joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b197
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, ecx
test si, si
jne 0x1000b24c
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x1000b24c
mov edx, dword [esi + 0x3c]
test dl, 3
jne 0x1000b24c
cmp dword [edx + esi], 0x4550
jne 0x1000b24c
cmp dword [edx + esi + 0x74], 6
jb 0x1000b24c
push ebx
mov ebx, dword [edx + esi + 0x50]
push edi
mov edi, dword [edx + esi + 0xa8]
lea eax, [ebx - 1]
lea ecx, [edi - 1]
cmp ecx, eax
jae 0x1000b24a
mov eax, dword [edx + esi + 0xac]
mov ecx, ebx
sub ecx, edi
cmp eax, ecx
ja 0x1000b24a
xor edx, edx
add edi, esi
push 0x1c
pop ecx
div ecx
mov edx, eax
test edx, edx
je 0x1000b24a
imul ecx, edx, 0x1c
add ecx, 0x14
add ecx, edi
lea ecx, [ecx - 0x1c]
dec edx
cmp dword [ecx - 8], 2
lea edi, [ecx - 0x14]
jne 0x1000b228
cmp dword [ecx], ebx
jae 0x1000b228
mov eax, ebx
sub eax, dword [ecx]
cmp dword [ecx - 4], eax
jbe 0x1000b22e
test edx, edx
jne 0x1000b20e
jmp 0x1000b24a
push 0x1c
push edi
call dword [sym.imp.kernel32.dll_VirtualLock]
test eax, eax
je 0x1000b24a
mov eax, dword [edi + 0x14]
push dword [edi + 0x10]
add eax, esi
push eax
call dword [sym.imp.kernel32.dll_VirtualLock]
pop edi
pop ebx
pop esi
ret

Function at 0x1000c446
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1000c455
pop dword [ebp - 0x3c]
mov eax, 0x20fb00f3
sub eax, 0x10fa3c9e
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x387b9
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0xa7bb8d1b
add ecx, 0x5844b8ec
mov esi, eax
mov edx, 0x10018600
add edx, dword [ebp - 0x3c]
mov edi, 0x4ed194c8
sub edi, 0xeac9c3ea
xor dword [ebp - 0x2c], 0x44bb0001
mov ebx, dword [edx]
sub dword [ebp - 0x2c], ecx
sub ebx, edi
sub dword [ebp - 0x20], ebx
mov dword [esi], ebx
sub dword [ebp - 0x14], ebx
add esi, 4
add edx, 4
loop 0x1000c4a9
add eax, 0xe12b1a7e
sub eax, 0xe12a0f8f
mov ebx, eax
add eax, 0x9e9e7154
sub eax, 0x9e9e714f
mov ecx, 0x47480646
sub ecx, 0x37480646
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x4010cd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0xc]
push 0
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4010f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 2
pop eax
pop ebp
ret
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 3
pop ebp
ret
Function at 0x401ee6
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
push edi
mov edi, dword [ebp + 0xc]
or esi, 0xffffffff
test edi, edi
je 0x401f01
mov dword [edi], 1
mov eax, dword [ebp + 8]
test eax, eax
je 0x402054
cmp byte [eax], 0
je 0x402054
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.00407cd0
cmp byte [ebp - 0x11f], 0x3a
pop ecx
pop ecx
jne 0x401f3d
cmp byte [ebp - 0x11e], 0x5c
jne 0x401f3d
and byte [ebp - 0x11d], 0
push ebx
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x401fdb
push str.GetDiskFreeSpaceExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x401fc6
cmp byte [ebp - 0x120], 0x5c
jne 0x401f85
cmp byte [ebp - 0x11f], 0x5c
jne 0x401f85
lea eax, [ebp - 0x120]
push eax
call fcn.00401e24
jmp 0x401f91
lea eax, [ebp - 0x120]
push eax
call fcn.00401e4b
pop ecx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x120]
push eax
call edi
test eax, eax
je 0x401fc6
mov esi, dword [ebp - 4]
cmp esi, 0x400
jb 0x401fbb
push 0xfffffffffffffffe
pop esi
jmp 0x401fc6
mov eax, dword [ebp - 8]
shl esi, 0x16
shr eax, 0xa
add esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp esi, 0xffffffff
je 0x401fd8
cmp dword [ebp + 0xc], 0
je 0x402053
mov edi, dword [ebp + 0xc]
and dword [ebp + 0xc], 0
cmp byte [ebp - 0x120], 0x5c
jne 0x401ff1
cmp byte [ebp - 0x11f], 0x5c
je 0x402008
cmp byte [ebp - 0x11f], 0x3a
jne 0x402008
and byte [ebp - 0x11d], 0
mov byte [ebp - 0x11e], 0x5c
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x402053
mov eax, dword [ebp - 0xc]
cmp esi, 0xffffffff
jne 0x402041
mov esi, eax
imul esi, dword [ebp + 8]
shr esi, 8
imul esi, dword [ebp + 0xc]
shr esi, 2
test edi, edi
je 0x402053
imul eax, dword [ebp + 8]
add eax, 0x3ff
shr eax, 0xa
mov dword [edi], eax
pop ebx
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x404787
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [0x41193c]
push dword [0x411934]
call fcn.00407cd0
mov esi, dword [ebp + 8]
pop ecx
pop ecx
movzx eax, byte [esi + 4]
dec eax
je 0x4048b7
dec eax
jne 0x4048c8
push 1
push 0x30c
call fcn.00408023
mov edi, eax
pop ecx
test edi, edi
pop ecx
lea ebx, [edi + 0x208]
je 0x4048c8
push 0
push esi
call fcn.004040d6
push dword [0x411934]
mov esi, eax
call fcn.00401e4b
push 0x5c
push esi
call fcn.00407dc0
add esp, 0x14
test eax, eax
je 0x4047ff
inc eax
mov dword [ebp + 8], eax
jmp 0x404802
mov dword [ebp + 8], esi
mov esi, 0x104
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 8]
push edi
push eax
lea eax, [edi + 0x104]
mov dword [ebp - 8], esi
push eax
push dword [0x411934]
push ebx
push dword [ebp + 8]
push 1
call sub.VERSION.dll_VerFindFileA
mov ebx, eax
shr ebx, 1
and ebx, 1
cmp byte [edi], 0
je 0x404862
push edi
call fcn.00401e24
push dword [ebp + 8]
push edi
call fcn.00407ce0
push edi
push dword [0x411934]
call fcn.00407cd0
add esp, 0x14
jmp 0x40488b
push esi
push dword [0x411934]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push dword [0x411934]
call fcn.00401e24
push dword [ebp + 8]
push dword [0x411934]
call fcn.00407ce0
add esp, 0xc
test ebx, ebx
jne 0x4048ac
push 2
push dword [0x411934]
call fcn.00408964
pop ecx
test eax, eax
pop ecx
je 0x4048ac
cmp dword [0x411a44], 0xd
jne 0x4048ac
inc ebx
push edi
call fcn.004080d4
pop ecx
mov eax, ebx
jmp 0x4048ec
push 0x104
push dword [0x411934]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push dword [0x411934]
call fcn.00401e24
push 0
push esi
call fcn.004040d6
push eax
push dword [0x411934]
call fcn.00407ce0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406786
Capabilities:
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
push ebx
xor ebx, ebx
cmp dword [0x411a14], ebx
push esi
push edi
je 0x4067b9
cmp dword [ebp + 8], ebx
jne 0x4067b2
push 4
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
jmp 0x40692f
push 5
push dword [ebp + 8]
jmp 0x4067a4
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
push dword [ebp + 0xc]
call edi
cmp dword [ebp + 8], ebx
je 0x4067e3
lea eax, [ebp - 0x310]
push esi
push eax
push dword [ebp + 8]
call edi
lea eax, [ebp - 0x108]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x108]
push str.WININIT.INI
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [ebp + 8], ebx
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
je 0x40683b
lea eax, [ebp - 0x310]
push eax
push str.Rename
call esi
lea eax, [ebp - 0x108]
push eax
push ebx
push ebx
push ebx
call esi
jmp 0x40692f
push 0x40f238
push str.Rename
call esi
lea eax, [ebp - 0x108]
push eax
push ebx
push ebx
push ebx
call esi
lea eax, [ebp - 0x108]
push 2
push eax
call section..text
mov esi, eax
pop ecx
cmp esi, 0xffffffff
pop ecx
mov dword [ebp - 4], esi
je 0x40692f
push esi
call fcn.0040113a
mov edi, eax
lea eax, [ebp + 8]
push eax
lea eax, [edi + 0x200]
push eax
call fcn.00401e6f
add esp, 0xc
test eax, eax
je 0x406926
push edi
push dword [ebp + 8]
push esi
call fcn.00401077
add esp, 0xc
test eax, eax
jne 0x40691c
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], ebx
lea ebx, [edi - 4]
test ebx, ebx
jbe 0x40691c
cmp byte [esi], 0x78
jne 0x4068ed
cmp byte [esi + 1], 0x79
jne 0x4068ed
cmp byte [esi + 2], 0x7a
jne 0x4068ed
cmp byte [esi + 3], 0x3d
jne 0x4068ed
lea eax, [ebp - 0x20c]
push eax
call fcn.00407c50
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [esi + 4]
push eax
call fcn.00408a40
add esp, 0x10
test eax, eax
je 0x4068f8
inc dword [ebp + 0xc]
inc esi
cmp dword [ebp + 0xc], ebx
jb 0x4068b2
jmp 0x40691c
push 0
mov byte [esi], 0x4e
push dword [ebp - 4]
mov byte [esi + 1], 0x55
mov byte [esi + 2], 0x4c
call fcn.00401114
push edi
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.004010cd
add esp, 0x14
lea eax, [ebp + 8]
push eax
call fcn.00401ecf
pop ecx
push dword [ebp - 4]
call fcn.00401225
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408964
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x408984
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040ad4b
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4089a5
test byte [esp + 8], 2
je 0x4089a5
mov dword [0x411a44], 0xd
mov dword [0x411a48], 5
jmp 0x408980
xor eax, eax
ret

Function at 0x4089d2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4089fd
test byte [esp + 8], 0x80
je 0x4089ec
and al, 0xfe
jmp 0x4089ee
or al, 1
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x408a0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040ad4b
pop ecx
or eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x40c109
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x411870
cmp edx, dword [eax]
je 0x40c12b
add eax, 8
inc ecx
cmp eax, 0x411900
jl 0x40c11c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x411870]
jne 0x40c259
mov eax, dword [0x411a98]
cmp eax, 1
je 0x40c233
test eax, eax
jne 0x40c15c
cmp dword [0x40f324], 1
je 0x40c233
cmp edx, 0xfc
je 0x40c259
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40c193
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00407cd0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00407c50
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40c1d6
lea eax, [ebp - 0x1a4]
push eax
call fcn.00407c50
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40d6c8
push edi
call fcn.00408bc0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00407cd0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00407ce0
lea eax, [ebp - 0xa0]
push 0x40f220
push eax
call fcn.00407ce0
push dword [esi + 0x411874]
lea eax, [ebp - 0xa0]
push eax
call fcn.00407ce0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040c6ea
add esp, 0x2c
pop edi
jmp 0x40c259
lea eax, [ebp + 8]
lea esi, [esi + 0x411874]
push 0
push eax
push dword [esi]
call fcn.00407c50
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4e5008], 0x8088405
inc edx
mov dword [ebx + 0x4e5008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf44
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf75
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf5d
add dl, dl
jne 0x41cf80
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cfd1
xor eax, eax
add dl, dl
jne 0x41cf8d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d06e
add dl, dl
jne 0x41cf9c
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfb2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfbd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cfc7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf6c
mov eax, 1
add dl, dl
jne 0x41cfdf
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfea
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfd6
sub eax, ebx
mov ebx, 1
jne 0x41d01d
mov ecx, 1
add dl, dl
jne 0x41d003
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d00e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cffa
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf6c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d034
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d03f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d02b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf6c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d08f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf6c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f0a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x4c958e
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f0ef
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f10e
mov ecx, edx
add ecx, ebx
jmp 0x41f10e
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f10e
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f180
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f169
test esi, esi
jbe 0x41f180
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f15b
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f180
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f138
jmp 0x41f180
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f180
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9595
ret
Function at 0x4202d8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x4ca8f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x420313
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x42032c
lea eax, [ebp - 0x10]
mov edx, dword [0x4e754c]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x42033f
lea eax, [ebp - 0x10]
mov edx, dword [0x4e754c]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x42034b
adc edx, 0
mov edx, dword [edx*4 + 0x4e6378]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x4204c5
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4204b8
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4204b8
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420456
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420456
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420456
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420456
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x4204b8
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4204b8
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x4204dd
inc ebx
cmp ebx, 0x19
jne 0x420305
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca8fa
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x403060
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x434094]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], 0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00419370
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x4030af
cmp dword [ebp + 0xc], 0
jne 0x4030b9
jmp 0x40318a
cmp dword [ebp + 0x10], 0
je 0x40310e
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x218], edx
mov eax, dword [ebp - 0x218]
add eax, 2
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x218]
mov dx, word [ecx]
mov word [ebp - 0x21e], dx
add dword [ebp - 0x218], 2
cmp word [ebp - 0x21e], 0
jne 0x4030d7
mov eax, dword [ebp - 0x218]
sub eax, dword [ebp - 0x21c]
sar eax, 1
mov dword [ebp - 0x224], eax
jne 0x403112
jmp 0x40318a
lea ecx, [ebp - 0x210]
push ecx
push 0x104
call dword [0x42a128]
mov edx, dword [ebp + 0x10]
push edx
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.00417b2d
add esp, 0xc
push 0x431668
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.004175d4
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x40315e
jmp 0x40318a
mov eax, dword [ebp - 4]
push eax
push 1
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00417e4a
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call fcn.00417882
add esp, 4
mov dword [ebp - 0x214], 1
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00417358
mov esp, ebp
pop ebp
ret
Function at 0x406500
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x406535
cmp dword [ebp + 0xc], 0xa
jae 0x406546
mov dword [ebp - 0x10], 0xffffffff
jmp 0x40661d
mov eax, dword [ebp + 0xc]
shl eax, 2
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, 1
push ecx
call fcn.004173b6
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00406440
add esp, 0x14
test eax, eax
je 0x406616
push 0x430834
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x14]
push edx
call fcn.004175d4
add esp, 0xc
cmp dword [ebp - 0x14], 0
jne 0x4065ab
mov dword [ebp - 0x10], 0xfffffffe
jmp 0x40661d
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 1
mov edx, dword [ebp - 4]
push edx
call fcn.00417789
add esp, 0x10
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 8]
je 0x4065d7
mov dword [ebp - 0x10], 0xfffffffe
jmp 0x40661d
call dword [0x42a12c]
xor edx, edx
mov ecx, 0x1f4
div ecx
mov dword [ebp - 0x20], edx
call dword [0x42a12c]
xor edx, edx
mov ecx, 0x3e8
div ecx
add edx, dword [ebp - 4]
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x20]
push eax
push 1
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00417789
add esp, 0x10
jmp 0x40661d
mov dword [ebp - 0x10], 0xfffffffd
cmp dword [ebp - 0x14], 0
je 0x40662f
mov edx, dword [ebp - 0x14]
push edx
call fcn.00417882
add esp, 4
cmp dword [ebp - 4], 0
je 0x406641
mov eax, dword [ebp - 4]
push eax
call fcn.00417480
add esp, 4
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret