joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4053a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov ebx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x3c]
mov dword [esp + 4], eax
mov eax, dword [esi + 0x40]
mov dword [esp], eax
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov edi, eax
xor eax, eax
test edi, edi
je 0x405409
push 0
push 0
push dword [ebx]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
add esp, 0xc
movzx eax, word [esi + 0x20]
add eax, dword [esi + 0x54]
movzx ecx, word [esi + 0x22]
add eax, ecx
add eax, 0x1e
push 0
push eax
push dword [ebx]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
add esp, 0xc
test eax, eax
je 0x405413
push edi
call fcn.0040af20
add esp, 4
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
movzx eax, word [esi + 0x32]
cmp ax, 8
je 0x40543a
test ax, ax
jne 0x4053fe
push dword [ebx]
mov esi, dword [esp + 4]
push esi
push 1
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
cmp eax, esi
jne 0x4053fe
jmp 0x4054aa
mov eax, dword [ebx]
mov dword [esp + 0x18], 0x4aaf00
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 8], 0x4aaf58
mov dword [esp + 0xc], edi
mov eax, dword [esp]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
lea ecx, [esp + 8]
lea esi, [esp + 0x18]
push 0
push ecx
push 0
push eax
push 0
push dword [esp + 0x18]
push esi
call fcn.00412630
add esp, 0x1c
mov ebx, eax
lea ecx, [esp + 8]
call fcn.00412df0
mov ecx, esi
call fcn.00412de0
test ebx, ebx
jne 0x4053fe
mov eax, edi
jmp 0x405409

Function at 0x405770
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov ebx, dword [esp + 0x28]
mov dword [esp + 2], 0x6054b50
movzx eax, word [ecx + 4]
mov word [esp + 6], ax
movzx eax, word [ecx + 6]
mov word [esp + 8], ax
movzx eax, word [ecx + 8]
mov word [esp + 0xa], ax
movzx eax, word [ecx + 0xa]
mov word [esp + 0xc], ax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0xe], eax
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x12], eax
movzx eax, word [ecx + 0x14]
mov word [esp + 0x16], ax
lea eax, [esp + 2]
push ebx
push 0x16
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
cmp eax, 0x16
jne 0x40581f
movzx eax, word [esi + 0x14]
xor edi, edi
test eax, eax
je 0x405849
push ebx
push 1
push eax
push dword [esi + 0x18]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
movzx esi, word [esi + 0x14]
cmp eax, esi
je 0x405849
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll_strerror
add esp, 4
push eax
push esi
push str.fwrite__d_bytes_failed___s
push 0x4aa9d8
push 5
call fcn.0040ab40
add esp, 0x14
jmp 0x405844
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll_strerror
add esp, 4
push eax
push str.fwrite_EOCD_failed___s
push 0x4aa9d8
push 5
call fcn.0040ab40
add esp, 0x10
mov edi, 0x80000000
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
ret 4
Function at 0x405860
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x8010
call fcn.0040f658
mov ebp, dword [esp + 0x8034]
mov eax, dword [esp + 0x8030]
mov esi, dword [esp + 0x802c]
mov ecx, dword [esp + 0x8028]
mov edx, esi
xor edx, ebp
mov dword [esp + 4], ecx
mov edi, eax
xor ecx, eax
xor eax, eax
or ecx, edx
je 0x405a22
mov ebx, dword [esp + 0x8038]
test ebx, ebx
je 0x405a22
lea eax, [esp + 0x10]
push 0x8000
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov eax, 0x80000000
cmp dword [esp + 0x8028], edi
mov ecx, esi
sbb ecx, ebp
jge 0x405a22
mov edx, edi
mov dword [esp + 8], esi
mov esi, dword [esp + 0x8024]
nop word cs:[eax + eax]
mov dword [esp + 0xc], ebp
cmp ebx, 0x8000
mov edi, 0x8000
cmovb edi, ebx
push 0
mov dword [esp + 4], edx
push edx
push esi
mov ebp, esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
add esp, 0xc
test eax, eax
jne 0x405977
push ebp
push edi
push 1
lea eax, [esp + 0x1c]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
cmp eax, edi
jne 0x405993
push 0
push dword [esp + 8]
push ebp
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
add esp, 0xc
test eax, eax
jne 0x4059ab
mov esi, ebp
push ebp
push edi
push 1
lea eax, [esp + 0x1c]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
cmp eax, edi
jne 0x4059d6
mov edx, dword [esp]
add edx, edi
mov ebp, dword [esp + 0xc]
adc ebp, 0
add dword [esp + 4], edi
adc dword [esp + 8], 0
sub ebx, edi
jne 0x4058f0
xor eax, eax
jmp 0x405a22
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll_strerror
add esp, 4
push eax
push dword [esp + 4]
push str.filemove_src_seek__ld_failed___s
jmp 0x4059c5
push ebp
call sub.api_ms_win_crt_stdio_l1_1_0.dll_feof
add esp, 4
test eax, eax
je 0x4059f3
push dword [esp]
push edi
push str.fread__zu_bytes_off_ld_failed__unexpected_EOF
jmp 0x4059c5
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll_strerror
add esp, 4
push eax
push dword [esp + 8]
push str.filemove_dst_seek__ld_failed___s
push 0x4aa9d8
push 5
call fcn.0040ab40
add esp, 0x14
jmp 0x405a1d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll_strerror
add esp, 4
push eax
push dword [esp + 8]
push edi
push str.filemove_write__zu_off_ld_failed___s
jmp 0x405a0e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll_strerror
add esp, 4
push eax
push dword [esp + 4]
push edi
push str.fread__zu_bytes_off_ld_failed___s
push 0x4aa9d8
push 5
call fcn.0040ab40
add esp, 0x18
mov eax, 0x80000000
add esp, 0x8010
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x407ba0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x407bd8
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x407bce
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x407bda
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x407bc0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x40b050
Capabilities:
Enumerate pe sections
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov edi, ecx
xorps xmm0, xmm0
movups xmmword [esp + 0x1e], xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
mov eax, esp
push dword [ebp + 8]
push 0x2e
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
mov esi, 0x80000000
cmp eax, 0x2e
jne 0x40b1dd
cmp dword [esp], 0x2014b50
jne 0x40b1c9
movzx eax, word [esp + 4]
mov word [edi], ax
movzx eax, word [esp + 6]
mov word [edi + 2], ax
movzx eax, word [esp + 8]
mov word [edi + 4], ax
movzx eax, word [esp + 0xa]
mov word [edi + 6], ax
movzx eax, word [esp + 0xc]
mov word [edi + 8], ax
movzx eax, word [esp + 0xe]
mov word [edi + 0xa], ax
mov eax, dword [esp + 0x10]
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x14]
mov dword [edi + 0x10], eax
mov eax, dword [esp + 0x18]
mov dword [edi + 0x14], eax
movzx ebx, word [esp + 0x1c]
mov word [edi + 0x18], bx
movzx eax, word [esp + 0x1e]
mov word [edi + 0x1a], ax
movzx ecx, word [esp + 0x20]
mov word [edi + 0x1c], cx
movzx ecx, word [esp + 0x22]
mov word [edi + 0x1e], cx
movzx ecx, word [esp + 0x24]
mov word [edi + 0x20], cx
mov ecx, dword [esp + 0x26]
mov dword [edi + 0x24], ecx
mov ecx, dword [esp + 0x2a]
mov dword [edi + 0x28], ecx
test bx, bx
je 0x40b15b
lea eax, [ebx + 1]
push eax
call fcn.00405d60
add esp, 4
mov dword [edi + 0x2c], eax
push dword [ebp + 8]
push ebx
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
movzx ecx, word [edi + 0x18]
cmp eax, ecx
jne 0x40b1dd
mov ecx, dword [edi + 0x2c]
mov byte [ecx + eax], 0
movzx eax, word [edi + 0x1a]
test ax, ax
je 0x40b190
movzx ebx, ax
lea eax, [ebx + 1]
push eax
call fcn.00405d60
add esp, 4
mov dword [edi + 0x30], eax
push dword [ebp + 8]
push ebx
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
movzx ecx, word [edi + 0x1a]
cmp eax, ecx
jne 0x40b1dd
mov ecx, dword [edi + 0x30]
mov byte [ecx + eax], 0
movzx ebx, word [edi + 0x1c]
test ebx, ebx
je 0x40b1c5
lea eax, [ebx + 1]
push eax
call fcn.00405d60
add esp, 4
mov dword [edi + 0x34], eax
push dword [ebp + 8]
push ebx
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
movzx ecx, word [edi + 0x1c]
cmp eax, ecx
jne 0x40b1dd
mov ecx, dword [edi + 0x34]
mov byte [ecx + eax], 0
xor esi, esi
jmp 0x40b1dd
push str.Whoops:_didnt_find_expected_signature_n
push 0x4abb7c
push 3
call fcn.0040ab40
add esp, 0xc
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x40b1f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov edi, ecx
xorps xmm0, xmm0
movups xmmword [esp + 0xe], xmm0
movaps xmmword [esp], xmm0
mov eax, esp
push dword [ebp + 8]
push 0x1e
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
mov esi, 0x80000000
cmp eax, 0x1e
jne 0x40b30e
cmp dword [esp], 0x4034b50
jne 0x40b2fa
movzx eax, word [esp + 4]
mov word [edi + 4], ax
movzx eax, word [esp + 6]
mov word [edi + 6], ax
movzx eax, word [esp + 8]
mov word [edi + 8], ax
movzx eax, word [esp + 0xa]
mov word [edi + 0xa], ax
movzx eax, word [esp + 0xc]
mov word [edi + 0xc], ax
mov eax, dword [esp + 0xe]
mov dword [edi + 0x10], eax
mov eax, dword [esp + 0x12]
mov dword [edi + 0x14], eax
mov eax, dword [esp + 0x16]
mov dword [edi + 0x18], eax
movzx ebx, word [esp + 0x1a]
mov word [edi + 0x1c], bx
movzx eax, word [esp + 0x1c]
mov word [edi + 0x1e], ax
test bx, bx
je 0x40b2c1
lea eax, [ebx + 1]
push eax
call fcn.00405d60
add esp, 4
mov dword [edi + 0x20], eax
push dword [ebp + 8]
push ebx
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
movzx ecx, word [edi + 0x1c]
cmp eax, ecx
jne 0x40b30e
mov ecx, dword [edi + 0x20]
mov byte [ecx + eax], 0
movzx eax, word [edi + 0x1e]
test ax, ax
je 0x40b2f6
movzx ebx, ax
lea eax, [ebx + 1]
push eax
call fcn.00405d60
add esp, 4
mov dword [edi + 0x24], eax
push dword [ebp + 8]
push ebx
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
movzx ecx, word [edi + 0x1e]
cmp eax, ecx
jne 0x40b30e
mov ecx, dword [edi + 0x24]
mov byte [ecx + eax], 0
xor esi, esi
jmp 0x40b30e
push str.whoops:_didnt_find_expected_signature_n
push 0x4abb7c
push 3
call fcn.0040ab40
add esp, 0xc
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x40b880
Capabilities:
Enumerate pe sections
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov esi, ecx
mov ebx, dword [esp + 0x30]
mov dword [esp + 2], 0x4034b50
movzx eax, word [ecx + 4]
mov word [esp + 6], ax
movzx eax, word [ecx + 6]
mov word [esp + 8], ax
movzx eax, word [ecx + 8]
mov word [esp + 0xa], ax
movzx eax, word [ecx + 0xa]
mov word [esp + 0xc], ax
movzx eax, word [ecx + 0xc]
mov word [esp + 0xe], ax
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 0x18]
mov dword [esp + 0x18], eax
movzx eax, word [ecx + 0x1c]
mov word [esp + 0x1c], ax
movzx eax, word [ecx + 0x1e]
mov word [esp + 0x1e], ax
lea eax, [esp + 2]
push ebx
push 0x1e
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
mov edi, 0x80000000
cmp eax, 0x1e
jne 0x40b944
movzx eax, word [esi + 0x1c]
test eax, eax
je 0x40b923
push ebx
push eax
push 1
push dword [esi + 0x20]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
movzx ecx, word [esi + 0x1c]
cmp eax, ecx
jne 0x40b944
movzx eax, word [esi + 0x1e]
test eax, eax
je 0x40b942
push ebx
push eax
push 1
push dword [esi + 0x24]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
movzx ecx, word [esi + 0x1e]
cmp eax, ecx
jne 0x40b944
xor edi, edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
ret 4
Function at 0x40ba10
Capabilities:
Enumerate pe sections
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x30
mov esi, ecx
mov ebx, dword [esp + 0x40]
mov dword [esp + 2], 0x2014b50
movzx eax, word [ecx]
mov word [esp + 6], ax
movzx eax, word [ecx + 2]
mov word [esp + 8], ax
movzx eax, word [ecx + 4]
mov word [esp + 0xa], ax
movzx eax, word [ecx + 6]
mov word [esp + 0xc], ax
movzx eax, word [ecx + 8]
mov word [esp + 0xe], ax
movzx eax, word [ecx + 0xa]
mov word [esp + 0x10], ax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x12], eax
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x16], eax
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x1a], eax
movzx eax, word [ecx + 0x18]
mov word [esp + 0x1e], ax
movzx eax, word [ecx + 0x1a]
mov word [esp + 0x20], ax
movzx eax, word [ecx + 0x1c]
mov word [esp + 0x22], ax
movzx eax, word [ecx + 0x1e]
mov word [esp + 0x24], ax
movzx eax, word [ecx + 0x20]
mov word [esp + 0x26], ax
mov eax, dword [ecx + 0x24]
mov dword [esp + 0x28], eax
mov eax, dword [ecx + 0x28]
mov dword [esp + 0x2c], eax
lea eax, [esp + 2]
push ebx
push 0x2e
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
mov edi, 0x80000000
cmp eax, 0x2e
jne 0x40bb24
movzx eax, word [esi + 0x18]
test eax, eax
je 0x40bae4
push ebx
push eax
push 1
push dword [esi + 0x2c]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
movzx ecx, word [esi + 0x18]
cmp eax, ecx
jne 0x40bb24
movzx eax, word [esi + 0x1a]
test eax, eax
je 0x40bb03
push ebx
push eax
push 1
push dword [esi + 0x30]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
movzx ecx, word [esi + 0x1a]
cmp eax, ecx
jne 0x40bb24
movzx eax, word [esi + 0x1c]
test eax, eax
je 0x40bb22
push ebx
push eax
push 1
push dword [esi + 0x34]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
movzx ecx, word [esi + 0x1c]
cmp eax, ecx
jne 0x40bb24
xor edi, edi
mov eax, edi
add esp, 0x30
pop esi
pop edi
pop ebx
ret 4
Function at 0x40c0a0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x120
mov eax, ecx
mov ecx, dword [ebp + 8]
xorps xmm0, xmm0
movaps xmmword [esp + 0x80], xmm0
movaps xmmword [esp + 0x70], xmm0
movaps xmmword [esp + 0x60], xmm0
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 8], ecx
test ecx, ecx
jle 0x40c36b
mov dword [esp + 0xc], edx
movaps xmm0, xmmword [0x4aca10]
movups xmmword [esp + 0x9c], xmm0
movaps xmm0, xmmword [0x4aca20]
movups xmmword [esp + 0xac], xmm0
movaps xmm0, xmmword [0x4aca30]
movups xmmword [esp + 0xbc], xmm0
movaps xmm0, xmmword [0x4aca40]
movups xmmword [esp + 0xcc], xmm0
movaps xmm0, xmmword [0x4aca50]
movups xmmword [esp + 0xdc], xmm0
movaps xmm0, xmmword [0x4aca60]
movups xmmword [esp + 0xec], xmm0
movaps xmm0, xmmword [0x4aca70]
movups xmmword [esp + 0xfc], xmm0
movaps xmm0, xmmword [0x4aca80]
movups xmmword [esp + 0x10c], xmm0
xor edi, edi
mov ebx, 0xedb88320
lea esi, [esp + 0x9c]
nop dword [eax + eax]
mov ecx, 0
test ebx, ebx
je 0x40c1b0
xor ecx, ecx
mov edx, esi
jmp 0x40c199
shr ebx, 1
add edx, 4
test ebx, ebx
je 0x40c1b0
test bl, 1
je 0x40c190
xor ecx, dword [edx]
jmp 0x40c190
mov dword [esp + edi*4 + 0x10], ecx
lea ecx, [edi + 1]
cmp ecx, 0x20
je 0x40c1c7
mov ebx, dword [esp + edi*4 + 0xa0]
mov edi, ecx
jmp 0x40c180
xor esi, esi
lea edi, [esp + 0x10]
jmp 0x40c1df
mov dword [esp + esi*4 + 0x9c], ecx
add esi, 1
cmp esi, 0x20
je 0x40c212
mov ebx, dword [esp + esi*4 + 0x10]
mov ecx, 0
test ebx, ebx
je 0x40c1d0
xor ecx, ecx
mov edx, edi
jmp 0x40c209
shr ebx, 1
add edx, 4
test ebx, ebx
je 0x40c1d0
test bl, 1
je 0x40c200
xor ecx, dword [edx]
jmp 0x40c200
lea edi, [esp + 0x9c]
jmp 0x40c22f
mov eax, ebx
sar edx, 2
mov dword [esp + 8], edx
je 0x40c367
xor ebx, ebx
jmp 0x40c24c
mov dword [esp + ebx*4 + 0x10], edx
add ebx, 1
cmp ebx, 0x20
je 0x40c290
mov ecx, dword [esp + ebx*4 + 0x9c]
mov edx, 0
test ecx, ecx
je 0x40c240
xor edx, edx
mov esi, edi
jmp 0x40c279
shr ecx, 1
add esi, 4
test ecx, ecx
je 0x40c240
test cl, 1
je 0x40c270
xor edx, dword [esi]
jmp 0x40c270
mov edx, dword [esp + 8]
test dl, 1
jne 0x40c2a0
mov ebx, eax
jmp 0x40c2aa
xor ebx, ebx
test eax, eax
jne 0x40c346
cmp edx, 2
jb 0x40c365
xor eax, eax
jmp 0x40c2cf
mov dword [esp + eax*4 + 0x9c], edx
add eax, 1
cmp eax, 0x20
je 0x40c310
mov ecx, dword [esp + eax*4 + 0x10]
mov edx, 0
test ecx, ecx
je 0x40c2c0
xor edx, edx
lea esi, [esp + 0x10]
jmp 0x40c2f9
shr ecx, 1
add esi, 4
test ecx, ecx
je 0x40c2c0
test cl, 1
je 0x40c2f0
xor edx, dword [esi]
jmp 0x40c2f0
mov edx, dword [esp + 8]
test dl, 2
je 0x40c220
xor eax, eax
test ebx, ebx
je 0x40c222
xor eax, eax
mov ecx, edi
jmp 0x40c33d
shr ebx, 1
add ecx, 4
test ebx, ebx
je 0x40c222
test bl, 1
je 0x40c330
xor eax, dword [ecx]
jmp 0x40c330
xor ebx, ebx
lea ecx, [esp + 0x10]
jmp 0x40c35d
shr eax, 1
add ecx, 4
test eax, eax
je 0x40c2aa
test al, 1
je 0x40c350
xor ebx, dword [ecx]
jmp 0x40c350
mov eax, ebx
xor eax, dword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x422190
Capabilities:
Terminate process

Disassembly:
push ebx
push edi
push esi
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
push dword [edi]
call fcn.0040af20
add esp, 4
push dword [edi + 4]
call fcn.0040af20
add esp, 4
mov eax, dword [ebx + 8]
add eax, eax
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov esi, eax
mov dword [edi], eax
mov eax, dword [ebx + 8]
add eax, eax
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov dword [edi + 4], eax
test esi, esi
je 0x422236
test eax, eax
je 0x422236
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
cmp dword [ebx + 8], 0
je 0x422232
mov eax, dword [ebx]
movzx eax, word [eax]
mov word [esi], ax
mov eax, dword [ebx + 4]
movzx eax, word [eax]
mov ecx, dword [edi + 4]
mov word [ecx], ax
cmp dword [ebx + 8], 2
jb 0x422232
mov eax, 1
nop word cs:[eax + eax]
mov ecx, dword [edi]
mov edx, dword [ebx]
movzx edx, word [edx + eax*2]
mov word [ecx + eax*2], dx
mov ecx, dword [ebx + 4]
movzx ecx, word [ecx + eax*2]
mov edx, dword [edi + 4]
mov word [edx + eax*2], cx
add eax, 1
cmp eax, dword [ebx + 8]
jb 0x422210
pop esi
pop edi
pop ebx
ret
push 0xffffffffffffffff
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop dword [eax]
Function at 0x424d50
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov eax, ebx
sub eax, edi
add eax, eax
add eax, 2
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov dword [esp], 0
mov dword [esp + 4], 0
test eax, eax
je 0x424dce
mov esi, eax
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], ebx
lea ebp, [esp + 4]
push eax
push 0
push 0x424de0
push esi
push ebp
lea eax, [esp + 0x14]
push eax
push ebx
push edi
call fcn.00424420
add esp, 0x20
push esi
call fcn.0040af20
add esp, 4
push dword [esp]
call fcn.0040af20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
push 0xffffffffffffffff
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop word cs:[eax + eax]
nop
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x424e3e
push eax
call fcn.0040bc40
add esp, 4
mov esi, eax
push ebx
call fcn.0040bcd0
add esp, 4
mov edi, eax
push ebx
call fcn.0040bcf0
add esp, 4
xor ecx, ecx
cmp eax, 0x118
setl cl
cvtsi2sd xmm0, esi
addsd xmm0, qword [ecx*8 + 0x4b0ce0]
cvtsi2sd xmm1, edi
addsd xmm1, xmm0
movsd qword [esp], xmm1
fld qword [esp]
jmp 0x424e50
xor eax, eax
cmp ebx, 0x90
setb al
fld qword [eax*8 + 0x4b0cf0]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x424ea0
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov al, byte [0x4be698]
test al, al
je 0x424f97
push dword [0x4be694]
push dword [0x4be690]
push edi
push esi
call fcn.00406170
add esp, 0x10
mov edi, eax
mov eax, dword [ebp + 0x1c]
and eax, 2
add eax, 2
push 0
push 0
push 0
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
je 0x424f45
mov ebx, eax
sub esi, edi
mov eax, dword [ebp + 0x1c]
test al, 2
mov eax, 4
mov ecx, 0xf001f
cmove ecx, eax
mov eax, dword [ebp + 0x18]
add eax, edi
push eax
push esi
push 0
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x424f7f
mov esi, eax
push 0x10
call fcn.00405c70
add esp, 4
mov dword [eax], esi
mov ecx, dword [ebp + 0x18]
mov dword [eax + 4], ecx
mov dword [eax + 8], edi
mov dword [eax + 0xc], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, ecx
jmp 0x424f8f
cmp dword [ebp + 0x18], 0
jne 0x424f86
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3ee
jne 0x424f86
push 0x10
call fcn.00405c70
add esp, 4
mov dword [eax], 0x4b0d90
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
jmp 0x424f3c
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
mov dword [eax], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4be698
call fcn.00417d90
add esp, 4
test eax, eax
je 0x424ec2
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
mov dword [esp + 0x20], 0
mov eax, esp
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x1c]
mov dword [0x4be690], eax
mov dword [0x4be694], 0
push 0x4be698
call fcn.00417e20
add esp, 4
jmp 0x424ec2