joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421655
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x57e9d0]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x421698
cmp word [esi], dx
jne 0x421698
or byte [edi + eax + 0x28], 4
jmp 0x42169d
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x4217f0
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4217d0
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4216df
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x421715
cmp eax, edx
jae 0x421721
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4216b7
jmp 0x4217f0
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4217cc
cmp dword [ebp - 0x14], 0
je 0x4217cc
mov eax, dword [ebx*4 + 0x57e9d0]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4217a4
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x42176d
mov word [esi], cx
jmp 0x4217a0
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x57e9d0]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x57e9d0]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x57e9d0]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x4217f0
pop ebx
cmp word [ebp - 4], bx
jne 0x4217b5
cmp esi, dword [ebp + 0xc]
jne 0x4217b5
mov word [esi], bx
jmp 0x4217ed
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004221ca
add esp, 0x10
cmp word [ebp - 4], bx
je 0x4217f0
push 0xd
jmp 0x4217e9
mov ecx, dword [ebx*4 + 0x57e9d0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4217e7
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4217f0
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x426295
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x426332
push ebx
push esi
call fcn.0042625e
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00425065
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4262df
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x426331
push edi
push eax
call fcn.0041d55c
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4262ff
call fcn.0041d522
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x426330
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00425065
add esp, 0x20
test eax, eax
jne 0x42631e
push edi
call fcn.0041d522
jmp 0x426326
push ebx
call fcn.0041d522
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x42d0e5
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0042d061
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x42d25d
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x42d25d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x42d20c
jg 0x42d13e
test eax, eax
je 0x42d202
push 1
push 0x1000
call fcn.00420d79
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x42d164
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x42d1f9
push 0x8000
push ebx
call fcn.0041bb40
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x42d190
jg 0x42d18b
cmp ecx, 0x1000
jb 0x42d190
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0042093b
add esp, 0x10
cmp eax, 0xffffffff
je 0x42d1d5
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x42d18b
jl 0x42d1bc
test ecx, ecx
jne 0x42d17d
push dword [ebp - 0xc]
push ebx
call fcn.0041bb40
push esi
call fcn.0041d522
add esp, 0xc
xor edi, edi
jmp 0x42d26e
cmp byte [edi + 0x24], 0
je 0x42d1ec
cmp dword [edi + 0x20], 5
jne 0x42d1ec
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x42d1f7
mov edi, dword [edi + 0x18]
jmp 0x42d1f9
xor edi, edi
push esi
call fcn.0041d522
pop ecx
jmp 0x42d26e
test ecx, ecx
jg 0x42d1ce
jl 0x42d20c
test eax, eax
jae 0x42d1ce
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004221ca
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x42d22f
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x42d1ce
jmp 0x42d266
push ebx
call fcn.0042697c
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x42d1ce
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x42d26e
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x42d26b
mov edi, dword [edi + 0x18]
jmp 0x42d26e
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004221ca
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42ee00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push edi
mov ebx, ecx
mov edi, dword [eax*4 + 0x44fc60]
cmp edi, 0x21
je 0x42eed9
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
test ax, ax
jns 0x42ee58
mov eax, dword [edi*4 + 0x44fe28]
mov ecx, ebx
not eax
and dword [0x45ed8c], eax
and dword [0x45ed88], eax
and dword [0x45ed90], eax
push 0x45ed88
call fcn.00431a40
pop esi
pop edi
pop ebx
pop ebp
ret 8
push 0x12
call esi
push edi
mov ecx, 0x45ed88
mov si, ax
call fcn.00401390
test si, si
jns 0x42ee7f
pop esi
not al
and al, 1
pop edi
mov byte [0x45eda0], al
pop ebx
pop ebp
ret 8
xor edx, edx
cmp byte [ebp + 0xc], 1
sete dl
xor ecx, ecx
inc edx
cmp byte [ebp + 0xc], 1
sete cl
add ecx, 5
cmp eax, edx
je 0x42eec4
cmp eax, ecx
jne 0x42eea1
xor ecx, ecx
jmp 0x42eec4
cmp byte [ebp + 0xc], 0
mov eax, 0x18
mov esi, 4
cmovne eax, esi
mov eax, dword [eax + 0x44fc40]
test dword [edi*4 + 0x44fd80], eax
cmovne edx, ecx
mov ecx, edx
push ecx
push edi
mov ecx, 0x45ed88
call fcn.00432620
push ecx
mov ecx, ebx
call fcn.00431a40
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x430ad0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x45ebe8], 0
mov edx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], edx
je 0x430b06
mov edx, dword [0x45ebf0]
test edx, edx
je 0x430b21
mov ecx, edi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x430af3
mov edx, dword [ebp - 4]
jmp 0x430b23
mov eax, dword [0x456bdc]
test eax, eax
je 0x430b23
push edi
push 0x96
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov edx, dword [ebp - 4]
jmp 0x430b23
mov edx, ecx
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x430b28
push dword [edx + 0xa8]
sub esi, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 1
jne 0x430b9e
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea eax, [esi + 0xa]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [0x5e0840], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
lea ecx, [esi + 1]
push ecx
push edi
push eax
call fcn.0040c210
add esp, 0xc
push dword [0x5e0840]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [0x5e0840]
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 4
cmp byte [0x45ebe8], 0
je 0x430bce
mov ecx, dword [0x45ebf0]
test ecx, ecx
je 0x430be8
mov edx, str.Cannot_Open_Clipboard
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x430bb6
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x456bdc]
test eax, eax
je 0x430be8
push str.Cannot_Open_Clipboard
push 0x96
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x431810
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x48
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push esi
push 0
push 0
mov edi, ecx
push dword [edi + 0x14]
push dword [edi + 0x10]
push 0x80000000
push 0x80000000
push 0x2cf0000
push str.GuiNN_Checkers_2.06_avx2
push str.GuiCheckersClass
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [edi + 0xa8], eax
test eax, eax
jne 0x431862
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0
push 0x42f940
push eax
push str.BotWnd
push esi
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [edi + 0xac], eax
mov ecx, edi
mov eax, dword [edi]
push esi
call dword [eax + 0x30]
push 1
push 0xb4
push dword [edi + 0x10]
push 0x226
push 0
push dword [edi + 0xac]
call dword [sym.imp.USER32.dll_MoveWindow]
push 5
push dword [edi + 0xa8]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 0xa8]
mov esi, dword [edi]
call dword [sym.imp.USER32.dll_GetMenu]
push eax
mov ecx, edi
call dword [esi + 0x40]
push 0
call fcn.00430a50
push 0x45ed88
mov ecx, edi
call fcn.00431a40
push ecx
mov ecx, 0x45ed10
call fcn.00434f40
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov byte [esp + 0x29], 0
call fcn.004325a0
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0xfff
mov dword [esp + 0x14], 0xfff00000
mov byte [esp + 0x28], 0
call fcn.004325a0
movaps xmm0, xmmword [esp + 0x10]
lea eax, [esp + 0x30]
movaps xmmword [esp + 0x30], xmm0
mov ecx, 0x45ed10
movaps xmm0, xmmword [esp + 0x20]
push 1
push eax
movaps xmmword [esp + 0x48], xmm0
call fcn.00434e60
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 0xc]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x34]
push 0x45ed88
mov ecx, edi
call fcn.00431a40
lea eax, [esp + 0x10]
mov ecx, 0x45ed10
push eax
call fcn.00434880
cmp dword [eax + 0x14], 0x10
jb 0x43197d
mov eax, dword [eax]
cmp byte [0x45ebe8], 0
je 0x4319a0
mov edx, dword [0x45ebf0]
test edx, edx
je 0x4319b7
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx], cl
lea edx, [edx + 1]
test cl, cl
jne 0x431990
jmp 0x4319b7
mov ecx, dword [0x456bdc]
test ecx, ecx
je 0x4319b7
push eax
push 0x96
push ecx
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov edx, dword [esp + 0x24]
cmp edx, 0x10
jb 0x4319e9
mov ecx, dword [esp + 0x10]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4319df
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4319f3
push edx
push ecx
call fcn.0040a81d
add esp, 8
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.00411e41
int3
Function at 0x431d10
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x431d6e
cmp byte [0x45ebe8], al
je 0x431d4c
mov eax, dword [0x45ebf0]
test eax, eax
je 0x431d66
mov edx, str.No_Clipboard_Data
mov cl, byte [edx]
lea edx, [edx + 1]
mov byte [eax], cl
lea eax, [eax + 1]
test cl, cl
jne 0x431d36
xor eax, eax
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x456bdc]
test eax, eax
je 0x431d66
push str.No_Clipboard_Data
push 0x96
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
xor eax, eax
mov esp, ebp
pop ebp
ret 8
push esi
push edi
push dword [0x456bd8]
call dword [sym.imp.USER32.dll_OpenClipboard]
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, eax
mov edi, edx
lea eax, [edi + 1]
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x431d95
mov esi, dword [ebp + 8]
sub edi, eax
cmp dword [ebp + 0xc], edi
cmovl edi, dword [ebp + 0xc]
push edi
push edx
push esi
call fcn.0040c210
add esp, 0xc
mov byte [edi + esi], 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x433630
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push 0x4513f0
xor esi, esi
push ecx
mov dword [ebp - 0xc], esi
call fcn.00411fd3
mov ebx, eax
add esp, 8
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x433786
mov ecx, dword [0x45ed68]
mov eax, dword [0x45ed64]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], eax
cmp eax, ecx
je 0x43377d
push edi
mov edi, dword [eax]
lea eax, [ebp - 0x10]
push ebx
push 1
push 4
push eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
call fcn.00413625
push ebx
push 1
lea eax, [ebp - 0x14]
push 4
push eax
call fcn.00413625
mov ecx, dword [edi + 0x10b4]
add esp, 0x20
cmp dword [ebp - 0x10], ecx
jne 0x43375a
mov eax, dword [ebp - 0x14]
cmp eax, dword [edi + 0x10b8]
jne 0x43375a
xor ebx, ebx
test ecx, ecx
je 0x43374d
lea esi, [edi + 0x4c]
nop
push dword [ebp - 4]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push 1
push 4
push eax
call fcn.00413625
push dword [ebp - 4]
mov ecx, dword [esi + 4]
mov eax, dword [esi]
push dword [ebp - 8]
push 2
lea eax, [eax + ecx*2]
push eax
call fcn.00413625
mov ecx, dword [esi - 4]
add esp, 0x20
xor edx, edx
test ecx, ecx
je 0x43372f
lea edi, [esi + 0xc]
nop dword [eax]
mov ecx, dword [esi + 8]
lea edi, [edi + 4]
mov eax, dword [esi]
add ecx, edx
inc edx
movsx eax, word [eax + ecx*2]
shl eax, 8
mov dword [edi - 4], eax
mov ecx, dword [esi - 4]
cmp edx, ecx
jb 0x433710
mov edi, dword [ebp - 0x1c]
mov eax, dword [esi - 8]
inc eax
imul eax, ecx
cmp dword [ebp - 8], eax
jne 0x433754
inc ebx
add esi, 0x41c
cmp ebx, dword [edi + 0x10b4]
jb 0x4336d0
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
mov al, 1
jmp 0x43375c
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
xor al, al
mov byte [edi + 0x115c], al
movzx eax, al
add esi, eax
mov eax, dword [ebp - 0x18]
add eax, 4
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x20]
jne 0x433672
pop edi
push ebx
call fcn.0041210f
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a070
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x320
push ebx
push esi
push edi
push 0x4513f0
push ecx
mov ebx, edx
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
call fcn.00411fd3
mov edi, eax
add esp, 8
test edi, edi
je 0x43a2df
push edi
push 1
lea eax, [ebp - 0x18]
push 8
push eax
call fcn.00413625
mov eax, 0x200
add esp, 0x10
cmp word [ebp - 0x16], ax
jg 0x43a2df
mov al, byte [ebp - 0x18]
test al, al
je 0x43a2df
cmp al, 4
jg 0x43a2df
cmp dword [ebp - 0x14], 0x124f81
jg 0x43a2df
push 0x13d620
call fcn.00419acf
push 0x13d620
mov dword [0x596f18], eax
call fcn.00419acf
push 0x4f5880
mov dword [0x5af074], eax
call fcn.00419acf
push edi
mov dword [0x5b0094], eax
call fcn.004133d8
add esp, 0x10
test eax, eax
jne 0x43a2ab
mov ax, word [ebp - 0x16]
inc dword [0x57ee0c]
test ax, ax
je 0x43a145
push edi
cwde
push 1
push eax
lea eax, [ebp - 0x31c]
push eax
call fcn.00413625
add esp, 0x10
push edi
push 1
push dword [ebp - 0x14]
push dword [0x596f18]
call fcn.00413625
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push edi
push 1
push 8
push eax
mov dword [ebp - 0xc], esi
call fcn.00413625
add esp, 0x20
test esi, esi
je 0x43a1bd
lea eax, [ebp - 0x31c]
push eax
call fcn.00419872
push eax
call fcn.00419a3c
push ebx
mov esi, eax
call fcn.00419872
push eax
call fcn.00419a3c
add esp, 0x10
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x43a1b4
test cl, cl
je 0x43a1b0
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x43a1b4
add eax, 2
add esi, 2
test cl, cl
jne 0x43a194
xor eax, eax
jmp 0x43a1b9
sbb eax, eax
or eax, 1
test eax, eax
je 0x43a1d3
push edi
call fcn.004133d8
add esp, 4
test eax, eax
je 0x43a122
jmp 0x43a2ab
lea eax, [ebp - 8]
push eax
push ecx
call fcn.00439900
mov ebx, dword [0x5af074]
lea eax, [ebp - 0xc]
mov edx, dword [0x596f18]
mov ecx, ebx
push eax
push dword [ebp - 8]
call fcn.00439e40
add esp, 0x10
mov dword [ebp - 8], 0
xor eax, eax
mov byte [ebp + eax - 0x11c], al
inc eax
cmp eax, 0x100
jl 0x43a203
mov esi, dword [ebp - 0xc]
test esi, esi
jle 0x43a277
mov eax, dword [0x596f18]
mov edx, ebx
sub eax, ebx
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], eax
nop dword [eax + eax]
movzx ecx, byte [eax + edx]
lea edx, [edx + 1]
mov bl, byte [ebp + ecx - 0x11c]
mov byte [edx - 1], bl
test ecx, ecx
je 0x43a266
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x11d]
mov byte [ebp + ecx - 0x11c], al
dec ecx
test ecx, ecx
jg 0x43a250
mov eax, dword [ebp - 0x10]
mov byte [ebp - 0x11c], bl
sub esi, 1
jne 0x43a230
mov ebx, dword [0x5af074]
lea eax, [ebp - 0xc]
push eax
push ecx
call fcn.00439f00
mov ecx, dword [0x596f18]
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
mov edx, ebx
call fcn.00439e40
push dword [ebp - 8]
push ebx
push dword [ebp + 8]
call fcn.0040c210
add esp, 0x1c
mov dword [ebp - 0x10], 1
push edi
call fcn.0041210f
push dword [0x596f18]
call fcn.00413251
push dword [0x5af074]
call fcn.00413251
push dword [0x5b0094]
call fcn.00413251
mov eax, dword [ebp - 0x10]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4411c0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x118
push esi
push edi
push 0x4513f0
push dword [ebx + 8]
mov dword [ebp - 0x18], ecx
call fcn.00411fd3
mov esi, eax
mov dword [ebp - 0x14], 0
add esp, 8
mov eax, 0xffff8ad0
xor edi, edi
mov word [ebp - 0xa], ax
test esi, esi
jne 0x441216
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
push esi
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], edi
push 4
push eax
call fcn.00413625
push esi
push 1
lea eax, [ebp - 0xc]
push 2
push eax
call fcn.00413625
push esi
push 1
lea eax, [ebp - 0xa]
push 2
push eax
call fcn.00413625
push esi
push 1
lea eax, [ebp - 4]
push 2
push eax
call fcn.00413625
movzx eax, word [ebp - 4]
add esp, 0x40
mov dword [ebp - 4], eax
push esi
call fcn.004133d8
add esp, 4
test eax, eax
jne 0x4412da
movzx eax, word [ebp - 0xc]
inc edi
mov ecx, dword [ebp - 0x18]
push 1
push dword [ebp - 0xa]
shl eax, 0x10
push dword [ebp - 0x10]
add eax, dword [ebp - 4]
push eax
call fcn.00440de0
push esi
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push 4
push eax
call fcn.00413625
push esi
push 1
lea eax, [ebp - 0xc]
push 2
push eax
call fcn.00413625
push esi
push 1
lea eax, [ebp - 0xa]
push 2
push eax
call fcn.00413625
push esi
push 1
lea eax, [ebp - 4]
push 2
push eax
call fcn.00413625
movzx eax, word [ebp - 4]
add esp, 0x40
mov dword [ebp - 4], eax
push esi
call fcn.004133d8
add esp, 4
test eax, eax
je 0x441268
push esi
call fcn.0041210f
add esp, 4
lea eax, [ebp - 0x118]
push edi
push str._d_Positions_Loaded
push 0xff
push eax
call fcn.00401170
add esp, 0x10
cmp byte [0x45ebe8], 0
je 0x441334
mov ecx, dword [0x45ebf0]
test ecx, ecx
je 0x441350
lea edx, [ebp - 0x118]
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x441316
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
mov eax, dword [0x456bdc]
test eax, eax
je 0x441350
lea ecx, [ebp - 0x118]
push ecx
push 0x96
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x71bf5480
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x6ae061c
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x43b643
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x43b3c1
sub ecx, ecx
call fcn.0043b673
inc eax
mov eax, eax
xor dword [edx], esi
sub eax, 1
inc edx
sub ecx, 0x51250e85
inc ecx
cmp edx, edi
jne fcn.0043b643
and eax, ecx
mov eax, 0xa5978c48
dec ecx
ret
Function at 0x41ac10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4625c1
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x482738]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea esi, [edi + 4]
mov dword [edi], 0x472290
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0041cb50
mov dword [esi], eax
mov dword [ebp - 4], 4
lea eax, [edi + 0x18]
mov dword [edi + 0xc], 0
xorps xmm0, xmm0
mov dword [edi + 0x14], 0x474fb4
movdqu xmmword [eax], xmm0
push eax
movq qword [eax + 0x10], xmm0
call fcn.004451d5
mov byte [ebp - 4], 5
lea eax, [edi + 0x38]
mov dword [edi + 0x30], 0
xorps xmm0, xmm0
mov dword [edi + 0x34], 0x474fb4
movdqu xmmword [eax], xmm0
push eax
movq qword [eax + 0x10], xmm0
call fcn.004451d5
mov byte [ebp - 4], 6
mov dword [edi + 0x50], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret