joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40135a
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x401389
push 0
push dword [ebp + 8]
call sub.USER32.dll_ShowWindow
push 0x40f22c
push 0x4c8
push dword [0x413074]
push 1
push dword [ebp + 8]
call fcn.00401bb0
jmp 0x40139b
push 1
push dword [ebp + 8]
call fcn.00401c1c
push dword [ebp + 8]
call sub.USER32.dll_SetForegroundWindow
leave
ret 8

Function at 0x40267b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push 0x100
lea eax, [ebp - 0x100]
push eax
push dword [ebp + 8]
call sub.USER32.dll_GetWindowTextA
push eax
lea eax, [ebp - 0x100]
push eax
push 0
push 0
push dword [ebp + 0xc]
call sub.GDI32.dll_TextOutA
leave
ret 8

Function at 0x402e8e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
ret

Function at 0x402fb5
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
call sub.KERNEL32.dll_GetCurrentProcess
lea edx, [ebp - 8]
push edx
push 0x20
push eax
call sub.ADVAPI32.dll_OpenProcessToken
or eax, eax
je 0x403029
mov dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
push str.SeDebugPrivilege
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueA
test eax, eax
je 0x40301e
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp - 8]
call sub.ADVAPI32.dll_AdjustTokenPrivileges
call sub.KERNEL32.dll_GetLastError
cmp eax, 0
jne 0x40301e
mov dword [ebp - 4], 1
push dword [ebp - 8]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 4]
leave
ret

Function at 0x403140
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
cmp dword [ebp + 0xc], eax
je 0x4031c4
cmp dword [ebp + 0x10], eax
je 0x4031c4
mov eax, dword [ebp + 0x10]
add eax, dword [ebp + 0x18]
push 0x40
push 0x3000
push eax
push 0
push dword [ebp + 8]
call sub.KERNEL32.dll_VirtualAllocEx
test eax, eax
je 0x4031c4
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
je 0x403194
push 0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 4]
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x4031b0
mov eax, dword [ebp - 4]
add eax, dword [ebp + 0x18]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x4031b0
mov eax, dword [ebp - 4]
leave
ret 0x14
push 0x8000
push 0
push dword [ebp - 4]
push dword [ebp + 8]
call sub.KERNEL32.dll_VirtualFreeEx
xor eax, eax
leave
ret 0x14
Function at 0x403af4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], 0
push 0x868
push dword [ebp + 8]
call sub.KERNEL32.dll_RtlZeroMemory
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebx], 0x3243594c
mov eax, dword [ebp + 0xc]
mov dword [ebx + 4], eax
push str.Kernel32.dll
call sub.KERNEL32.dll_GetModuleHandleA
test eax, eax
je 0x403c53
mov dword [ebp - 4], eax
push 0x40f47e
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x403c53
mov dword [ebx + 0x24], eax
push 0x40f48d
push dword [ebp - 4]
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x403c53
mov dword [ebx + 0x28], eax
push 0x40f499
push dword [ebp - 4]
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x403c53
mov dword [ebx + 0x2c], eax
push str.CreateToolhelp32Snapshot
push dword [ebp - 4]
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x403c53
mov dword [ebx + 0x30], eax
push str.User32.dll
call sub.KERNEL32.dll_GetModuleHandleA
test eax, eax
je 0x403c53
mov dword [ebp - 4], eax
push 0x40f4d1
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x403c53
mov dword [ebx + 0x20], eax
push str.PeekMessageW
push dword [ebp - 4]
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x403c53
mov dword [ebx + 0x38], eax
push str.GetKeyState
push dword [ebp - 4]
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x403c53
mov dword [ebx + 0x3c], eax
push str.GetAsyncKeyState
push dword [ebp - 4]
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x403c53
mov dword [ebx + 0x40], eax
push 0x40f508
push dword [ebp - 4]
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x403c53
mov dword [ebx + 0x1c], eax
push 0x40f511
push dword [ebp - 4]
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x403c53
mov dword [ebx + 0x50], eax
push str.GetClassNameA
push dword [ebp - 4]
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x403c53
mov dword [ebx + 0x48], eax
push str.GetTopWindow
push dword [ebp - 4]
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x403c53
mov dword [ebx + 0x44], eax
mov dword [ebp - 8], 1
pop ebx
mov eax, dword [ebp - 8]
leave
ret 8

Function at 0x40a9ce
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push str.Tencent:__Message__MenuYESUin
lea eax, [ebp - 0x40]
push eax
call sub.KERNEL32.dll_lstrcpyA
lea eax, [ebp - 0x40]
add eax, 0x20
push 0x20
push eax
push 0x4b0
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItemTextA
push 0xa
push 0
push 0
lea eax, [ebp - 0x40]
push eax
push 0
push 0
call sub.SHELL32.dll_ShellExecuteA
leave
ret 4
Function at 0x40aae3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
mov dword [0x411030], 0
push 0x104
lea eax, [ebp - 0x114]
push eax
call fcn.00401ab0
push 0x40aa90
lea eax, [ebp - 0x114]
push eax
call sub.KERNEL32.dll_lstrcatA
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
lea eax, [ebp - 0x114]
push eax
call sub.KERNEL32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x40ab42
call fcn.0040aab0
leave
ret
mov dword [ebp - 0x10], eax
push 0
lea eax, [ebp - 4]
push eax
push 8
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.dll_ReadFile
cmp dword [ebp - 4], 8
je 0x40ab66
call fcn.0040aab0
jmp 0x40abc5
cmp dword [ebp - 0xc], 0x4643585a
jne 0x40abc5
cmp dword [ebp - 8], 3
jne 0x40abc5
push dword [ebp - 0x10]
call fcn.0040b4c6
push dword [ebp - 0x10]
call fcn.0040bc2e
push dword [ebp - 0x10]
call fcn.0040bfab
push dword [ebp - 0x10]
call fcn.0040c421
push dword [ebp - 0x10]
call fcn.0040c86b
push dword [ebp - 0x10]
call fcn.0040cd0d
push dword [ebp - 0x10]
call fcn.0040d122
push dword [ebp - 0x10]
call fcn.0040d463
push dword [ebp - 0x10]
call fcn.0040d67b
push dword [ebp - 0x10]
call fcn.0040d9eb
push dword [ebp - 0x10]
call sub.KERNEL32.dll_CloseHandle
leave
ret

Function at 0x40abcf
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
cmp dword [0x411030], 0
jne 0x40abe8
mov eax, 1
leave
ret
push 0x104
lea eax, [ebp - 0x114]
push eax
call fcn.00401ab0
push 0x40aa90
lea eax, [ebp - 0x114]
push eax
call sub.KERNEL32.dll_lstrcatA
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x114]
push eax
call sub.KERNEL32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x40ac34
mov eax, 0
leave
ret
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0x4643585a
mov dword [ebp - 4], 3
push 0
lea eax, [ebp - 0x10]
push eax
push 8
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
call sub.KERNEL32.dll_WriteFile
cmp dword [ebp - 0x10], 8
jne 0x40aced
push dword [ebp - 0xc]
call fcn.0040b541
cmp eax, 0
je 0x40ad06
push dword [ebp - 0xc]
call fcn.0040bca3
cmp eax, 0
je 0x40ad06
push dword [ebp - 0xc]
call fcn.0040c0b1
cmp eax, 0
je 0x40ad06
push dword [ebp - 0xc]
call fcn.0040c527
cmp eax, 0
je 0x40ad06
push dword [ebp - 0xc]
call fcn.0040c971
cmp eax, 0
je 0x40ad06
push dword [ebp - 0xc]
call fcn.0040ce13
cmp eax, 0
je 0x40ad06
push dword [ebp - 0xc]
call fcn.0040d197
cmp eax, 0
je 0x40ad06
push dword [ebp - 0xc]
call fcn.0040d4d8
cmp eax, 0
je 0x40ad06
push dword [ebp - 0xc]
call fcn.0040d6f6
cmp eax, 0
je 0x40ad06
push dword [ebp - 0xc]
call fcn.0040daf1
cmp eax, 0
je 0x40ad06
push dword [ebp - 0xc]
call sub.KERNEL32.dll_CloseHandle
mov dword [0x411030], 0
mov eax, 1
leave
ret
push dword [ebp - 0xc]
call sub.KERNEL32.dll_CloseHandle
lea eax, [ebp - 0x114]
push eax
call sub.KERNEL32.dll_DeleteFileA
mov eax, 0
leave
ret
Function at 0x40b4c6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push 0
push 0
push 8
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x40b538
push 0
lea eax, [ebp - 4]
push eax
push 8
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call sub.KERNEL32.dll_ReadFile
cmp dword [ebp - 4], 8
jne 0x40b538
cmp dword [ebp - 0xc], 0x544f5250
je 0x40b513
push 1
push 0
push dword [ebp - 8]
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFilePointer
jmp 0x40b4df
push 0
lea eax, [ebp - 4]
push eax
push 0x80
push 0x413a30
push dword [ebp + 8]
call sub.KERNEL32.dll_ReadFile
cmp dword [ebp - 4], 0x80
jne 0x40b538
leave
ret 4
call fcn.0040b380
leave
ret 4

Function at 0x40b541
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], 0x544f5250
mov dword [ebp - 4], 0x80
push 2
push 0
push 0
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x40b5ac
push 0
lea eax, [ebp - 0xc]
push eax
push 8
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
cmp dword [ebp - 0xc], 8
jne 0x40b5ac
push 0
lea eax, [ebp - 0xc]
push eax
push 0x80
push 0x413a30
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
cmp dword [ebp - 0xc], 0x80
jne 0x40b5ac
mov eax, 1
leave
ret 4
mov eax, 0
leave
ret 4

Function at 0x40bc2e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push 0
push 0
push 8
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x40bc9a
push 0
lea eax, [ebp - 4]
push eax
push 8
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call sub.KERNEL32.dll_ReadFile
cmp dword [ebp - 4], 8
jne 0x40bc9a
cmp dword [ebp - 0xc], 0x454d4954
je 0x40bc7b
push 1
push 0
push dword [ebp - 8]
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFilePointer
jmp 0x40bc47
push 0
lea eax, [ebp - 4]
push eax
push 0x78
push 0x413ab0
push dword [ebp + 8]
call sub.KERNEL32.dll_ReadFile
cmp dword [ebp - 4], 0x78
jne 0x40bc9a
leave
ret 4
call fcn.0040bafc
leave
ret 4

Function at 0x40bca3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], 0x454d4954
mov dword [ebp - 4], 0x78
push 2
push 0
push 0
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x40bd08
push 0
lea eax, [ebp - 0xc]
push eax
push 8
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
cmp dword [ebp - 0xc], 8
jne 0x40bd08
push 0
lea eax, [ebp - 0xc]
push eax
push 0x78
push 0x413ab0
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
cmp dword [ebp - 0xc], 0x78
jne 0x40bd08
mov eax, 1
leave
ret 4
mov eax, 0
leave
ret 4
Function at 0x40bfab
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 0
push 0
push 8
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFilePointer
cmp eax, 0xffffffff
jne 0x40bfcd
call fcn.0040bf87
leave
ret 4
push 0
lea eax, [ebp - 4]
push eax
push 8
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call sub.KERNEL32.dll_ReadFile
cmp dword [ebp - 4], 8
je 0x40bff0
call fcn.0040bf87
leave
ret 4
cmp dword [ebp - 0xc], 0x4c494b53
je 0x40c00a
push 1
push 0
push dword [ebp - 8]
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFilePointer
jmp 0x40bfcd
push 0
lea eax, [ebp - 4]
push eax
push 0x10
push 0x413b30
push dword [ebp + 8]
call sub.KERNEL32.dll_ReadFile
cmp dword [ebp - 4], 0x10
je 0x40c02e
call fcn.0040bf87
leave
ret 4
push 0x413b38
call fcn.00402ab0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [0x413b34]
jae 0x40c0ad
push 0x2c
call fcn.0040de60
add esp, 4
or eax, eax
jne 0x40c066
call fcn.0040bf55
call fcn.0040bf87
leave
ret 4
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 4]
push eax
push 0x2c
push dword [ebp - 0x14]
push dword [ebp + 8]
call sub.KERNEL32.dll_ReadFile
cmp dword [ebp - 4], 0x2c
je 0x40c09b
push dword [ebp - 0x14]
call fcn.0040df10
add esp, 4
call fcn.0040bf55
call fcn.0040bf87
leave
ret 4
push dword [ebp - 0x14]
push 0x413b38
call fcn.00402b02
inc dword [ebp - 0x10]
jmp 0x40c03f
leave
ret 4

Function at 0x40c0b1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], 0x4c494b53
mov eax, 0x2c
mul dword [0x413b34]
add eax, 0x10
mov dword [ebp - 4], eax
push 2
push 0
push 0
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x40c154
push 0
lea eax, [ebp - 0xc]
push eax
push 8
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
cmp dword [ebp - 0xc], 8
jne 0x40c154
push 0
lea eax, [ebp - 0xc]
push eax
push 0x10
push 0x413b30
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
cmp dword [ebp - 0xc], 0x10
jne 0x40c154
mov dword [ebp - 0x10], 0x413b38
push dword [ebp - 0x10]
call fcn.00402af2
cmp eax, 0x413b38
je 0x40c14b
mov dword [ebp - 0x10], eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x2c
push dword [ebp - 0x10]
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
cmp dword [ebp - 0xc], 0x2c
jne 0x40c154
jmp 0x40c11e
mov eax, 1
leave
ret 4
mov eax, 0
leave
ret 4
Function at 0x40c421
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 0
push 0
push 8
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFilePointer
cmp eax, 0xffffffff
jne 0x40c443
call fcn.0040c3f3
leave
ret 4
push 0
lea eax, [ebp - 4]
push eax
push 8
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call sub.KERNEL32.dll_ReadFile
cmp dword [ebp - 4], 8
je 0x40c466
call fcn.0040c3f3
leave
ret 4
cmp dword [ebp - 0xc], 0x534e4f4d
je 0x40c480
push 1
push 0
push dword [ebp - 8]
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFilePointer
jmp 0x40c443
push 0
lea eax, [ebp - 4]
push eax
push 0x14
push 0x413b40
push dword [ebp + 8]
call sub.KERNEL32.dll_ReadFile
cmp dword [ebp - 4], 0x14
je 0x40c4a4
call fcn.0040c3f3
leave
ret 4
push 0x413b4c
call fcn.00402ab0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [0x413b44]
jae 0x40c523
push 0x2c
call fcn.0040de60
add esp, 4
or eax, eax
jne 0x40c4dc
call fcn.0040c3c1
call fcn.0040c3f3
leave
ret 4
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 4]
push eax
push 0x2c
push dword [ebp - 0x14]
push dword [ebp + 8]
call sub.KERNEL32.dll_ReadFile
cmp dword [ebp - 4], 0x2c
je 0x40c511
push dword [ebp - 0x14]
call fcn.0040df10
add esp, 4
call fcn.0040c3c1
call fcn.0040c3f3
leave
ret 4
push dword [ebp - 0x14]
push 0x413b4c
call fcn.00402b02
inc dword [ebp - 0x10]
jmp 0x40c4b5
leave
ret 4

Function at 0x40c527
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], 0x534e4f4d
mov eax, 0x2c
mul dword [0x413b44]
add eax, 0x14
mov dword [ebp - 4], eax
push 2
push 0
push 0
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x40c5ca
push 0
lea eax, [ebp - 0xc]
push eax
push 8
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
cmp dword [ebp - 0xc], 8
jne 0x40c5ca
push 0
lea eax, [ebp - 0xc]
push eax
push 0x14
push 0x413b40
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
cmp dword [ebp - 0xc], 0x14
jne 0x40c5ca
mov dword [ebp - 0x10], 0x413b4c
push dword [ebp - 0x10]
call fcn.00402af2
cmp eax, 0x413b4c
je 0x40c5c1
mov dword [ebp - 0x10], eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x2c
push dword [ebp - 0x10]
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
cmp dword [ebp - 0xc], 0x2c
jne 0x40c5ca
jmp 0x40c594
mov eax, 1
leave
ret 4
mov eax, 0
leave
ret 4
Function at 0x40c86b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 0
push 0
push 8
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFilePointer
cmp eax, 0xffffffff
jne 0x40c88d
call fcn.0040c847
leave
ret 4
push 0
lea eax, [ebp - 4]
push eax
push 8
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call sub.KERNEL32.dll_ReadFile
cmp dword [ebp - 4], 8
je 0x40c8b0
call fcn.0040c847
leave
ret 4
cmp dword [ebp - 0xc], 0x44475550
je 0x40c8ca
push 1
push 0
push dword [ebp - 8]
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFilePointer
jmp 0x40c88d
push 0
lea eax, [ebp - 4]
push eax
push 0x10
push 0x413b60
push dword [ebp + 8]
call sub.KERNEL32.dll_ReadFile
cmp dword [ebp - 4], 0x10
je 0x40c8ee
call fcn.0040c847
leave
ret 4
push 0x413b68
call fcn.00402ab0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [0x413b64]
jae 0x40c96d
push 0x2c
call fcn.0040de60
add esp, 4
or eax, eax
jne 0x40c926
call fcn.0040c815
call fcn.0040c847
leave
ret 4
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 4]
push eax
push 0x2c
push dword [ebp - 0x14]
push dword [ebp + 8]
call sub.KERNEL32.dll_ReadFile
cmp dword [ebp - 4], 0x2c
je 0x40c95b
push dword [ebp - 0x14]
call fcn.0040df10
add esp, 4
call fcn.0040c815
call fcn.0040c847
leave
ret 4
push dword [ebp - 0x14]
push 0x413b68
call fcn.00402b02
inc dword [ebp - 0x10]
jmp 0x40c8ff
leave
ret 4

Function at 0x40c971
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], 0x44475550
mov eax, 0x2c
mul dword [0x413b64]
add eax, 0x10
mov dword [ebp - 4], eax
push 2
push 0
push 0
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x40ca14
push 0
lea eax, [ebp - 0xc]
push eax
push 8
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
cmp dword [ebp - 0xc], 8
jne 0x40ca14
push 0
lea eax, [ebp - 0xc]
push eax
push 0x10
push 0x413b60
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
cmp dword [ebp - 0xc], 0x10
jne 0x40ca14
mov dword [ebp - 0x10], 0x413b68
push dword [ebp - 0x10]
call fcn.00402af2
cmp eax, 0x413b68
je 0x40ca0b
mov dword [ebp - 0x10], eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x2c
push dword [ebp - 0x10]
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
cmp dword [ebp - 0xc], 0x2c
jne 0x40ca14
jmp 0x40c9de
mov eax, 1
leave
ret 4
mov eax, 0
leave
ret 4
Function at 0x40cd0d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 0
push 0
push 8
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFilePointer
cmp eax, 0xffffffff
jne 0x40cd2f
call fcn.0040ccd1
leave
ret 4
push 0
lea eax, [ebp - 4]
push eax
push 8
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call sub.KERNEL32.dll_ReadFile
cmp dword [ebp - 4], 8
je 0x40cd52
call fcn.0040ccd1
leave
ret 4
cmp dword [ebp - 0xc], 0x44475342
je 0x40cd6c
push 1
push 0
push dword [ebp - 8]
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFilePointer
jmp 0x40cd2f
push 0
lea eax, [ebp - 4]
push eax
push 0x54
push 0x413b70
push dword [ebp + 8]
call sub.KERNEL32.dll_ReadFile
cmp dword [ebp - 4], 0x54
je 0x40cd90
call fcn.0040ccd1
leave
ret 4
push 0x413bbc
call fcn.00402ab0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [0x413bb8]
jae 0x40ce0f
push 0x2c
call fcn.0040de60
add esp, 4
or eax, eax
jne 0x40cdc8
call fcn.0040cc9f
call fcn.0040ccd1
leave
ret 4
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 4]
push eax
push 0x2c
push dword [ebp - 0x14]
push dword [ebp + 8]
call sub.KERNEL32.dll_ReadFile
cmp dword [ebp - 4], 0x2c
je 0x40cdfd
push dword [ebp - 0x14]
call fcn.0040df10
add esp, 4
call fcn.0040cc9f
call fcn.0040ccd1
leave
ret 4
push dword [ebp - 0x14]
push 0x413bbc
call fcn.00402b02
inc dword [ebp - 0x10]
jmp 0x40cda1
leave
ret 4

Function at 0x40ce13
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], 0x44475342
mov eax, 0x2c
mul dword [0x413bb8]
add eax, 0x54
mov dword [ebp - 4], eax
push 2
push 0
push 0
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x40ceb6
push 0
lea eax, [ebp - 0xc]
push eax
push 8
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
cmp dword [ebp - 0xc], 8
jne 0x40ceb6
push 0
lea eax, [ebp - 0xc]
push eax
push 0x54
push 0x413b70
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
cmp dword [ebp - 0xc], 0x54
jne 0x40ceb6
mov dword [ebp - 0x10], 0x413bbc
push dword [ebp - 0x10]
call fcn.00402af2
cmp eax, 0x413bbc
je 0x40cead
mov dword [ebp - 0x10], eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x2c
push dword [ebp - 0x10]
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
cmp dword [ebp - 0xc], 0x2c
jne 0x40ceb6
jmp 0x40ce80
mov eax, 1
leave
ret 4
mov eax, 0
leave
ret 4

Function at 0x40d122
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push 0
push 0
push 8
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x40d18e
push 0
lea eax, [ebp - 4]
push eax
push 8
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call sub.KERNEL32.dll_ReadFile
cmp dword [ebp - 4], 8
jne 0x40d18e
cmp dword [ebp - 0xc], 0x474e4148
je 0x40d16f
push 1
push 0
push dword [ebp - 8]
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFilePointer
jmp 0x40d13b
push 0
lea eax, [ebp - 4]
push eax
push 0x2c
push 0x413bd0
push dword [ebp + 8]
call sub.KERNEL32.dll_ReadFile
cmp dword [ebp - 4], 0x2c
jne 0x40d18e
leave
ret 4
call fcn.0040d0ae
leave
ret 4
Function at 0x40d197
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], 0x474e4148
mov dword [ebp - 4], 0x2c
push 2
push 0
push 0
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x40d1fc
push 0
lea eax, [ebp - 0xc]
push eax
push 8
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
cmp dword [ebp - 0xc], 8
jne 0x40d1fc
push 0
lea eax, [ebp - 0xc]
push eax
push 0x2c
push 0x413bd0
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
cmp dword [ebp - 0xc], 0x2c
jne 0x40d1fc
mov eax, 1
leave
ret 4
mov eax, 0
leave
ret 4

Function at 0x40d463
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push 0
push 0
push 8
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x40d4cf
push 0
lea eax, [ebp - 4]
push eax
push 8
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call sub.KERNEL32.dll_ReadFile
cmp dword [ebp - 4], 8
jne 0x40d4cf
cmp dword [ebp - 0xc], 0x4e555453
je 0x40d4b0
push 1
push 0
push dword [ebp - 8]
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFilePointer
jmp 0x40d47c
push 0
lea eax, [ebp - 4]
push eax
push 0x2c
push 0x413c00
push dword [ebp + 8]
call sub.KERNEL32.dll_ReadFile
cmp dword [ebp - 4], 0x2c
jne 0x40d4cf
leave
ret 4
call fcn.0040d3ef
leave
ret 4

Function at 0x40d4d8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], 0x4e555453
mov dword [ebp - 4], 0x2c
push 2
push 0
push 0
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x40d53d
push 0
lea eax, [ebp - 0xc]
push eax
push 8
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
cmp dword [ebp - 0xc], 8
jne 0x40d53d
push 0
lea eax, [ebp - 0xc]
push eax
push 0x2c
push 0x413c00
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
cmp dword [ebp - 0xc], 0x2c
jne 0x40d53d
mov eax, 1
leave
ret 4
mov eax, 0
leave
ret 4

Function at 0x40d67b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push 0
push 0
push 8
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x40d6ed
push 0
lea eax, [ebp - 4]
push eax
push 8
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call sub.KERNEL32.dll_ReadFile
cmp dword [ebp - 4], 8
jne 0x40d6ed
cmp dword [ebp - 0xc], 0x54504f4f
je 0x40d6c8
push 1
push 0
push dword [ebp - 8]
push dword [ebp + 8]
call sub.KERNEL32.dll_SetFilePointer
jmp 0x40d694
push 0
lea eax, [ebp - 4]
push eax
push 0x118
push 0x413c30
push dword [ebp + 8]
call sub.KERNEL32.dll_ReadFile
cmp dword [ebp - 4], 0x118
jne 0x40d6ed
leave
ret 4
call fcn.0040d63c
leave
ret 4