joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4df628
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040ac28
xor eax, eax
push ebp
push 0x4df726
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, ebx
call fcn.0040ab34
cmp dword [ebp - 4], 0
jne 0x4df677
lea eax, [ebp - 0xc]
mov edx, 0x4df744
call fcn.0040af6c
jmp 0x4df682
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.0040af6c
push 0
push 0
push 0
push 0
push 0x4df788
call sub.wininet.dll_InternetOpenW
mov edi, eax
test edi, edi
je 0x4df709
push 0
push 0x80000000
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.0040b5f0
push eax
push edi
call sub.wininet.dll_InternetOpenUrlW
mov esi, eax
test esi, esi
jne 0x4df6c2
push edi
call sub.wininet.dll_InternetCloseHandle
jmp 0x4df709
lea eax, [ebp - 0x14]
push eax
push 0x400
lea eax, [ebp - 0x414]
push eax
push esi
call sub.wininet.dll_InternetReadFile
lea edx, [ebp - 0x414]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x14]
call fcn.0040adec
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.0040b7e8
cmp dword [ebp - 0x14], 0
jne 0x4df6c2
push esi
call sub.wininet.dll_InternetCloseHandle
push edi
call sub.wininet.dll_InternetCloseHandle
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df72d
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040ab94
pop eax
jmp eax
Function at 0x4e0b4c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov esi, eax
xor ebx, ebx
push 2
push 0
mov eax, esi
call fcn.0040b5f0
push eax
call sub.kernel32.dll_LoadLibraryExW
mov esi, eax
test esi, esi
je 0x4e0be4
push 0x10
push 1
push esi
call sub.kernel32.dll_FindResourceW
mov edi, eax
test edi, edi
je 0x4e0be4
push edi
push esi
call sub.kernel32.dll_LoadResource
test eax, eax
je 0x4e0be4
mov edx, dword [eax + 0x30]
mov dword [ebp], edx
mov edx, dword [eax + 0x34]
shr edx, 0x10
mov word [ebp + 4], dx
movzx edx, word [eax + 0x34]
mov word [ebp + 6], dx
mov edx, dword [eax + 0x44]
and edx, 1
cmp edx, 1
sete dl
mov byte [ebp + 8], dl
mov edx, dword [eax + 0x44]
and edx, 2
cmp edx, 2
sete dl
mov byte [ebp + 9], dl
mov edx, dword [eax + 0x44]
and edx, 8
cmp edx, 8
sete dl
mov byte [ebp + 0xa], dl
mov eax, dword [eax + 0x44]
and eax, 0x20
cmp eax, 0x20
sete al
mov byte [ebp + 0xb], al
push esi
call sub.kernel32.dll_FreeLibrary
mov bl, 1
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x1098058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.010981a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x109807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x109806a
add dl, dl
jne 0x1098089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10980dc
xor eax, eax
add dl, dl
jne 0x1098096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x109817d
add dl, dl
jne 0x10980a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10980b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10980bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10980c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10980d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1098075
mov eax, 1
add dl, dl
jne 0x10980ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10980f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10980e1
sub eax, ebx
mov ebx, 1
jne 0x1098128
mov ecx, 1
add dl, dl
jne 0x109810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1098119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1098105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1098075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x109813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x109814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1098136
cmp eax, 0x7d00
jae 0x109816d
cmp eax, 0x500
jb 0x1098168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1098075
cmp eax, 0x7f
ja 0x1098170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1098075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x109819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1098075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4166da
Capabilities:
Encode data using xor

Disassembly:
loop 0x416715
push ebp
std
or ch, 0x52
and al, 8
mov ecx, eax
sbb esi, dword [ebx]
pop edx
and ch, byte [esi + 0x30dca305]
add eax, 0xc30dca3
or byte [esi + 0x4debf3cb], bh
int 0x7d
mov dr3, edi
lea ebp, [eax - 0x61]
jmp 0x416743
sub edx, dword [eax + 0x4f]
cmp al, 0xd2
ror dword [ecx], 0x3c
lcall 0x2d32, 0x411c232d
mov edi, dword [edi + 0x75]
mov edx, dword [ebx + ebp*4]
xor ch, byte [0x8b757f8b]
adc al, 0xab
dec ebp
bound eax, qword [edi + 0x6487254e]
and al, 0x9a
mov ch, byte [edx + ecx*2]
scasb al, byte es:[edi]
or byte [ecx - 0x76], ch
cmpsd dword [esi], dword es:[edi]
rcr dword [eax + ecx + 0x2ea9de2], 1
ja 0x416722
cmp edi, esi
invalid

Function at 0x417c10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push str.Shell32.lib
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov ebx, eax
call edi
test ax, ax
jge 0x417c3f
or dword [esi], 0x2000000
push str.SetCurrentProcessExplicitAppUserModelID
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x11
call edi
test ax, ax
jge 0x417c5a
or dword [esi], 0x4000000
push 0x12
call edi
test ax, ax
jge 0x417c69
or dword [esi], 0x8000000
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x42dadb
Capabilities:
Authenticate hmac

Disassembly:
push cs
std
int 0x3c
xchg edx, eax
mov esp, dword [eax - 0x30699888]
mov al, byte [0xcf966778]
cmpsd dword [esi], dword es:[edi]
mov ch, 0xa5
sbb byte [bx], 0xc6
xor dh, byte [ecx + 0xec8ac30]
invalid
lodsb al, byte [esi]
enter 0x780e, 0x3f
jl 0x42da37
invalid
mov eax, 0x3faadfbe
clc
inc eax
jp 0x42dae2
dec edi
stosd dword es:[edi], eax
pop esp
loope 0x42dab9
mov edi, 0xdac13cb1
pop ss
push esp
sub bl, byte [ebp + 0x31]
jno 0x42da31
push 1
das
xchg esi, eax
mov byte [0x999aee4c], al
sbb al, 0xc
mov al, byte [0x57076171]
fnstcw word [ecx]
aam 0x13
or byte [ebx], bl
pop ebp
adc dh, byte [ecx + 0x7f57e01f]
shl ch, 1
sbb ebx, dword [ebp + 0x12]
mov cl, 0x1f
loopne 0x42db17
jg 0x42da92
in eax, 0xf7
idiv dword [ecx + 0x6576c807]
mov ecx, 0x6576c807
mov bl, 3
dec ebp
xchg edx, eax
loopne 0x42daf3
invalid
inc esi
adc ch, byte [ebp + 8]
mov ah, 0x21
mov edx, 0x47ac3690
nop
lodsb al, byte ss:[esi]
inc edi
out dx, eax
rcr dword [ebp + ecx*8 + 0x63792f0c], 1
jo 0x42da8a
int3
aad 0xcd
xchg ebx, esp
xchg edi, eax
adc byte [eax - 0x4ce8ac0], 0x41
pop eax
push eax
pop eax
test dword [edi + 0x4b], esp
pop ecx
leave
mov ss, word [esi + 0x3c]
loopne 0x42db7a
sub byte [edx + 0x56258533], 0xfa
out dx, eax
xor byte [ecx], 0xa7
push esp
scasd eax, dword es:[edi]
mov ebp, 0xa9bc698f
enter 0xffffffffffffeba3, 0xffffffffffffffa1
insb byte es:[edi], dx
int 0x66
mov bh, 0x72
and eax, 0x9b515581
adc al, 0x98
sub edx, eax
sbb dl, ah
invalid
xor dword [edi - 0x704250ac], esp
imul edi, dword [ecx + ebp*4 - 0x5e145c38], 0xb766cd6c
mov esp, 0xeba3c8a9
mov eax, dword [0xb766cd6c]
jb 0x42db4f
adc dword [ebp + 0x51], 0x2b98149b
rcr byte [eax], 1
loop 0x42dac4
xchg ebx, eax
lds esp, [ecx + 0x26b6929]
push esi
and eax, dword [eax]
bound esi, qword [edi]
js 0x42dac3
jbe 0x42db1e
dec eax
dec eax
xor ah, byte [ebp + 0x68]
popal
pop ds
adc eax, 0x3d6d8120
dec ecx
iretd
sub dword [ebp + 0x3d], 0xa2ecf49
adc ebp, dword [ebp - 0x11]
pop ecx
dec edi
rol byte [esi], 0xd2
lodsb al, byte [esi]
cmpsd dword [esi], dword es:[edi]
aam 0x18
mov al, 0x68
stc
mov dl, 0x30
jbe 0x42db59
inc esp
invalid
jns 0x42dbf6
inc esp
aam 2
daa
bound ecx, qword [edi]
cmp byte [ecx - 0x11136a6d], bh
in eax, dx
iretd
cwde
or al, 0xb1
fstp xword [edi + eax*2 + 0x7f]
adc eax, 0x7c79733c

Function at 0x42e7af
Capabilities:
Encode data using xor

Disassembly:
dec ebp
inc ecx
jl 0x42e73f
adc dword [edx - 0x7d], 0x2534db4a
cmp dword [ebx], esp
daa
pop edi
or ebp, dword [edx - 0x20]
sbb byte [esp + eax*2], dh
test dl, cl
invalid

Function at 0x42e7e6
Capabilities:
Encode data using xor

Disassembly:
test al, 0x9a
or al, 0xee
cmp al, 0xb4
out 0x55, eax
sti
in al, 0x9a
daa
loope 0x42e870
cmpsb byte [esi], byte es:[edi]
div byte [ecx]
xor dword [edx - 0x4e], ebx
in al, dx
mov al, byte [edi + 0x74]
imul ecx, dword [edx - 0x59], 0x5366dc32
xchg esi, eax
js 0x42e809
bswap eax
and al, 0xa7
test eax, 0x4241ffd0
inc esi
inc esp
sub edi, edx
mov edx, 0x9312f427
inc ebx
jo 0x42e885
jmp 0xdd1be21f
inc eax
into
sti
push 5
stc
leave
nop
arpl word [ebx], si
invalid
Function at 0x43fa0a
Capabilities:
Execute syscall

Disassembly:
not dword [ebp - 0x36]
je 0x43f9be
mov al, 0x5d
imul esp, dword [esi + ebp*2], 0xb673ca50
mov ebp, 0xdec846bb
adc dl, byte [edi]
mov byte fs:[0xe476b16e], al
cwde
sub dword [eax - 0x7b688a22], ebp
sbb byte [0x75f38c62], al
in eax, dx
or dword [ebx + 0xf], eax
test eax, 0x6772d17d
pop gs
jge 0x43f984
jb 0x43fa1c
sub al, byte [ebp - 0x67]
xlatb
mov ecx, 0x8c8cbc39
push ecx
nop
retf 0x958b
hlt
in eax, dx
xlatb
inc ebx
jge 0x43f9af
jae 0x43f9d6
invalid
add eax, 0xe5b2c347
cmp dword [ebp - 0x19456492], edx
inc esp
mov byte [0x7d806efc], al
mov ecx, 0x17181183
invalid

Function at 0x465774
Capabilities:
Encode data using xor

Disassembly:
js 0x46572e
sub byte [0xa858622c], ah
mov word fs:[ebx - 0x653913c3], gs
movsd dword es:[edi], dword [esi]
cli
adc edi, esi
fild qword [eax]
invalid
mov ebx, 0x9811794c
sub esi, dword [ecx - 0x3cd72a1]
sbb ch, byte [edi]
mov cl, 0xac
push esp
or al, 0x92
and cl, cl
mov word [edx - 0x52], gs
pop ds
push es
adc byte [esi], ch
adc eax, 0xfdf9e96
invalid
cmp cl, byte ds:[esi - 0x2bd985d4]
salc
add edx, dword [ecx]
fdivr dword [ebp - 0x24]
ret
daa
lahf
div byte [ecx + 0xc]
add eax, 0x2c7a9b01
push ecx
loop 0x465762
add byte [edx + ebp + 0x38d5fbfb], bl
in al, dx
loop 0x465717
inc esp
mov edx, esp
jl 0x4657c4
ljmp 0xcba4:0xf7bd8aac
mov dl, 0xba
scasb al, byte es:[edi]
sub dword [ecx], ebp
in eax, 0xd4
sub al, 0xc0
sbb dword [edx + 0x34], edi
sti
scasb al, byte es:[edi]
lodsb al, byte [esi]
in eax, dx
and eax, 0x3aa2d36c
das
or dword [eax + ecx*4 - 0x3c5065d2], ebp
pop eax
push ebp
rcr byte [edx + 0x27c7b8b0], 1
and byte [ebx + ebp*2], bh
pop ebp
adc cl, byte [esi + 0x6a]
pop edx
sbb eax, 0xbaec7c94
fcomp qword [eax - 0x1c]
cli
cli
xor al, 0x74
jl 0x4657fa
cli
sub eax, 0xc9a64d0
sub al, 0x9b
lcall 0x4d43, 0xda6c1af1
inc esi
movsb byte es:[edi], byte [esi]
lcall 0x76fe, 0x31f4741f
fimul word [eax + ebp*2]
shr byte [ebx], 1
mov word [ebx], es
mov byte [0xdfa8930b], al
insb byte es:[edi], dx
jo 0x4657ff
push edx
add dword [ecx + 0x1082ea2c], ebp
les edi, [ebp + 0x6c]
idiv dword [esi]
hlt

Function at 0x4a14d0
Capabilities:
Encode data using xor

Disassembly:
in eax, 0x12
cmp dword [ebp + edx + 0x53], esp
pop esi
scasd eax, dword es:[edi]
sub ah, byte [edx - 0x629e6af5]
dec ebx
aaa
xor byte [esi - 0x23], ch
invalid
Function at 0x4b88ac
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov al, 0x52
dec ebp
jecxz 0x4b8893
push esi
add cl, byte [ebx + 0x1114ed9e]
stosb byte es:[edi], al
mov al, byte [0x6dd86fa5]
inc ebx
or dh, byte [ecx + 0x6e]
jmp 0x3bf98973
add byte [edi - 0x875dba1], cl
add byte [ebx - 0xe208a66], ch
jge 0x4b8846
mov eax, dword [0xb09ab1d2]
mov bl, 0x78
test eax, 0x98bf646f
cwde
pushfd
push ds
stosd dword es:[edi], eax
scasb al, byte es:[edi]
bound esi, qword [edi]
push 0x46
cmp ecx, esp
push ebx
mov dh, 0x97
mov esi, 0x5bd893bb
imul esi, ebx, 0xfca12610
adc byte [esi], ah
mov eax, dword [0xe2d788fc]
invalid
int3
push eax
sub ch, byte [edi + 0x77e4c07e]
pop edx
aaa
xor edx, ebx
mov eax, 0x8a80fb6e
cmp ch, ch
nop
test dword [ebp - 0x1aab0e43], edi
add eax, 0x8d304647
sahf
mov eax, 0x1a810641
dec edi
xchg byte [eax], cl
adc byte [ebx - 0x48], bl
and ebx, 0xc3d80fac
mov ecx, dword [eax - 0x23]
jl 0x4b88b6
mov eax, dword [edi - 0x57162a27]
wait
sub byte [edx - 0x3f919d00], al
push esi
lahf
dec esi
aad 0xa0
sti
xabort 0x79
invalid

Function at 0x4b88c2
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov al, 0x52
dec ebp
jecxz 0x4b8893
push esi
add cl, byte [ebx + 0x1114ed9e]
stosb byte es:[edi], al
mov al, byte [0x6dd86fa5]
inc ebx
or dh, byte [ecx + 0x6e]
jmp 0x3bf98973
add byte [edi - 0x875dba1], cl
add byte [ebx - 0xe208a66], ch
jge 0x4b8846
mov eax, dword [0xb09ab1d2]
mov bl, 0x78
test eax, 0x98bf646f
cwde
pushfd
push ds
stosd dword es:[edi], eax
scasb al, byte es:[edi]
bound esi, qword [edi]
push 0x46
cmp ecx, esp
push ebx
mov dh, 0x97
mov esi, 0x5bd893bb
imul esi, ebx, 0xfca12610
adc byte [esi], ah
mov eax, dword [0xe2d788fc]
invalid
int3
push eax
sub ch, byte [edi + 0x77e4c07e]
pop edx
aaa
xor edx, ebx
mov eax, 0x8a80fb6e
cmp ch, ch
nop
test dword [ebp - 0x1aab0e43], edi
add eax, 0x8d304647
sahf
mov eax, 0x1a810641
dec edi
xchg byte [eax], cl
adc byte [ebx - 0x48], bl
and ebx, 0xc3d80fac
mov ecx, dword [eax - 0x23]
jl 0x4b88b6
mov eax, dword [edi - 0x57162a27]
wait
sub byte [edx - 0x3f919d00], al
push esi
lahf
dec esi
aad 0xa0
sti
xabort 0x79
invalid
Function at 0x4ba6ad
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c23a8
cmp edx, dword [eax]
je 0x4ba6cf
add eax, 8
inc ecx
cmp eax, 0x4c2438
jl 0x4ba6c0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c23a8]
jne 0x4ba7fd
mov eax, dword [0x4c6d2c]
cmp eax, 1
je 0x4ba7d7
test eax, eax
jne 0x4ba700
cmp dword [0x4c22d4], 1
je 0x4ba7d7
cmp edx, 0xfc
je 0x4ba7fd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba737
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bb090
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb520
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba77a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb520
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf9ec
push edi
call fcn.004bd3f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bb090
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb0a0
lea eax, [ebp - 0xa0]
push 0x4bf9cc
push eax
call fcn.004bb0a0
push dword [esi + 0x4c23ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb0a0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bd364
add esp, 0x2c
pop edi
jmp 0x4ba7fd
lea eax, [ebp + 8]
lea esi, [esi + 0x4c23ac]
push 0
push eax
push dword [esi]
call fcn.004bb520
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x405560
Capabilities:
Terminate process

Disassembly:
lea eax, [esp + 0xc]
push eax
push dword [esp + 0xc]
push 0x800
push 0x456f88
call fcn.004019c0
add esp, 0x10
push dword [esp + 4]
push str.WowSoft_injector
push 0x456f88
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
test byte [esp + 4], 0x10
jne 0x405599
ret
push 0
call fcn.00420701
int3
Function at 0x4075f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x4076d7
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x4076c6
jg 0x407630
test edx, edx
je 0x4076c6
nop dword [eax]
call fcn.0040b2c0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x407683
jg 0x407647
test esi, esi
je 0x407683
cmp ebx, eax
jg 0x407657
jl 0x407651
cmp edi, esi
jae 0x407657
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
push esi
push dword [esp + 0x14]
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.0041d490
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x4076aa
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x4076c0
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x407630
jl 0x4076c0
test edi, edi
jne 0x407630
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov edx, dword [eax]
lea eax, [ecx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
test edx, edx
je 0x4076ff
mov eax, dword [eax]
mov edx, dword [eax]
jmp 0x407705
xor edx, edx
mov dword [esp + 0x18], eax
mov eax, edx
cdq
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
test edi, edi
jl 0x40776d
jg 0x40771a
test esi, esi
je 0x40776d
test edx, edx
jl 0x407768
jg 0x407724
test eax, eax
je 0x407768
cmp edi, edx
jg 0x407738
jl 0x40772e
cmp esi, eax
jae 0x407738
mov eax, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov ebx, dword [ebp + 8]
push eax
push ebx
push dword [esp + 0x24]
call fcn.0041d490
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x14]
add ebx, edx
mov ecx, dword [esp + 0xc]
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x10]
sub dword [eax], edx
mov eax, dword [ecx + 0x20]
add dword [eax], edx
jmp 0x407770
mov ebx, dword [ebp + 8]
jmp 0x40777a
mov ebx, dword [ebp + 8]
test edi, edi
jl 0x407793
jg 0x40777a
test esi, esi
je 0x407793
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x407793
push eax
push esi
push 1
push ebx
call fcn.00425236
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4077b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x10]
sub esp, 0xc
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
test eax, eax
jg 0x4077db
jl 0x4077ce
test ecx, ecx
jne 0x4077db
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
mov edi, ecx
je 0x4078b4
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov ecx, ebx
call fcn.0040b2e0
mov ecx, edx
mov esi, eax
mov dword [esp + 0x14], ecx
test ecx, ecx
jl 0x40784b
jg 0x40780b
test esi, esi
je 0x40784b
mov eax, dword [esp + 0xc]
cmp eax, ecx
jg 0x40781f
jl 0x407819
cmp edi, esi
jae 0x40781f
mov esi, edi
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push dword [esp + 0x18]
call fcn.0041d490
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0xc]
sub edi, esi
sbb ecx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x10]
jmp 0x40786e
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x40789d
mov eax, dword [esp + 0x10]
add edi, 0xffffffff
mov esi, 1
mov byte [eax], cl
mov ecx, dword [esp + 0xc]
adc ecx, 0xffffffff
add eax, esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
test ecx, ecx
jg 0x4077f2
jl 0x4078a1
test edi, edi
jne 0x4077f2
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
sbb edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [esp + 0xc]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
sbb edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
test eax, eax
je 0x407903
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [esp + 0x14], edx
mov eax, dword [eax]
test eax, eax
je 0x40790a
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [esp + 0x14]
push dword [ebp + 8]
call fcn.0041d490
mov eax, dword [ebp + 8]
sub edi, esi
add eax, esi
add esp, 0xc
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0x10]
jmp 0x40790d
lea eax, [ebx + 0x2c]
mov dword [esp + 0x14], eax
mov esi, dword [ebp + 8]
cmp dword [ebx + 0x4c], 0
je 0x407977
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x407937
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov dword [eax], edx
cmp edi, 0xfff
jbe 0x407962
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.00428474
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x407977
cmp edi, eax
ja 0x407940
test edi, edi
je 0x407977
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.00428474
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x407ce0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x455008]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x407d10
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0041aaae
add esp, 0x30
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x407d4d
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x407d4d
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0041aaae
add esp, 0x30
ret 4
cmp dword [esi + 0x4c], 0
je 0x407e45
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x407d75
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x407da9
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.00420740
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0041aaae
add esp, 0x30
ret 4
mov byte [esp + 0xf], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x23]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x407e14
sub eax, 1
je 0x407e14
sub eax, 2
jne 0x407e45
push dword [esi + 0x4c]
movsx eax, byte [esp + 0x13]
push eax
call fcn.00420740
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0041aaae
add esp, 0x30
ret 4
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x18]
sub edi, eax
je 0x407e33
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00425236
add esp, 0x10
cmp edi, eax
jne 0x407e45
lea eax, [esp + 0xf]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x14], eax
jne 0x407d37
mov ecx, dword [esp + 0x38]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041aaae
add esp, 0x30
ret 4