joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401788
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a0
sub eax, 0x194c
cmp ecx, eax
je 0x4017b7
add eax, 0x13f1
test ecx, ecx
jne 0x4017c2
cmp edx, 0xbf
jne 0x4017c2
add ecx, 0x36e9
sub eax, 0xfd1
sub dword [ebp - 0x40], eax
sub ecx, 0x2137
sub edx, 0x5a4
sub ecx, 0x5a4
xor eax, 0x431
add ecx, 0x431
test edx, edx
je 0x401815
or ecx, 0x24be
and ecx, 0x24be
cmp ecx, edx
je 0x40181b
and ecx, 0x1f3d
or edx, 0x1340
cmp edx, eax
je 0x40181b
sub eax, dword [ebp - 0x54]
add ecx, 0x22a2
add eax, 0x291b
sub eax, 0x6e3
add dword [ebp - 0x2d4], edx
or dword [ebp - 0x2c], eax
or eax, dword [ebp - 0x1b8]
cmp eax, edx
je 0x40183e
sub edx, 0x21c3
lea edx, [ebp - 0x78]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add ecx, 0x3b62
cmp ecx, dword [ebp - 0x180]
je 0x401856
add eax, 0x13a3
cmp edx, 0x176
jne 0x4018e4
or edx, dword [ebp - 0xbc]
cmp eax, edx
je 0x4018d8
or eax, 0x2cc3
sub edx, 0x7f7
cmp ecx, dword [ebp - 0x1cc]
je 0x4018ba
xor edx, 0x19a0
add edx, 0x19a0
and eax, 0x374e
cmp dword [ebp - 0x64], eax
je 0x4018c6
and ecx, dword [ebp - 0x32c]
and edx, dword [ebp - 0x33c]
test ecx, ecx
je 0x4018e4
add edx, 0x7e0
sub edx, 0xfda
add eax, dword [ebp - 0x1d0]
add ecx, 0x2a2f
add ecx, dword [ebp - 0x94]
and ecx, 0x1047
add dword [ebp - 0x214], ecx
add edx, dword [ebp - 0x1b0]
call dword [sym.imp.MSVCRT.dll_rand]
xor dword [ebp - 0x90], edx
or ecx, dword [ebp - 0x120]
cmp ecx, 0x1f
jne 0x40197e
or edx, dword [ebp - 0x260]
cmp edx, 0x1a9
je 0x401984
or eax, 0xab8
sub edx, 0x1f9a
and dword [ebp - 0x31c], eax
cmp eax, dword [ebp - 0x2c4]
je 0x40198a
add dword [ebp - 0x194], ecx
sub dword [ebp - 0x224], edx
sub edx, 0x1de5
xor eax, 0x2e39
cmp ecx, 0x121
je 0x401984
or edx, 0x1279
cmp ecx, 0x26c
je 0x401975
xor edx, 0x20ef
add dword [ebp - 0x15c], ecx
add ecx, 0x12b3
add dword [ebp - 0x58], edx
and edx, 0x2f8e
or dword [ebp - 0x2e4], ecx
xor eax, dword [ebp - 0x2f0]
push ecx
call dword [sym.imp.USER32.dll_IsIconic]
sub ecx, dword [ebp - 0x34]
sub eax, 0x188c
cmp dword [ebp - 0x110], eax
jne 0x4019d5
and dword [ebp - 0x214], eax
and ecx, dword [ebp - 0xc4]
test ecx, ecx
jne 0x4019cf
and eax, 0x27bd
xor edx, 0x23db
or eax, 0x2540
and ecx, 0x1151
or eax, 0x392a
leave
ret
Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x15a22a85
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1cf16b40
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401150
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40116b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4011a2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x40119e
jmp 0x401190
cmp esi, eax
jae 0x4011a2
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401190
cmp esi, eax
jb 0x4011a9
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x405cb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57424c
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5f6998]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ebx, [esi + 0x30]
mov dword [ebp - 0x10], ebx
call fcn.00440a7e
xor ecx, ecx
xor edi, edi
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x405cff
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 4], 1
lea ebx, [esi + 0x34]
mov dword [ebp - 0x10], ebx
call fcn.00440a7e
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x405d34
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 3
lea ebx, [esi + 0x38]
mov dword [ebp - 0x10], ebx
call fcn.00440a7e
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x405d66
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 5
lea ebx, [esi + 0x3c]
mov dword [ebp - 0x10], ebx
call fcn.00440a7e
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x405d98
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [ebp - 0x10]
add eax, 0x10
mov dword [ecx], eax
mov byte [ebp - 4], 7
push edi
push 0x58df78
lea ecx, [esi + 0x34]
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
call fcn.00402a10
push edi
push 0x58df78
lea ecx, [esi + 0x30]
mov dword [esi + 0x40], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
call fcn.00402a10
push edi
push 0x58df78
lea ecx, [esi + 0x38]
mov dword [esi + 0x24], edi
call fcn.00402a10
push edi
push 0x58df78
mov ecx, ebx
mov dword [esi + 0x28], edi
call fcn.00402a10
mov dword [esi + 0x2c], edi
mov dword [esi + 0xc], edi
mov dword [esi + 8], edi
mov dword [esi + 4], edi
mov dword [esi], edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407770
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
mov eax, dword [0x5f6998]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
cmp word [edi], 0
mov dword [ebp - 0x668], ecx
je 0x4078eb
lea edx, [ebp - 0x20c]
mov eax, edi
sub edx, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4077a1
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4077c0
sub eax, edx
sar eax, 1
push esi
mov esi, eax
lea eax, [ebp - 0x20c]
add eax, 0xfffffffe
cmp word [ebp + esi*2 - 0x20e], 0x5c
jne 0x407805
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4077e6
mov ecx, dword [0x58ef30]
mov edx, dword [0x58ef34]
mov dword [eax], ecx
mov dword [eax + 4], edx
jmp 0x40782d
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x407805
mov ecx, dword [0x58ef24]
mov edx, dword [0x58ef28]
mov dword [eax], ecx
mov cx, word [0x58ef2c]
mov dword [eax + 4], edx
mov word [eax + 8], cx
lea edx, [ebp - 0x664]
push edx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x4078cd
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push edi
call ebx
test eax, eax
jne 0x4078a1
add esi, 0xfffffffe
js 0x40788a
nop
cmp word [edi + esi*2], 0x5c
je 0x40786c
dec esi
jns 0x407860
jmp 0x40788a
lea ecx, [esi + 1]
push ecx
lea edx, [ebp - 0x414]
push edi
push edx
call fcn.0054334c
add esp, 0xc
xor eax, eax
mov word [ebp + esi*2 - 0x414], ax
lea ecx, [ebp - 0x414]
push ecx
mov ecx, dword [ebp - 0x668]
call fcn.00407770
push 0
push edi
call ebx
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
pop esi
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00542c3e
mov esp, ebp
pop ebp
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00542c3e
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop edi
call fcn.00542c3e
mov esp, ebp
pop ebp
ret 4
Function at 0x407900
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x5f6998]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp - 0x110]
push eax
push 0x20019
xor edi, edi
push edi
push str.SystemCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x118], 0x104
mov dword [ebp - 0x11c], 1
mov dword [ebp - 0x110], edi
mov dword [ebp - 0x114], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4079a2
push esi
lea ecx, [ebp - 0x10c]
push str._sConnection
push ecx
call fcn.00543458
mov ecx, dword [ebp - 0x110]
add esp, 0xc
lea edx, [ebp - 0x114]
push edx
push 0x20019
push edi
lea eax, [ebp - 0x10c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4079b6
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00542c3e
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x118]
push eax
mov eax, dword [ebp - 0x114]
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x11c]
push edx
push edi
push str.PnpInstanceID
push eax
mov dword [ebp - 0x118], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x407a09
push 3
lea ecx, [ebp - 0x10c]
push 0x58ef38
push ecx
call fcn.00543398
add esp, 0xc
test eax, eax
jne 0x407a09
lea edi, [eax + 1]
mov edx, dword [ebp - 0x114]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
mov eax, dword [ebp - 0x110]
push eax
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00542c3e
mov esp, ebp
pop ebp
ret 4
Function at 0x407a40
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x52c
mov eax, dword [0x5f6998]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x510]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x524], 0x104
mov dword [ebp - 0x51c], 1
mov dword [ebp - 0x510], 0
mov dword [ebp - 0x514], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x407aaf
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00542c3e
mov esp, ebp
pop ebp
ret 4
push esi
push 0x3ff
lea ecx, [ebp - 0x50b]
push 0
push ecx
mov byte [ebp - 0x50c], 0
call fcn.00542dc0
mov ecx, dword [ebp - 0x510]
add esp, 0xc
xor esi, esi
push esi
push esi
push esi
push esi
lea edx, [ebp - 0x518]
push edx
lea eax, [ebp - 0x50c]
push eax
push esi
push ecx
mov dword [ebp - 0x518], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x407b20
mov edx, dword [ebp - 0x510]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00542c3e
mov esp, ebp
pop ebp
ret 4
push edi
test eax, eax
jne 0x407c33
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
nop
mov edx, dword [ebp - 0x510]
lea eax, [ebp - 0x514]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x50c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407bfc
lea eax, [ebp - 0x524]
push eax
mov eax, dword [ebp - 0x514]
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x51c]
push edx
push 0
push str.NetCfgInstanceId
push eax
call edi
test eax, eax
jne 0x407bfc
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10c]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x407bb0
test dl, dl
je 0x407bac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x407bb0
add eax, 2
add ecx, 2
test dl, dl
jne 0x407b90
xor eax, eax
jmp 0x407bb5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x407bfc
mov eax, 4
lea ecx, [ebp - 0x52c]
push ecx
mov ecx, dword [ebp - 0x514]
lea edx, [ebp - 0x520]
push edx
mov dword [ebp - 0x52c], eax
mov dword [ebp - 0x528], eax
lea eax, [ebp - 0x528]
push eax
push 0
push str.Characteristics
push ecx
call edi
test eax, eax
jne 0x407bfc
test byte [ebp - 0x520], 4
jne 0x407c5f
mov ecx, dword [ebp - 0x510]
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x518]
push edx
lea eax, [ebp - 0x50c]
push eax
inc esi
push esi
push ecx
mov dword [ebp - 0x518], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x407b30
mov ecx, dword [ebp - 0x514]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
mov edx, dword [ebp - 0x510]
push edx
call esi
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00542c3e
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 0x510]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
mov eax, dword [ebp - 0x514]
push eax
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.00542c3e
mov esp, ebp
pop ebp
ret 4
Function at 0x40b770
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [edi]
test esi, esi
je 0x40b7d0
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [edi], 0
jmp 0x40b790
mov eax, 0x400000
cmp esi, 0x400000
ja 0x40b79f
mov eax, esi
mov edx, dword [ebp + 8]
push 0
lea ecx, [ebp + 0x10]
push ecx
push eax
mov eax, dword [edx]
push ebx
push eax
mov dword [ebp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x10]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x40b7d6
test ecx, ecx
je 0x40b7cf
test esi, esi
jne 0x40b790
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop ebx
pop edi
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x40b7e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [edi]
test esi, esi
je 0x40b840
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [edi], 0
jmp 0x40b800
mov eax, 0x400000
cmp esi, 0x400000
ja 0x40b80f
mov eax, esi
mov edx, dword [ebp + 8]
push 0
lea ecx, [ebp + 0x10]
push ecx
push eax
mov eax, dword [edx]
push ebx
push eax
mov dword [ebp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x10]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x40b846
test ecx, ecx
je 0x40b83f
test esi, esi
jne 0x40b800
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop ebx
pop edi
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x414ee0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x576db3
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5f6998]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0056cfd8
mov dword [ebp - 4], 0
push 4
call fcn.0043f938
mov edi, eax
add esp, 4
test edi, edi
je 0x414f68
call fcn.0056cc9e
mov dword [edi], eax
call fcn.0056ca5d
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0056c992
mov byte [ebp - 4], 1
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x414f5a
inc eax
mov dword [ebx + 4], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0056c9ba
jmp 0x414f6a
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416110
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x576ff8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5f6998]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x41623d
cmp byte [edi + 0x49], bl
je 0x41623d
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x4161cf
mov ecx, 0xf
mov dword [ebp - 0x18], ecx
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x416184
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x41619c
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x4161d3
dec eax
je 0x4161d7
sub eax, 2
je 0x41622e
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00402790
xor al, al
jmp 0x41623f
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x4161e7
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x416210
cmp ebx, 0x10
jae 0x4161f6
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.005447f2
add esp, 0x10
cmp esi, eax
jne 0x4161c0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x41622e
test esi, esi
jne 0x416190
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00415b10
jmp 0x41618a
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00402790
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00542c3e
mov esp, ebp
pop ebp
ret
Function at 0x416e80
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5771a2
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5f6998]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 8], ebx
je 0x416ee4
lea eax, [edi + 0x70]
mov dword [edi], 0x590960
mov dword [edi + 0x10], 0x590958
mov dword [ebp + 8], eax
mov dword [eax], vtable.std::ios_base.0
mov dword [ebp - 4], ebx
mov dword [eax], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov eax, 1
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
push ebx
lea esi, [edi + 0x18]
push esi
mov ecx, edi
call fcn.00416630
mov dword [ebp - 4], 2
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [edi + ecx], vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
mov ecx, esi
mov dword [ebp + 8], esi
call fcn.00414ee0
mov byte [ebp - 4], 3
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x50], bl
mov byte [esi + 0x49], bl
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x54], ebx
mov edx, dword [0x5fc8b4]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], ebx
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41a6d0
Capabilities:
Terminate thread

Disassembly:
cmp dword [ecx + 0x580], 0
je 0x41a6de
jmp fcn.0041a160
jmp fcn.0041a030
Function at 0x422660
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x578d5b
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x5f6998]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x422738
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00542dc0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, eax
test edi, edi
je 0x422738
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x21c]
push eax
call fcn.00432d40
mov dword [ebp - 4], 0
push 0x208
push 0
push esi
call fcn.00542dc0
mov eax, dword [ebp - 0x21c]
add esp, 0x14
test eax, eax
je 0x42270c
add eax, 0xc
jmp 0x422711
mov eax, 0x58df78
mov edx, esi
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x422715
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.00567cb8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00542c3e
mov esp, ebp
pop ebp
ret 8