecx, edx
je 0x406252
mov bl, byte [ebp + eax - 0x84]
cmp bl, byte [ecx + 0xc]
je 0x40626e
cmp byte [ecx + 0xe], 0
jne 0x406248
mov eax, dword [ecx + 8]
cmp byte [eax + 0xe], 0
jne 0x40622d
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0xe], 0
jne 0x406248
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0xe], 0
je 0x406221
jmp 0x406248
mov eax, dword [ecx + 4]
cmp byte [eax + 0xe], 0
jne 0x406246
cmp ecx, dword [eax + 8]
jne 0x406246
mov ecx, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xe], 0
je 0x406236
mov ecx, eax
cmp ecx, edx
jne 0x406203
mov eax, dword [ebp - 0x90]
mov cl, byte [ebp + eax - 0x84]
mov edx, dword [edi + 0x50]
mov byte [ebp - 0x98], cl
lea ecx, [edi + 0x3c]
cmp edx, 0x10
jb 0x406296
mov esi, dword [ecx]
jmp 0x406298
cmp dword [edi + 0x4c], 0
jbe 0x4062c3
mov al, byte [edi + 4]
test al, al
jne 0x406288
mov edx, dword [edi]
lea eax, [edi + 0x3c]
push eax
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
push 0xffffffffffffffff
lea ecx, [edi + 0x3c]
push 0
call fcn.00402d20
jmp 0x4062c3
mov esi, ecx
mov eax, dword [ecx + 0x10]
add eax, esi
cmp edx, 0x10
jb 0x4062a6
mov edx, dword [ecx]
jmp 0x4062a8
mov edx, ecx
test eax, eax
je 0x4062ae
sub eax, edx
mov edx, dword [ebp - 0x98]
push edx
push 1
push eax
call fcn.00406cc0
mov esi, dword [ebp - 0x94]
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp eax, dword [ebp - 0x8c]
jb 0x4061f3
xor ebx, ebx
push ebx
lea eax, [ebp - 0x88]
push eax
push ebx
push ebx
push ebx
push esi
mov dword [ebp - 0x88], ebx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x406190
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00499155
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.00499155
mov esp, ebp
pop ebp
ret
Function at 0x406740
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, ecx
mov eax, dword [esi + 0x58]
push 0xffffffffffffffff
push eax
call edi
mov ebx, dword [esi + 0x10]
test eax, eax
sete al
mov dword [ebp - 4], ebx
test al, al
je 0x406770
mov ecx, dword [esi + 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test ebx, ebx
je 0x4067b5
mov edx, dword [esi + 0x58]
push 0xffffffffffffffff
push edx
call edi
mov ecx, dword [esi + 0x24]
test eax, eax
sete al
cmp ecx, 1
sete bl
test al, al
je 0x406798
mov edx, dword [esi + 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test bl, bl
je 0x4067b5
mov eax, dword [ebp - 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
dec eax
neg eax
pop edi
sbb eax, eax
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406860
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, ecx
nop
mov eax, dword [esi + 0x58]
push 0xffffffffffffffff
push eax
call edi
mov ecx, dword [esi + 0x24]
test eax, eax
sete al
cmp ecx, 1
sete bl
test al, al
je 0x406894
mov edx, dword [esi + 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test bl, bl
jne 0x4068a2
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x406870
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 8]
push ecx
push edx
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
pop edi
pop esi
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x407a20
Capabilities:
Hash data using murmur3

Disassembly:
sub ebx, edx
not esi
xchg ebx, eax
call fcn.00447440
xor esi, 0x69285eb4
and dword [0x4f2737], esi
xor edx, ebp
add edi, ecx
dec edi
sub esi, dword [0x4f2b8b]
inc ebx
call fcn.00405175
add dword [0x4f25c9], esi
dec eax
rol edx, 0xf
not esi
ror edx, 8
rol edx, 8
not esi
ror edx, 0xf
inc eax
sub dword [0x4f24a7], edi
dec ebx
inc edi
sub edi, ecx
xor edx, ebp
sub dword [0x4f2639], esi
xor esi, 0x69285eb4
call fcn.00457e2c
xchg ebx, eax
not esi
add ebx, edx
push eax
sub dword [0x4f2747], ebx
xor esi, dword [0x4f2c3f]
not ecx
call fcn.00443c37
or esi, dword [0x4f2cac]
add esi, 0xa5da4f0f
or ebx, dword [0x4f2c89]
call fcn.00414728
sub ebx, dword [0x4f2bc1]
sub dword [0x4f272c], esi
ror esi, 0x19
call fcn.00452281
rol esi, 0x19
or dword [0x4f2325], ecx
sub esi, 0xa5da4f0f
call fcn.00421c2c
not ecx
xor dword [0x4f270b], ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
xchg edx, esi
sub ecx, dword [0x4f2a23]
not ecx
rol edi, 3
xchg edi, edx
add dword [0x4f26b3], ecx
call fcn.00412c12
rol edi, 0xd
or eax, 0x305e7e8
add byte [ecx + 0x4f27a81d], cl
add byte [ecx], dh
add eax, 0x4f2841
add dword [0x4f233a], ebx
call fcn.00456d6c
or dword [0x4f2522], edi
mov dword [0x4f2600], ecx
call fcn.00403c69
ror edi, 0xd
call fcn.00492700
and dword [0x4f24d2], ebx
xchg edi, edx
ror edi, 3
not ecx
xchg edx, esi
lea esi, [0x65c3d4]
xor edi, eax
and dword [0x4f2812], ecx
call fcn.0040bd44
sub dword [0x4f2375], esi
sub ebx, 0x357b16cc
add dword [0x4f240a], esi
xor ecx, edi
xchg ecx, esi
xor dword [0x4f2470], edx
sub ecx, esp
rol ebx, 0x1e
xchg eax, edx
xor esi, ecx
dec edx
rol ebx, 0x19
xor eax, dword [0x4f2f02]
rol ebx, 0x1e
sub dword [0x4f2426], ebx
or edi, dword [0x4f2bd5]
xchg ecx, esi
call fcn.0048951d
xchg ecx, esi
ror ebx, 0x1e
ror ebx, 0x19
inc edx
xor esi, ecx
xchg eax, edx
ror ebx, 0x1e
add ecx, esp
xor dword [0x4f237c], ecx
xchg ecx, esi
xor ecx, edi
mov dword [0x4f24f4], eax
add ebx, 0x357b16cc
xor dword [0x4f2498], ebx
call fcn.0049f768
xor edi, eax
xor esi, 0xc800
xor ecx, 0xf512a4b6
xor ebx, dword [0x4f29f6]
call fcn.0045ffb4
inc edx
dec eax
sub edx, 0xe03e3733
inc edi
xor ebx, eax
rol eax, 0xa
call fcn.0049cc9a
call fcn.00498b96
ror eax, 0xa
xor ebx, eax
dec edi
add edx, 0xe03e3733
inc eax
dec edx
call fcn.004742c5
xor ecx, 0xf512a4b6
add esi, 0xbc2c
Function at 0x40a8f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4bb9a8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
mov eax, dword [0x4ed310]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov edx, dword [ebp + 8]
push esi
push 2
mov dword [esp + 0x30], ecx
push eax
lea ecx, [esp + 0x18]
push ecx
push edx
mov ebx, edi
call fcn.0040a7b0
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
call edx
test al, al
je 0x40a95e
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40a9c4
push eax
jmp 0x40a9bc
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov eax, edx
sub eax, ecx
sar eax, 3
test eax, eax
je 0x40a9b7
mov ebx, dword [ecx + eax*8 - 8]
mov eax, dword [ecx + eax*8 - 4]
cmp ecx, edx
je 0x40a984
sub edx, 8
mov dword [esp + 0x10], edx
mov ecx, dword [ebp + 8]
push esi
push eax
push ebx
lea eax, [esp + 0x18]
push eax
push ecx
mov ebx, edi
call fcn.0040a7b0
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
test al, al
jne 0x40a953
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov eax, edx
sub eax, ecx
sar eax, 3
test eax, eax
jne 0x40a971
test ecx, ecx
je 0x40a9c4
push ecx
call fcn.0049855c
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40afc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4bb9a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
mov eax, dword [0x4ed310]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
push esi
push eax
mov ecx, edi
lea edx, [esp + 0x14]
mov dword [esp + 0x30], ebx
call fcn.0040ada0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, eax
sub edx, ecx
sar edx, 2
test edx, edx
je 0x40b054
mov edx, dword [eax - 4]
cmp ecx, eax
je 0x40b034
sub eax, 4
mov dword [esp + 0x10], eax
push esi
push edx
mov ecx, edi
lea edx, [esp + 0x14]
call fcn.0040ada0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, eax
sub edx, ecx
sar edx, 2
test edx, edx
jne 0x40b026
cmp ecx, ebx
je 0x40b061
push ecx
call fcn.0049855c
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40d190
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ba19b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4ed310]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00498061
push 4
mov dword [ebp - 4], 0
call fcn.0049964e
mov edi, eax
add esp, 4
test edi, edi
je 0x40d20c
call fcn.00497f39
mov dword [edi], eax
call fcn.00497cf8
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00498022
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x40d202
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0049804a
jmp 0x40d20e
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x410550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x4ed310]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x24], 0x310030
mov dword [ebp - 0x20], 0x330032
mov dword [ebp - 0x1c], 0x350034
mov dword [ebp - 0x18], 0x370036
mov dword [ebp - 0x14], 0x390038
mov dword [ebp - 0x10], 0x420041
mov dword [ebp - 0xc], 0x440043
mov dword [ebp - 8], 0x460045
xor esi, esi
jmp 0x4105a0
call fcn.0049a61a
and eax, 0x8000000f
jns 0x4105b1
dec eax
or eax, 0xfffffff0
inc eax
mov cx, word [ebp + eax*2 - 0x24]
mov word [ebp + esi*2 - 0x44], cx
inc esi
cmp esi, 0x10
jb 0x4105a0
push ebx
push 0
push edi
call fcn.00499330
add esp, 0xc
mov byte [edi], 8
xor eax, eax
pop esi
mov dl, byte [ebp + eax*2 - 0x44]
mov byte [edi + eax + 1], dl
inc eax
cmp eax, 0x10
jb 0x4105d3
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov byte [ebx + edi - 1], 0x11
call fcn.00499155
mov esp, ebp
pop ebp
ret 4
Function at 0x412180
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4bbcb6
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x4ed310]
xor eax, esp
mov dword [esp + 0x264], eax
push ebx
push esi
mov eax, dword [0x4ed310]
xor eax, esp
push eax
lea eax, [esp + 0x278]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [esp + 0x14], eax
xor edx, edx
mov eax, ecx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], dx
lea esi, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x4121e0
sub eax, esi
sar eax, 1
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.00401bf0
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x38]
mov dword [esp + 0x284], ebx
call fcn.00405320
mov byte [esp + 0x280], 2
cmp dword [esp + 0x2c], 8
jb 0x41222b
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0049855c
add esp, 4
xor edx, edx
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], dx
call fcn.00405480
test al, al
je 0x4122f0
mov eax, dword [esp + 0x38]
cmp eax, 0xffffffff
je 0x4122f0
push ebx
lea ecx, [esp + 0x14]
push ecx
push 0x200
lea edx, [esp + 0x78]
push edx
push eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4122f0
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov edx, eax
and edx, ecx
cmp edx, 0xffffffff
je 0x4122f0
add dword [esp + 0x64], eax
adc dword [esp + 0x68], ecx
cmp eax, 0x200
jne 0x4122f0
cmp ecx, ebx
jne 0x4122f0
cmp byte [esp + 0x26a], 0x55
jne 0x4122f0
cmp byte [esp + 0x26b], 0xaa
jne 0x4122f0
or edx, 0xffffffff
xor eax, eax
lea ecx, [esp + 0x22e]
lea ecx, [ecx]
cmp byte [ecx], bl
je 0x4122cb
cmp edx, 0xffffffff
jne 0x4122f0
mov edx, eax
inc eax
add ecx, 0x10
cmp eax, 4
jb 0x4122c0
mov ecx, dword [esp + 0x14]
add edx, edx
mov al, byte [esp + edx*8 + 0x22e]
mov byte [ecx], al
lea ecx, [esp + 0x34]
call fcn.00405400
mov al, 1
jmp 0x4122fb
lea ecx, [esp + 0x34]
call fcn.00405400
xor al, al
mov ecx, dword [esp + 0x278]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x264]
xor ecx, esp
call fcn.00499155
mov esp, ebp
pop ebp
ret 4
Function at 0x412950
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4bbc6c
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x100c4
call fcn.00499c70
mov eax, dword [0x4ed310]
xor eax, esp
mov dword [esp + 0x100c0], eax
push ebx
push esi
push edi
mov eax, dword [0x4ed310]
xor eax, esp
push eax
lea eax, [esp + 0x100d8]
mov dword fs:[0], eax
xor ebx, ebx
xor eax, eax
mov edi, edx
mov word [esp + 0x14], ax
mov eax, edi
mov esi, ecx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4129b3
sub eax, edx
sar eax, 1
push eax
push edi
lea ecx, [esp + 0x1c]
call fcn.00401bf0
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x50]
mov dword [esp + 0x100e4], ebx
call fcn.00405320
mov byte [esp + 0x100e0], 2
cmp dword [esp + 0x28], 8
jb 0x4129fe
mov edx, dword [esp + 0x14]
push edx
call fcn.0049855c
add esp, 4
xor eax, eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], ax
call fcn.00405480
test al, al
jne 0x412a75
xor ecx, ecx
mov eax, edi
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x412a36
sub eax, edx
sar eax, 1
push eax
push edi
lea ecx, [esp + 0x38]
call fcn.00401bf0
lea edi, [esp + 0x30]
lea esi, [esp + 0x84]
mov byte [esp + 0x100e0], 3
call fcn.00409830
push 0x4e2e64
mov edx, esi
push edx
call fcn.00499164
mov eax, dword [esp + 0x80]
cmp eax, dword [esp + 0x78]
jg 0x412b2a
jl 0x412a96
mov ecx, dword [esp + 0x7c]
cmp ecx, dword [esp + 0x74]
jae 0x412b2a
mov eax, dword [esp + 0x50]
cmp eax, 0xffffffff
je 0x412aef
push ebx
lea edx, [esp + 0x14]
push edx
push 0x10000
lea ecx, [esp + 0xd8]
push ecx
push eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x412aef
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov edx, eax
and edx, ecx
cmp edx, 0xffffffff
je 0x412aef
add dword [esp + 0x7c], eax
mov edx, dword [esi]
mov edx, dword [edx + 4]
adc dword [esp + 0x80], ecx
push eax
lea eax, [esp + 0xd0]
push eax
mov ecx, esi
call edx
jmp 0x412a75
push edi
lea eax, [esp + 0x34]
push str.Unable_to_read_the_file___s_.
push eax
call fcn.00405240
add esp, 0xc
push eax
lea ecx, [esp + 0x88]
push ecx
mov byte [esp + 0x100e8], 4
call fcn.00403180
push 0x4e2d94
lea edx, [esp + 0x88]
push edx
call fcn.00499164
cmp dword [esi + 0x30], ebx
je 0x412b34
call fcn.0041ea50
lea ecx, [esp + 0x4c]
call fcn.00405400
mov ecx, dword [esp + 0x100d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100c0]
xor ecx, esp
call fcn.00499155
mov esp, ebp
pop ebp
ret
Function at 0x412b70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb12b
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4ed310]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 4]
sub eax, dword [edi]
mov esi, edx
sar eax, 2
cmp eax, 0x10001
jb 0x412bb5
xor al, al
jmp 0x412c70
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], cx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x412bd0
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.00401bf0
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x412bf5
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x412c0c
test al, 0x10
jne 0x412c0c
mov eax, 1
jmp 0x412c0e
xor eax, eax
test al, al
sete bl
ret
cmp dword [ebp - 0x18], 8
jb 0x412c25
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0049855c
add esp, 4
test bl, bl
jne 0x412bae
push 0x2c
call fcn.0049964e
add esp, 4
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x412c5a
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
push edx
push 0
mov edx, esi
push ecx
mov esi, eax
call fcn.00412080
jmp 0x412c5c
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
call fcn.00437500
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00499155
mov esp, ebp
pop ebp
ret 0xc
Function at 0x412c90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4bb73b
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4ed310]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
mov eax, dword [0x4ed310]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, ecx
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov dword [esp + 0x18], eax
sar ecx, 2
cmp ecx, 0x10001
jb 0x412ce7
xor al, al
jmp 0x412e3c
xor edx, edx
mov eax, edi
mov word [esp + 0x1c], dx
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x412d03
sub eax, edx
sar eax, 1
push eax
push edi
lea ecx, [esp + 0x24]
call fcn.00401bf0
mov eax, dword [esp + 0x1c]
mov esi, 8
cmp dword [esp + 0x30], esi
jae 0x412d30
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x412d47
test al, 0x10
jne 0x412d47
mov eax, 1
jmp 0x412d49
xor eax, eax
test al, al
sete bl
cmp dword [esp + 0x30], esi
jb 0x412d61
mov eax, dword [esp + 0x1c]
push eax
call fcn.0049855c
add esp, 4
test bl, bl
jne 0x412ce0
xor ecx, ecx
mov eax, edi
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x412d85
sub eax, edx
sar eax, 1
push eax
push edi
lea ecx, [esp + 0x24]
call fcn.00401bf0
lea edx, [esp + 0x1c]
push edx
call fcn.00402310
add esp, 4
cmp dword [esp + 0x30], 8
mov ebx, eax
mov esi, edx
jb 0x412dc4
mov eax, dword [esp + 0x1c]
push eax
call fcn.0049855c
add esp, 4
cmp ebx, 0x12c000
jne 0x412dd0
test esi, esi
je 0x412df0
cmp ebx, 0x168000
jne 0x412ddc
test esi, esi
je 0x412df0
cmp ebx, 0x2d0000
jne 0x412ce0
test esi, esi
jne 0x412ce0
push 0x2c
call fcn.0049964e
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x48], 0
test eax, eax
je 0x412e1f
mov ecx, dword [ebp + 0xc]
push 1
push 0
push 1
push ecx
mov edx, edi
mov esi, eax
call fcn.00412080
jmp 0x412e21
xor eax, eax
mov edi, dword [esp + 0x18]
mov dword [esp + 0x48], 0xffffffff
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
call fcn.00437500
mov al, 1
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00499155
mov esp, ebp
pop ebp
ret 8