joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4110c4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [esp + 0x10], ebx
je 0x411113
push dword [esp + 0x10]
push 0x411042
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x41d6ec]
cmp esi, ebx
je 0x411167
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x41110b
cmp byte [esi + 0x10], bl
je 0x41110b
push 3
push ebx
push ebx
push ebx
push ebx
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, edi
cmp edi, ebx
jne 0x4110e8
jmp 0x411167
mov esi, dword [0x41d6ec]
cmp esi, ebx
je 0x411167
push ebp
mov ebp, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x411160
cmp byte [esi + 0x11], bl
je 0x41113d
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], bl
je 0x411153
push 3
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push edi
push 0x41d6ec
call fcn.00415bff
pop ecx
pop ecx
mov esi, ebp
cmp ebp, ebx
jne 0x41111e
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x4112b3
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [0x41d834]
call fcn.00415afd
or dword [ebp - 4], 0xffffffff
mov ebx, eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
movzx ecx, word [eax]
test cx, cx
je 0x411378
mov edx, dword [ebp + 8]
push 2
pop esi
cmp cx, 0x20
jne 0x4112f4
add eax, esi
cmp word [eax], 0x20
je 0x4112ec
movzx ecx, word [eax]
mov dword [ebp - 8], 1
cmp ecx, 0x22
jne 0x41132f
add eax, esi
movzx ecx, word [eax]
mov edi, eax
test cx, cx
je 0x41132b
cmp cx, 0x22
je 0x41131f
add eax, esi
movzx ecx, word [eax]
test cx, cx
jne 0x41130f
cmp word [eax], 0
je 0x41132b
mov edx, eax
add eax, esi
jmp 0x411354
mov edx, eax
jmp 0x411354
test cx, cx
je 0x411350
mov edi, eax
cmp cx, 0x20
je 0x411346
add eax, esi
movzx ecx, word [eax]
test cx, cx
jne 0x411336
cmp word [eax], 0
mov edx, eax
je 0x411354
jmp 0x411327
and dword [ebp - 8], 0
mov ecx, dword [ebx]
cmp ecx, dword [ebp - 4]
jne 0x411362
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x411383
xor edi, edi
cmp dword [ebp - 8], edi
je 0x41136c
inc dword [ebp - 4]
movzx ecx, word [eax]
test cx, cx
jne 0x4112e6
cmp dword [ebp + 8], 0
jne 0x411393
mov eax, dword [ebp - 4]
jmp 0x411399
test edi, edi
je 0x411396
sub edx, edi
sar edx, 1
mov dword [ecx], edx
inc dword [ebx]
mov eax, edi
jmp 0x411399
mov ecx, dword [ebp + 8]
and dword [ecx], 0
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x411998
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, 0x1000
xor esi, esi
cmp dword [ebp + 0xc], 0x18
push edi
mov dword [ebp - 0xc], ebx
je 0x411a3f
cmp dword [ebp + 0xc], 0x19
je 0x411a3f
push 0x2000
push esi
push dword [0x41d3f4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
jmp 0x411a15
cmp dword [ebp - 0x10], 2
jne 0x411a2e
cmp dword [ebp - 0xc], 0
jne 0x4119fd
lea eax, [esi + esi + 0x2000]
push eax
push edi
push 8
push dword [0x41d3f4]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edi, eax
mov dword [ebp - 0xc], ebx
mov ax, word [ebp - 8]
cmp ax, 0xa
je 0x411a2e
cmp ax, 0xd
je 0x411a15
mov word [edi + esi*2], ax
inc esi
dec dword [ebp - 0xc]
push 0
lea eax, [ebp - 0x10]
push eax
push 2
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4119d5
push dword [ebp + 0x10]
xor eax, eax
push edi
mov word [edi + esi*2], ax
call fcn.00416b50
jmp 0x411abd
push ebx
push esi
push dword [0x41d3f4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
jmp 0x411a8a
cmp dword [ebp - 0x10], 1
jne 0x411aa3
cmp dword [ebp - 0xc], 0
jne 0x411a78
lea eax, [esi + 0x1000]
push eax
push edi
push 8
push dword [0x41d3f4]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edi, eax
mov dword [ebp - 0xc], ebx
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x411aa3
cmp al, 0xd
je 0x411a8a
mov byte [edi + esi], al
inc esi
dec dword [ebp - 0xc]
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x411a51
cmp dword [ebp + 0xc], 0x18
push dword [ebp + 0x10]
mov byte [edi + esi], 0
push edi
jne 0x411ab8
call fcn.00416ba0
jmp 0x411abd
call fcn.00416c20
push edi
push 0
push dword [0x41d3f4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x41311d
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x45c
push ebx
push esi
or esi, 0xffffffff
mov ebx, esi
test eax, eax
je 0x413262
cmp word [eax], 0
je 0x413262
push 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [ebp + eax*2 - 0x20e]
cmp eax, 2
je 0x41317a
cmp eax, 3
jne 0x4131bf
cmp word [ebp - 0x20a], 0x3a
jne 0x4131bf
cmp eax, 2
jne 0x41319c
lea eax, [ebp - 0x20c]
push 0x41711c
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x413262
jmp 0x41325f
xor eax, eax
mov word [ecx], ax
sub ecx, 2
cmp word [ecx], 0x5c
je 0x4131b7
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x41320a
test byte [ebp - 0x45c], 0x10
je 0x4131ef
push 0xfffffffffffffffe
pop ebx
or esi, 0xffffffff
jmp 0x413201
mov esi, dword [ebp - 0x440]
xor ebx, ebx
or ebx, dword [ebp - 0x43c]
xor edx, edx
or esi, edx
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x413262
cmp word [ebp - 0x20c], 0x5c
jne 0x41321e
cmp word [ebp - 0x20a], 0x5c
je 0x413232
cmp word [ebp - 0x20c], 0x2e
jne 0x413262
cmp word [ebp - 0x20a], 0x2e
jne 0x413262
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41324a
test al, 0x10
je 0x413262
jmp 0x41325c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x413262
or esi, 0xffffffff
push 0xfffffffffffffffe
pop ebx
mov edx, esi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x413315
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [0x41d6fc], edi
jne 0x41333f
push fcn.004132e2
push 0x10
push 0x258
call fcn.00415ab4
mov dword [0x41d6fc], eax
cmp dword [ebp + 0xc], edi
jne 0x41334b
mov dword [ebp + 0xc], section..rdata
mov ebx, dword [ebp + 0x10]
cmp ebx, edi
je 0x413357
cmp word [ebx], di
jne 0x41335c
mov ebx, 0x417120
push dword [ebp + 0xc]
call sub.MSVCRT.dll_wcslen
push ebx
mov esi, eax
call sub.MSVCRT.dll_wcslen
pop ecx
pop ecx
add eax, esi
lea eax, [eax + eax + 4]
push eax
push edi
push dword [0x41d3f4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x41341f
push dword [ebp + 0xc]
push edi
call sub.MSVCRT.dll_wcscpy
pop ecx
pop ecx
test esi, esi
je 0x4133b3
mov eax, dword [ebp + 0xc]
cmp word [eax + esi*2 - 2], 0x5c
je 0x4133b3
push 0x41711c
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
push ebx
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
push dword [ebp + 8]
push dword [0x41d6fc]
call fcn.0041598e
mov esi, eax
lea eax, [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x4133e4
and dword [esi + 4], 0
jmp 0x4133f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4133fb
mov dword [esi + 4], 1
mov dword [ebp - 4], esi
jmp 0x413410
cmp dword [ebp + 8], 0xffffffff
jne 0x41340d
push esi
push dword [0x41d6fc]
call fcn.00415a79
and dword [esi], 0
push edi
push 0
push dword [0x41d3f4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x413488
Capabilities:
Set file attributes

Disassembly:
xor eax, eax
cmp dword [esp + 4], eax
je 0x413496
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret 8

Function at 0x4134ab
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x4134d4
test byte [esp + 8], 2
je 0x4134c8
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4134d6
xor eax, eax
ret 8

Function at 0x4134e7
Capabilities:
Copy file

Disassembly:
xor eax, eax
cmp dword [esp + 4], eax
je 0x413506
cmp dword [esp + 8], eax
je 0x413506
push eax
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x413508
xor eax, eax
ret 8
Function at 0x4137ce
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x4138a3
push edi
push esi
push pe_nt_image_headers32
push 3
push esi
push 3
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4138a2
mov esi, dword [ebp + 0x10]
push esi
call fcn.00415446
push esi
mov word [ebp - 0x20], ax
call fcn.0041546e
push esi
mov word [ebp - 0x1e], ax
call fcn.00415491
push esi
mov word [ebp - 0x1c], ax
call fcn.004154b3
push esi
mov word [ebp - 0x1a], ax
call fcn.004154d5
push esi
mov word [ebp - 0x18], ax
call fcn.004154f7
push esi
mov word [ebp - 0x16], ax
call fcn.00415519
mov word [ebp - 0x14], ax
xor eax, eax
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
xor eax, eax
xor edx, edx
xor ecx, ecx
cmp dword [ebp + 0xc], 1
jne 0x413881
lea edx, [ebp - 8]
jmp 0x41388f
cmp dword [ebp + 0xc], 2
jne 0x41388c
lea ecx, [ebp - 8]
jmp 0x41388f
lea eax, [ebp - 8]
push ecx
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
leave
ret 0xc

Function at 0x413910
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
cmp dword [esi + 0x14], eax
jne 0x413945
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4

Function at 0x413dc0
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x413e19
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x413e18
mov eax, dword [esp + 0x10]
mov ecx, dword [0x41d88c]
push eax
push ecx
call fcn.00415a13
test eax, eax
je 0x413e14
cmp dword [eax + 4], 0
je 0x413e02
push esi
push edi
push eax
call fcn.00414760
pop esi
pop edi
pop ecx
ret 0xc
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop esi
pop edi
pop ecx
ret 0xc
Function at 0x413ea0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [0x41d3f4]
push ebx
push ebp
push esi
push edi
mov ebx, 0x1000
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [esp + 0x1c]
mov edx, dword [0x41d88c]
push ecx
mov esi, eax
push edx
mov ebp, esi
call fcn.00415a13
mov dword [esp + 0x1c], eax
test eax, eax
je 0x413fb5
jmp 0x413ee4
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x13], 0
cmp dword [eax + 4], 0
lea ecx, [esp + 0x13]
je 0x413f02
push 1
push ecx
push eax
call fcn.00414860
mov dword [esp + 0x14], eax
jmp 0x413f15
push 0
lea edx, [esp + 0x18]
push edx
mov edx, dword [eax]
push 1
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, byte [esp + 0x13]
test al, al
je 0x413f25
mov byte [ebp], al
mov al, byte [esp + 0x13]
inc ebp
mov edi, ebp
sub edi, esi
cmp edi, ebx
jl 0x413f4c
mov eax, dword [0x41d3f4]
add ebx, 0x1000
push ebx
push esi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov al, byte [esp + 0x13]
lea ebp, [edi + esi]
test al, al
je 0x413fb5
cmp dword [esp + 0x14], 0
je 0x413f5f
cmp al, 0xd
je 0x413f5f
cmp al, 0xa
jne 0x413ee0
dec ebp
cmp al, 0xd
jne 0x413fb5
mov edi, dword [esp + 0x1c]
cmp dword [edi + 4], 0
je 0x413f7d
push 1
lea ecx, [esp + 0x17]
push ecx
push edi
call fcn.00414860
jmp 0x413f94
mov ecx, dword [edi]
push 0
lea edx, [esp + 0x18]
push edx
push 1
lea eax, [esp + 0x1f]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x413fb5
cmp dword [edi + 4], 0
je 0x413fa6
inc dword [edi + 0xc]
jmp 0x413fb5
mov edx, dword [edi]
push 1
push 0
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
mov byte [ebp], 0
call ebx
mov edi, eax
mov eax, dword [esp + 0x20]
push eax
lea ecx, [edi - 1]
push ecx
call fcn.00416280
push edi
push eax
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call ebx
mov edx, dword [0x41d3f4]
push esi
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8

Function at 0x414010
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov ecx, dword [0x41d88c]
push esi
push eax
push ecx
mov dword [esp + 0xc], 0
call fcn.00415a13
mov esi, eax
test esi, esi
je 0x414093
cmp dword [esi + 4], 0
je 0x414062
push 1
lea edx, [esp + 8]
push edx
push esi
call fcn.00414860
test eax, eax
je 0x414056
inc dword [esi + 0xc]
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, 1
pop esi
add esp, 8
ret 4
mov edx, dword [esi]
push 0
lea eax, [esp + 0xc]
push eax
push 1
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41409e
cmp dword [esp + 8], 0
je 0x41409e
mov eax, dword [esi]
push 1
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 4
or eax, 0xffffffff
pop esi
add esp, 8
ret 4
Function at 0x414110
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x41d88c]
push eax
push ecx
mov dword [esp + 8], 0
call fcn.00415a13
test eax, eax
je 0x414162
cmp dword [eax + 4], 0
je 0x414148
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push edx
push ecx
push eax
call fcn.00414860
pop ecx
ret 0xc
mov ecx, dword [esp + 0x10]
mov eax, dword [eax]
push 0
lea edx, [esp + 4]
push edx
mov edx, dword [esp + 0x14]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp]
pop ecx
ret 0xc

Function at 0x4141d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov ecx, dword [0x41d88c]
push esi
push eax
push ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.00415a13
mov esi, eax
test esi, esi
je 0x4142ae
mov eax, dword [esp + 0x14]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x414266
cmp word [eax], 0
je 0x414266
push edi
lea edx, [esp + 0x18]
push edx
push eax
push 0xfde9
call fcn.00414980
mov edi, eax
test edi, edi
je 0x414265
cmp dword [esi + 4], 0
je 0x414243
mov eax, dword [esp + 0x18]
push eax
push edi
push esi
call fcn.00414760
mov dword [esp + 0xc], eax
jmp 0x414255
mov edx, dword [esp + 0x18]
mov eax, dword [esi]
push 0
lea ecx, [esp + 0x10]
push ecx
push edx
push edi
push eax
call ebx
mov ecx, dword [0x41d3f4]
push edi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
cmp dword [esi + 4], 0
je 0x414289
push 2
push 0x4170e0
push esi
call fcn.00414760
mov ecx, eax
mov eax, dword [esp + 8]
pop ebx
add eax, ecx
pop esi
add esp, 8
ret 8
mov eax, dword [esi]
push 0
lea edx, [esp + 0x10]
push edx
push 2
push 0x4170e0
push eax
call ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
pop ebx
add eax, ecx
pop esi
add esp, 8
ret 8
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 8
Function at 0x414300
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x41d88c]
push eax
push ecx
call fcn.00415a13
test eax, eax
je case.0x414330.3
mov ecx, dword [esp + 8]
add ecx, 0xfffffffe
cmp ecx, 0x17
ja case.0x414330.3
movzx edx, byte [ecx + 0x414440]
jmp dword [edx*4 + 0x414428]
cmp dword [eax + 4], 0
je 0x41434d
push 2
push 0x417148
push eax
call fcn.00414760
ret 8
mov edx, dword [eax]
push 0
lea ecx, [esp + 8]
push ecx
push 2
push 0x417148
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
cmp dword [eax + 4], 0
je 0x41437d
push 3
push 0x4170dc
push eax
call fcn.00414760
ret 8
mov edx, dword [eax]
push 0
lea ecx, [esp + 8]
push ecx
push 3
push 0x4170dc
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
cmp dword [eax + 4], 0
je 0x4143ad
push 2
push 0x417144
push eax
call fcn.00414760
ret 8
mov edx, dword [eax]
push 0
lea ecx, [esp + 8]
push ecx
push 2
push 0x417144
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
cmp dword [eax + 4], 0
je 0x4143dd
push 4
push 0x41713c
push eax
call fcn.00414760
ret 8
mov edx, dword [eax]
push 0
lea ecx, [esp + 8]
push ecx
push 4
push 0x41713c
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
cmp dword [eax + 4], 0
je 0x41440d
push 4
push 0x417134
push eax
call fcn.00414760
ret 8
mov edx, dword [eax]
push 0
lea ecx, [esp + 8]
push ecx
push 4
push 0x417134
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x414490
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [0x41d88c]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push ebx
push eax
mov esi, 0x18
mov dword [esp + 0x14], 0
call fcn.00415a13
mov ebp, eax
test ebp, ebp
je 0x4145a1
push edi
push ebx
call fcn.00413e20
cmp dword [ebp + 4], 0
mov esi, eax
mov edi, edx
je 0x4144df
push 4
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.00414860
mov dword [esp + 0x10], eax
jmp 0x4144fb
mov ecx, dword [ebp]
push 0
lea edx, [esp + 0x14]
push edx
push 4
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
cmp eax, 2
jl 0x414518
cmp cl, 0xff
jne 0x414518
cmp ch, 0xfe
jne 0x414518
mov ebp, 0x19
add esi, 2
jmp 0x414575
cmp eax, 3
jl 0x414538
cmp cl, 0xef
jne 0x414538
cmp ch, 0xbb
jne 0x414538
cmp byte [esp + 0x1a], 0xbf
jne 0x414538
mov ebp, 2
add esi, 3
jmp 0x414575
cmp eax, 2
jl 0x414551
cmp cl, 0xfe
jne 0x414551
cmp ch, 0xff
jne 0x414551
mov ebp, 4
add esi, 2
jmp 0x414575
cmp eax, 4
jl 0x41458a
cmp ecx, 0xfeff
jne 0x414565
mov ebp, 5
jmp 0x414572
cmp ecx, 0xfffe0000
jne 0x41458a
mov ebp, 6
add esi, 4
adc edi, 0
push edi
push esi
push ebx
call fcn.00414170
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 4
push edi
push esi
push ebx
mov ebp, 0x18
call fcn.00414170
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 4
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x4146d0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
test esi, esi
je 0x414756
cmp word [esi], ax
je 0x414756
mov eax, dword [esp + 0xc]
mov ecx, dword [0x41d88c]
push edi
push eax
push ecx
call fcn.00415a13
mov edi, eax
test edi, edi
je 0x414751
lea edx, [esp + 0x14]
push edx
push esi
push 0xfde9
call fcn.00414980
mov esi, eax
test esi, esi
je 0x414751
cmp dword [edi + 4], 0
je 0x41472b
mov eax, dword [esp + 0x14]
push eax
push esi
push edi
call fcn.00414760
mov dword [esp + 8], eax
jmp 0x414741
mov edx, dword [esp + 0x14]
mov eax, dword [edi]
push 0
lea ecx, [esp + 0xc]
push ecx
push edx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [0x41d3f4]
push esi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 8

Function at 0x414760
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x14], 1
push edi
mov dword [esp + 8], 0
jne 0x414795
mov eax, dword [esi + 0xc]
mov ecx, dword [esi]
push 1
push 0
neg eax
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], edx
mov ecx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ecx, edi
jle 0x41480a
mov eax, dword [esi + 8]
add eax, dword [esi + 4]
sub eax, ecx
mov ecx, edi
dec ecx
je 0x4147f7
dec ecx
je 0x4147e2
sub ecx, 2
je 0x4147cf
mov ecx, dword [esp + 0x14]
push edi
push ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
mov dword [eax], ecx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cx, word [edx]
mov word [eax], cx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cl, byte [edx]
mov byte [eax], cl
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
push esi
call fcn.00413910
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x414837
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
push 0
lea edx, [esp + 0xc]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x14]
push edi
push edx
add ecx, eax
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x414860
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x14], 0
push edi
jne 0x414881
push esi
call fcn.00413910
mov dword [esi + 0x14], 1
mov dword [esi + 0xc], 0
mov ebx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ebx, edi
jl 0x4148f6
mov eax, dword [esi + 0x10]
add eax, dword [esi + 4]
mov ecx, edi
sub eax, ebx
dec ecx
je 0x4148e3
dec ecx
je 0x4148ce
sub ecx, 2
je 0x4148bb
push edi
push eax
mov eax, dword [esp + 0x1c]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [eax]
mov edx, dword [esp + 0x14]
mov dword [edx], ecx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov ax, word [eax]
mov ecx, dword [esp + 0x14]
mov word [ecx], ax
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov dl, byte [eax]
mov eax, dword [esp + 0x14]
mov byte [eax], dl
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [esi + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
sub ecx, ebx
add ecx, dword [esi + 4]
push ebx
push ecx
push ebp
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
sub edi, ebx
add ebp, ebx
push 0
cmp edi, eax
jl 0x41493f
mov eax, dword [esi]
lea edx, [esp + 0x18]
push edx
push edi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi + 0xc], 0
pop esi
add eax, ebx
pop ebx
ret 0xc
mov edx, dword [esi + 4]
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [esi]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp edi, eax
jle 0x414962
mov edi, eax
mov ecx, dword [esi + 4]
push edi
push ecx
push ebp
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0xc], edi
add esp, 0xc
pop ebp
lea eax, [ebx + edi]
pop edi
pop esi
pop ebx
ret 0xc