joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1699876
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 1]
mov al, byte [esp + 0xe]
setne ah
sub esp, 9
jmp 0x1699855
bswap edx
sub esp, 0x15
lea esp, [esp + 0x18]
mov dh, byte [esp + 6]
xchg word [esp + 9], dx
mov ebp, dword [esp + 7]
jmp 0x1699811
mov ebp, edx
btc eax, ebx
sete al
pop word [esp + 8]
jmp 0x1699899
xchg dword [esp + 0xf], edx
pop edx
mov dword [esp + 0x10], esp
mov bp, word [esp + 0x14]
mov word [esp + 0xb], sp
setns dh
jmp 0x169983f
mov ax, word [esp]
pop ax
pop ax
not bp
jmp 0x1699827
xchg byte [esp + 7], dl
lea eax, [eax + edi]
lea esp, [esp + 9]
shl ah, cl
jmp 0x16998ca
mov word [esp + 0x10], sp
mov dh, byte [esp + 0x12]
mov byte [esp + 1], bh
setp al
lea ebp, [eax*4]
neg eax
jmp 0x1699883
neg ah
shl dx, 0xb
stc
xchg byte [esp + 1], ah
xchg dx, ax
jmp 0x1699a2d
xchg byte [esp + 2], ah
push dx
xchg byte [esp], dh
pop dword [esp + 3]
mov byte [esp], bh
mov al, 9
jmp 0x16998b4
mov ax, 0x4d21
lea ebp, [eax*4]
mov dl, 0xed
lea ebp, reloc.kernel32.dll_GetProcAddress
jmp 0x1699926
xchg bp, ax
rdtsc
rdtsc
pop edx
lea eax, [edi*4]
neg al
jmp 0x16998f9
sub esp, 0x17
lea eax, [ebx*4]
bswap eax
mov word [esp + 2], bx
mov word [esp + 0xe], dx
jmp 0x16999fc
add esp, 1
sub esp, 6
xchg byte [esp + 5], dl
mov ebp, edi
xchg dx, ax
stc
jmp 0x1699913
mov eax, 0x809385d7
mov dx, 0x637b
lea eax, [ecx - 0x84]
pop ebp
pop dword [esp + 6]
pop eax
jmp 0x16999b3
pop word [esp + 3]
bsr ax, di
mov dl, byte [esp + 0x11]
push word [esp + 0xa]
mov ebp, 0xe943c6be
xchg dx, ax
jmp 0x1699953
dec al
mov ah, bh
add esp, 2
bswap eax
pop word [esp + 2]
not edx
jmp 0x16999e2
sbb ebp, 0x29c23ae5
call fcn.016999cc
cmp dh, byte [ebx + 0x1ab54623]
and dword ss:[eax - 0x5d], esp
fidiv dword [reloc.kernel32.dll_GetProcAddress]
mov eax, dword [esp + 9]
lea esp, [esp + 5]
push word [esp]
cmc
mov ax, cx
lea ebp, [ecx*4]
jmp 0x169998a
xchg word [esp + 1], bp
pop ebp
mov bp, 0xc4b4
shl dh, 7
mov eax, 0xfed590b4
jmp 0x169999c
btr dx, bp
not dx
mov dl, byte [esp + 0xe]
pop word [esp + 6]
add bp, ax
xchg dx, bp
jmp 0x169996f
mov eax, dword [esp + 5]
add esp, 6
bsr edx, ecx
mov edx, dword [esp]
mov ah, al
dec ax
jmp 0x1699942

Function at 0x1699db9
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
jmp 0x1699dc0
xchg byte [esp + 8], ah
pop word [esp + 0xf]
neg bp
cld
push dword [esp + 0x21]
jmp 0x1699def
pop word [esp + 0x15]
lea ebp, [edx + esi]
sete dh
mov edx, 0x1d4721a0
xchg word [esp + 0x26], dx
rcl dl, cl
jmp 0x1699e4c
mov ax, dx
lea eax, [ebp*4]
mov dh, ch
lea esp, [esp + 0x1a]
mov edx, dword [esp + 5]
or dh, 0xf0
jmp 0x1699e62
or dx, 0xe4de
mov ax, word [esp + 0x28]
pop word [esp + 0x1e]
xchg bp, ax
std
pop bp
jmp 0x1699e2a
rdtsc
push word [esp + 9]
lea ebp, [esi*4]
rdtsc
cmc
lea eax, [edx + 0x8a]
jmp 0x1699ea7
neg eax
sub esp, 0x15
mov ah, 0x69
xchg edx, eax
add esp, 0x13
bswap edx
jmp 0x1699e91
Function at 0x169a17a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bp, word [esp + 6]
mov bp, word [esp + 0xc]
bswap edx
pop word [esp + 0xb]
mov bp, 0x801a
pop word [esp + 0x1c]
jmp 0x169a162
mov eax, edx
xchg edx, ebp
and dl, al
pushal
bsf dx, ax
xchg word [esp + 0x20], dx
jmp 0x169a113
mov dl, ch
rdtsc
or bp, bx
xchg word [esp + 0xb], bp
sub esp, 0xf
jmp 0x169a194
bswap edx
mov ebp, dword [esp + 0x1e]
mov ebp, edx
xchg ebp, edx
mov ebp, 0x769b1b9a
setle ah
jmp 0x169a14c
rdtsc
jmp 0x169a13a
mov bp, 0xecbb
stc
std
dec edx
call fcn.0169a17e

Function at 0x169a17e
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
sets dl
jmp 0x169a1a0
mov dx, si
mov ax, cx
mov ebp, dword [esp + 0xb]
mov dword [esp + 0x2f], eax
lea eax, [edx + ebx]
bswap eax
jmp 0x169a1ea
setg dh
mov dl, 0xc3
mov ebp, dword [esp + 0x1d]
setl al
clc
mov bp, word [esp + 0x21]
jmp 0x169a1d4

Function at 0x169a382
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop bp
lea edx, [ebx - 0xc]
xchg dx, bp
mov ah, 0xca
mov dl, 0xba
lea eax, [edi + ebp]
jmp 0x169a361
mov bp, 0x6d3f
push dword [esp]
setne al
xchg dword [esp + 0x14], edx
pop word [esp + 8]
lea ebp, [eax*4]
jmp 0x169a319
mov dh, byte [esp]
lea eax, [eax + ecx]
cld
mov ebp, dword [esp]
jmp 0x169a3a0
pushal
lea esp, [esp + 0x4a]
mov ah, byte [esp]
lea edx, [ecx + ebx]
xchg dl, dh
and dl, dl
jmp 0x169a34b
xchg byte [esp + 0x27], dl
cmc
jmp 0x169a32f
cmp edx, esp
push word [esp + 2]
rdtsc
sbb edx, 0xb7d3bb74
jmp 0x169a3b5
lea eax, [ecx*4]
mov dx, ax
push ecx
mov dh, bl
not dx
bts eax, ecx
jmp 0x169a389
bsf ax, sp
not dl
rdtsc
mov word [esp + 2], ax
stc
bsf ax, si
jmp 0x169a4c5
dec al
xchg byte [esp], dl
mov al, dl
mov ebp, 0xcb901ca6
mov edx, ebp
not dh
jmp 0x169a3f9
mov eax, dword [esp]
mov eax, dword [esp]
mov al, byte [esp]
cld
lea eax, [esp + 0xb1]
xchg byte [esp], dl
jmp 0x169a40f
add esp, 5
xchg byte [esp], dh
mov byte [esp], dl
bswap eax
xchg bp, ax
mov ebp, 0x6ef5d91a
jmp 0x169a476

Function at 0x169a53d
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 0xe], ax
pop dword [esp + 0xb]
mov ax, word [esp + 4]
jmp 0x169a55e
mov bp, 0xad92
bt dx, si
sub esp, 0x16
xchg word [esp + 0xc], ax
neg ebp
dec eax
jmp 0x169a507
lea esp, [esp + 4]
not dl
bsr ebp, edx
jmp 0x169a51d
not ax
rdtsc
mov dl, byte [esp + 2]
xchg ebp, eax
pop edx
setns dh
jmp 0x169a5c4
mov dx, word [esp + 5]
rdtsc
bts ebp, ebp
xchg byte [esp + 9], dh
pop dword [esp + 5]
jmp 0x169a548
cmp ah, al
bt ax, di
inc dh
mov ax, bx
mov ax, word [esp + 8]
pop word [esp + 9]
jmp 0x169a585
mov bp, word [esp + 4]
xchg byte [esp + 8], dh
push dword [esp + 2]
lea eax, [edx*4]
xchg dl, dh
rdtsc
jmp 0x169a59b

Function at 0x4b20ba
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x3f3565b0
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
mov ecx, 0x10264cac
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x407a20
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4262d8
push 0x41b808
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
pushal
pushfd
xor ebx, ebx
mov ecx, 0xa
mov eax, 0x564d5868
mov dx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete al
movzx eax, al
mov dword [0x4316a0], eax
popfd
popal
jmp 0x407a88
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x4316a0]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40aad0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x18]
xor ebp, ebp
push 0x104
mov dword [esp + 0x14], ecx
push eax
mov dword [esp + 0x1c], ebp
call dword [0x4260e8]
mov ecx, dword [0x4321e4]
push 0x42ba4c
push ecx
call fcn.00405570
mov edx, eax
or ecx, 0xffffffff
mov edi, 0x42b1f0
xor eax, eax
add esp, 8
add edx, 6
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebx, [esp + 0x18]
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea ebx, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x80
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x20]
and ecx, 3
push 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x42ba44
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push 1
and ecx, 3
lea eax, [esp + 0x2c]
push 0x80000000
push eax
rep movsb byte es:[edi], byte [esi]
call dword [0x4260c0]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40ac00
push ebp
push ebx
call dword [0x4260bc]
mov edi, eax
push edi
call fcn.0041ab6e
add esp, 4
lea ecx, [esp + 0x14]
mov esi, eax
push ebp
push ecx
push edi
push esi
push ebx
call dword [0x4260c4]
xor eax, eax
test edi, edi
jbe 0x40abea
mov cl, byte [eax + esi]
xor cl, 0x62
mov byte [eax + esi], cl
inc eax
cmp eax, edi
jb 0x40abdc
mov ecx, dword [esp + 0x10]
push edi
push esi
call fcn.0040aa70
push esi
mov ebp, eax
call fcn.0041ab7c
add esp, 4
push ebx
call dword [0x4261b8]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x410eb0
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4263c0
push 0x41b808
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x1c], 1
mov dword [ebp - 4], 0
push edx
push ecx
push ebx
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 0x1c]
pop ebx
pop ecx
pop edx
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x497d90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5f000]
push edi
jmp 0x497daa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x497db1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x497da0
mov eax, 1
add ebx, ebx
jne 0x497dc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x497dd4
jne 0x497df3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x497df3
dec eax
add ebx, ebx
jne 0x497de0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x497db8
add ebx, ebx
jne 0x497def
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x497e45
xor ecx, ecx
sub eax, 3
jb 0x497e0b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x497e7a
sar eax, 1
mov ebp, eax
jmp 0x497e16
add ebx, ebx
jne 0x497e16
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x497de4
inc ecx
add ebx, ebx
jne 0x497e24
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x497de4
add ebx, ebx
jne 0x497e31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x497e26
jne 0x497e42
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x497e26
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x497e64
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x497e56
jmp 0x497da6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x497e64
add edi, ecx
jmp 0x497da6
pop esi
mov edi, esi
mov ecx, 0x2cc0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x497e82
cmp byte [edi], 0x1a
jne 0x497e82
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x497e87
lea edi, [esi + 0x94000]
mov eax, dword [edi]
or eax, eax
je 0x497eff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9c754]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9c86c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x497eb4
mov ecx, edi
jns 0x497ee3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9c870]
or eax, eax
je 0x497ef9
mov dword [ebx], eax
add ebx, 4
jmp 0x497ed1
call dword [esi + 0x9c880]
mov ebp, dword [esi + 0x9c874]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x497f33
sub esp, 0xffffff80
jmp 0x454d3d
Function at 0x414f50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40e015
lea edi, [esi - 0xd015]
push edi
or ebp, 0xffffffff
jmp 0x414f72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414f79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414f68
mov eax, 1
add ebx, ebx
jne 0x414f8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414f80
jne 0x414f9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414f80
xor ecx, ecx
sub eax, 3
jb 0x414fb0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x415022
mov ebp, eax
add ebx, ebx
jne 0x414fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414fc8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414fec
inc ecx
add ebx, ebx
jne 0x414fd8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414fcd
jne 0x414fe9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414fcd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41500c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414ffd
jmp 0x414f6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41500c
add edi, ecx
jmp 0x414f6e
pop esi
mov edi, esi
mov ecx, 0x210
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41502a
cmp byte [edi], 5
jne 0x41502a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41502f
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x41509e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x16414]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x164c8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41505c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x164cc]
or eax, eax
je 0x415098
mov dword [ebx], eax
add ebx, 4
jmp 0x415079
call dword [esi + 0x164dc]
mov ebp, dword [esi + 0x164d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4150d2
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x404760
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0xc], ecx
xorps xmm0, xmm0
push str.OOB_Length
push edi
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0x1c], xmm0
call sym.fixios.exe_plist_dict_get_item
mov esi, eax
add esp, 8
test esi, esi
je 0x40491b
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x40491b
cmp dword [ecx + 0x10], 1
jne 0x40491b
test ecx, ecx
je 0x4047b1
mov eax, dword [ecx + 0x10]
jmp 0x4047b6
mov eax, 0xa
mov dword [ebp - 8], eax
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
cmp eax, 1
jne 0x4047db
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 8]
call fcn.00428610
add esp, 8
push str.OOB_Offset
push edi
call sym.fixios.exe_plist_dict_get_item
add esp, 8
test eax, eax
je 0x404904
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x404904
cmp dword [ecx + 0x10], 1
jne 0x404904
lea ecx, [ebp - 0x14]
push ecx
push eax
call sym.fixios.exe_plist_get_uint_val
mov ebx, dword [ebp - 0x1c]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x40483a
push 0x438b8c
call fcn.00404d10
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
add esp, 4
push 0
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
push esi
push ebx
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x20
xor ecx, ecx
cmp eax, ebx
jne 0x4048d4
cmp ecx, dword [ebp - 0x18]
jne 0x4048d4
mov dword [ebp - 8], ecx
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, edi
push eax
push ebx
mov ecx, dword [ecx]
call fcn.0041fdb0
add esp, 8
test eax, eax
mov eax, dword [ebp - 8]
jne 0x4048a4
cmp eax, ebx
jne 0x4048a4
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push eax
push str.ERROR:_Unable_to_send_data_to_ASR._Sent__u_of__u_bytes._n
call fcn.00404d10
add esp, 0xc
push str.ERROR:_Unable_to_send_OOB_data_to_ASR_n
call fcn.00404d10
add esp, 4
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
add esp, 4
push eax
push str.ERROR:_Unable_to_read_OOB_data_from_filesystem_offset:__s_n
call fcn.00404d10
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.ERROR:_Unable_to_find_OOB_data_offset_n
call fcn.00404d10
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.ERROR:_Unable_to_find_OOB_data_length_n
call fcn.00404d10
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404df0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
push edi
push str.Writing_data_to__s_n
call fcn.00404da0
push 0x438db0
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x404e36
push edi
push str.write_file:_Unable_to_open_file__s_n
call fcn.00404d10
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
push ebx
push esi
push 1
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [ebp - 4]
add esp, 0x14
cmp eax, esi
je 0x404e74
push esi
push eax
push edi
push str.ERROR:_Unable_to_write_entire_file:__s:__d_of__d_n
call fcn.00404d10
add esp, 0x10
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404e80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x436008]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x44]
push 0x38
mov ebx, edx
mov dword [ebp - 0x4c], edi
push 0
push eax
mov dword [ebp - 0x50], ebx
mov esi, ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64]
add esp, 8
test eax, eax
je 0x404ef5
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
add esp, 4
push eax
push str.read_file:_fstat:__s_n
call fcn.00404d10
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0042eb3e
mov esp, ebp
pop ebp
ret
push esi
push str.Reading_data_from__s_n
call fcn.00404da0
push 0x438e3c
mov dword [edi], 0
push esi
mov dword [ebx], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x404f55
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
add esp, 4
push eax
push esi
push str.read_file:_cannot_open__s:__s_n
call fcn.00404d10
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0042eb3e
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x2c]
push esi
mov dword [ebp - 0x48], esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x404f96
push 0x438e60
call fcn.00404d10
add esp, 4
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0042eb3e
mov esp, ebp
pop ebp
ret
push edi
push esi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [ebp - 0x48]
add esp, 0x14
cmp esi, eax
je 0x404fdf
push str.ERROR:_Unable_to_read_entire_file_n
call fcn.00404d10
add esp, 4
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0042eb3e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x4c]
pop edi
pop esi
mov dword [ecx], eax
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 8]
xor ecx, ebp
mov dword [eax], ebx
xor eax, eax
pop ebx
call fcn.0042eb3e
mov esp, ebp
pop ebp
ret
Function at 0x4050f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
mov dword [ebp - 4], edx
test edi, edi
jne 0x405106
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
push edi
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir
add esp, 4
test eax, eax
jne 0x405118
pop edi
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
call esi
cmp dword [eax], 0x11
jne 0x40512e
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
call esi
cmp dword [eax], 2
jne 0x4051eb
push ebx
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
add esp, 4
mov ebx, eax
mov ecx, ebx
call fcn.00401100
mov esi, eax
test esi, esi
je 0x4051c7
mov edx, 0x438f34
mov ecx, esi
nop word [eax + eax]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x405180
test al, al
je 0x40517c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x405180
add ecx, 2
add edx, 2
test al, al
jne 0x405160
xor eax, eax
jmp 0x405185
sbb eax, eax
or eax, 1
test eax, eax
je 0x4051c7
mov ecx, edi
mov eax, esi
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4051b0
test dl, dl
je 0x4051ac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4051b0
add eax, 2
add ecx, 2
test dl, dl
jne 0x405190
xor eax, eax
jmp 0x4051b5
sbb eax, eax
or eax, 1
test eax, eax
je 0x4051c7
mov edx, dword [ebp - 4]
mov ecx, esi
call fcn.004050f0
mov esi, eax
jmp 0x4051ca
or esi, 0xffffffff
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
pop ebx
test esi, esi
jne 0x4051e3
mov edx, dword [ebp - 4]
mov ecx, edi
call fcn.004050f0
mov eax, esi
pop esi
pop edi
mov esp, ebp
pop ebp
ret
pop esi
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret