joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405360
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x104
push 0x104
call fcn.004028b0
push eax
lea eax, [esp + 8]
push eax
call fcn.0040a830
mov al, byte [esp]
test al, al
jne 0x405397
push 0x104
push 0x42afc0
lea ecx, [esp + 8]
push ecx
call fcn.0040a830
push 0x104
push str.d2exp.mpq
lea edx, [esp + 8]
push edx
call fcn.00425850
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
mov eax, 0x4263e0
jne 0x4053c5
mov eax, 0x4263d0
mov ecx, dword [esp + 0x10c]
mov edx, dword [esp + 0x108]
push ecx
push edx
push 2
push eax
push str.Diablo_II
call fcn.004053f0
add esp, 0x118
ret

Function at 0x4054b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x104
push 0x104
call fcn.004028b0
push eax
lea eax, [esp + 8]
push eax
call fcn.0040a830
mov al, byte [esp]
test al, al
jne 0x4054e7
push 0x104
push 0x42afc0
lea ecx, [esp + 8]
push ecx
call fcn.0040a830
push 0x104
push str.icons_WAR3.bni
lea edx, [esp + 8]
push edx
call fcn.00425850
lea eax, [esp]
push eax
call fcn.00401bc0
add esp, 4
push 0x104
call fcn.004028b0
push eax
lea ecx, [esp + 8]
push ecx
call fcn.0040a830
mov al, byte [esp]
test al, al
push 0x104
push str.war3x.mpq
jne 0x40553b
lea edx, [esp + 8]
push edx
call fcn.0040a830
jmp 0x405545
lea eax, [esp + 8]
push eax
call fcn.00425850
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov ecx, 0x4263f8
mov eax, edx
test eax, eax
jne 0x405568
mov ecx, 0x4263f0
mov edx, dword [esp + 0x10c]
push edx
mov edx, dword [esp + 0x10c]
push edx
xor edx, edx
test eax, eax
setne dl
lea edx, [edx + edx + 1]
push edx
push ecx
push str.Warcraft_III
call fcn.004053f0
add esp, 0x118
ret

Function at 0x405ab0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push 1
push 0x430fbc
push 0x430fbc
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret

Function at 0x406340
Capabilities:
Get file size

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov dl, 0x2c
mov ecx, edi
call fcn.0040a750
mov esi, eax
test esi, esi
je 0x406358
mov byte [esi], 0
lea eax, [esp + 0xc]
push eax
push edi
call fcn.004028f0
add esp, 8
test esi, esi
je 0x40636d
mov byte [esi], 0x2c
test eax, eax
jne 0x406374
pop edi
pop esi
ret
mov ecx, dword [esp + 0xc]
push 0
push ecx
mov edi, 1
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4063a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4063a9
mov eax, dword [esp + 0xc]
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
push eax
mov dword [edx], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret
Function at 0x407490
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
mov edx, dword [esp + 8]
jne 0x4019da
test edx, edx
je 0x4019da
push 0x57
call fcn.0040c3e0
xor eax, eax
ret
or eax, 0xffffffff
test edx, edx
je 0x401a02
push esi
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
mov esi, dword [esi*4 + 0x42a480]
shr eax, 8
xor eax, esi
inc ecx
dec edx
jne 0x4019e3
pop edi
pop esi
not eax
ret
jmp 0x4019c0

Function at 0x407f20
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3ea
push ebx
call edi
push 0x3eb
push ebx
mov esi, eax
call edi
test esi, esi
mov edi, eax
je 0x40800c
test edi, edi
je 0x40800c
push ebp
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x28]
test eax, eax
mov ebp, dword [sym.imp.USER32.dll_EnableWindow]
push 0
je 0x407f98
push esi
call ebp
push 0
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
call esi
push 1
push edi
call ebp
push 5
push edi
call esi
mov ecx, dword [esp + 0x14]
mov edx, dword [0x4310e4]
lea eax, [edx + ecx]
jmp 0x407fbb
push edi
call ebp
push 0
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
call edi
push 1
push esi
call ebp
push 5
push esi
call edi
mov ecx, dword [esp + 0x14]
mov eax, dword [0x4310e0]
add eax, ecx
mov edx, dword [esp + 0x18]
push 1
mov dword [esp + 0x20], eax
sub eax, ecx
push eax
mov eax, dword [esp + 0x18]
sub edx, eax
push edx
push ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
mov eax, dword [esp + 0x28]
test eax, eax
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
pop ebp
je 0x407ff3
push 0x3e9
push ebx
call esi
test eax, eax
jne 0x408005
push 1
push ebx
call esi
test eax, eax
jne 0x408005
push 2
push ebx
call esi
test eax, eax
je 0x40800c
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x408360
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
push edi
push ebx
push eax
push esi
call fcn.004051d0
add esp, 0xc
test eax, eax
je 0x40842c
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push ebx
call fcn.0040ffd0
test eax, eax
je 0x4083ca
push 0
push 0
push 2
mov ecx, 0x4310ec
call fcn.00408a20
mov edx, dword [esp + 0x18]
push 0xf0
push str.C:projectsBattle.netPatcher_bnupdate_srcfile.cpp
mov edi, eax
push ebx
mov dword [edi + 8], edx
call fcn.0040a980
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 0
jmp 0x4083d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x40840f
test esi, esi
je 0x408406
lea esp, [esp]
mov dl, 0x3b
mov ecx, esi
mov edi, esi
call fcn.0040a750
mov esi, eax
test esi, esi
je 0x4083f5
mov byte [esi], 0
inc esi
push edi
call fcn.00408440
add esp, 4
test eax, eax
je 0x40842c
test esi, esi
jne 0x4083e0
pop edi
pop esi
mov eax, 1
pop ebx
ret
push 0
push 0
push ebx
push 0x81
call fcn.00402620
push ebx
push str.ERROR:_unable_to_open_archive__s_n_n
call fcn.004250f0
add esp, 0x18
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x408500
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x214
push ebx
mov ebx, dword [esp + 0x220]
push esi
push edi
mov edi, dword [esp + 0x224]
push ebx
xor esi, esi
push esi
push esi
push edi
mov dword [eax], 1
call fcn.0040ffd0
test eax, eax
je 0x40853f
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x214
ret
push ebp
lea ecx, [esp + 0x1c]
push ecx
push 0x104
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
cmp eax, esi
je 0x40866b
cmp eax, 0x104
ja 0x40866b
lea edx, [esp + 0x10]
push edx
push edi
call fcn.00401fe0
add esp, 8
test eax, eax
je 0x40866b
mov al, byte [esp + 0x1c]
test al, al
lea esi, [esp + 0x1c]
je 0x40866b
mov eax, dword [esp + 0x10]
push 0x7fffffff
push eax
push esi
call fcn.0040a7f0
test eax, eax
push esi
je 0x4085b9
call fcn.0040a9d0
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x408591
jmp 0x40866b
mov ebp, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
call ebp
sub eax, 5
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x18], eax
je 0x40866b
mov dl, 0x5c
mov ecx, edi
call fcn.0040a780
test eax, eax
je 0x4085e3
lea edi, [eax + 1]
mov al, byte [esp + 0x1c]
test al, al
lea esi, [esp + 0x1c]
je 0x408643
nop
push esi
call ebp
cmp eax, 5
jne 0x408634
push 0x104
push esi
lea ecx, [esp + 0x128]
push ecx
call fcn.0040a830
push 0x104
push edi
lea edx, [esp + 0x128]
push edx
call fcn.00425850
push ebx
push 0
push 0
lea eax, [esp + 0x12c]
push eax
call fcn.0040ffd0
test eax, eax
jne 0x40868b
push esi
call fcn.0040a9d0
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x4085f0
push 0
push 0
push edi
push 0x83
call fcn.00402620
add esp, 0x10
test eax, eax
jne 0x4085e3
call fcn.00405ef0
mov ecx, dword [esp + 0x230]
mov dword [ecx], 0
mov eax, dword [esp + 0x10]
test eax, eax
pop ebp
je 0x40867d
push eax
call fcn.00402050
add esp, 4
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
add esp, 0x214
ret
mov dword [esp + 0x14], 1
jmp 0x40866b
Function at 0x408890
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40889e
mov dword [eax], 0
mov eax, dword [esp + 4]
test eax, eax
je 0x408946
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x408946
push ebx
push ebp
push esi
push edi
push 0x161
push str.C:projectsBattle.netPatcher_bnupdate_srcfile.cpp
push eax
mov dword [ecx], 0
call fcn.0040a980
push 0
push 0x8000000
push 3
push 0
push 1
mov ebp, eax
push 0x80000000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x408966
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x408966
cmp esi, 0xffffffff
je 0x408966
push 0
push 0x17b
push str.C:projectsBattle.netPatcher_bnupdate_srcfile.cpp
push esi
call fcn.00408f70
push 0
mov edi, eax
lea eax, [esp + 0x18]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x408950
cmp esi, dword [esp + 0x14]
jne 0x408950
mov eax, dword [esp + 0x1c]
test eax, eax
mov ecx, dword [esp + 0x18]
mov dword [ecx], edi
je 0x408966
mov dword [eax], esi
jmp 0x408966
push 0x57
call fcn.0040c3e0
xor eax, eax
ret
test edi, edi
je 0x408966
push 0
push 0x187
push str.C:projectsBattle.netPatcher_bnupdate_srcfile.cpp
push edi
call fcn.0040a0f0
test ebp, ebp
je 0x40897c
push 0
push 0x188
push str.C:projectsBattle.netPatcher_bnupdate_srcfile.cpp
push ebp
call fcn.0040a0f0
cmp ebx, 0xffffffff
je 0x408988
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x18]
mov ecx, dword [edx]
pop edi
pop esi
xor eax, eax
test ecx, ecx
pop ebp
setne al
pop ebx
ret

Function at 0x408c80
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
push esi
push edi
call fcn.00408c50
add esp, 8
test eax, eax
jne 0x408c9b
pop edi
pop esi
ret
mov ecx, dword [esp + 0x10]
push 0
lea eax, [esp + 0x18]
push eax
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x408cb6
pop edi
pop esi
ret
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, esi
pop edi
sete al
pop esi
ret

Function at 0x4090d0
Capabilities:
Terminate process

Disassembly:
xor eax, eax
cmp ecx, 8
sete al
push 1
push 0
push 0
mov dword [0x433230], eax
mov eax, dword [esp + 0x10]
push eax
push edx
push ecx
call fcn.0040b5e0
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x409850
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 4]
mov eax, 1
cmp ecx, eax
mov dword [0x433234], eax
jbe 0x40987b
shl eax, 1
cmp eax, ecx
jb 0x409870
mov dword [0x433234], eax
add esp, 0x24
ret
Function at 0x409b30
Capabilities:
Print debug messages

Disassembly:
sub esp, 0xcc
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebx, dword [edi]
mov esi, dword [ebx + 0x1c]
mov eax, dword [ebx + 0x20]
xor ebp, ebp
cmp esi, eax
mov dword [esp + 0x10], edi
jae 0x409bc2
mov edi, edi
movzx edi, word [esi]
xor eax, eax
mov al, byte [esi + 3]
add edi, esi
test al, 0x82
je 0x409b67
and eax, 0x80
or ebp, eax
jmp 0x409bb3
test al, 0x40
jne 0x409baa
mov eax, dword [0x433ed8]
test eax, eax
lea edx, [ebx + 0x6c]
jne 0x409b87
mov eax, dword [ebx + 0x68]
push eax
mov ecx, 0x8510007e
call fcn.00409bf0
jmp 0x409baa
mov ecx, dword [ebx + 0x68]
push ecx
push edx
lea eax, [esp + 0x1c]
push str.Storm_Error_:_memory_never_released_____s___i_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, esi
mov ecx, ebx
call fcn.004098b0
cmp edi, dword [ebx + 0x20]
mov esi, edi
jb 0x409b50
test ebp, ebp
jne 0x409bd6
mov edi, dword [esp + 0x10]
mov ecx, edi
call fcn.00409300
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0xcc
ret

Function at 0x40ae40
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x40ae56
push 0x57
call fcn.0040c3e0
xor eax, eax
pop esi
ret 0xc
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x40ae63
mov eax, 0x7fed7fed
mov cl, byte [esp + 0xc]
push ebx
push ebp
test cl, 1
movzx ecx, byte [esi]
push edi
mov edx, 0xeeeeeeee
je 0x40aeb1
test ecx, ecx
je 0x40aefb
nop
add eax, edx
imul edx, edx, 0x21
mov edi, ecx
mov ebx, ecx
shr edi, 4
mov edi, dword [edi*4 + 0x4264b8]
and ebx, 0xf
mov ebp, dword [ebx*4 + 0x4264b8]
inc esi
add edx, ecx
movzx ecx, byte [esi]
sub edi, ebp
xor eax, edi
test ecx, ecx
lea edx, [edx + eax + 3]
jne 0x40ae80
jmp 0x40aefb
test ecx, ecx
je 0x40aefb
inc esi
cmp ecx, 0x61
jb 0x40aec3
cmp ecx, 0x7a
ja 0x40aec3
sub ecx, 0x20
cmp ecx, 0x2f
jne 0x40aecd
mov ecx, 0x5c
add eax, edx
imul edx, edx, 0x21
mov edi, ecx
mov ebx, ecx
shr edi, 4
mov edi, dword [edi*4 + 0x4264b8]
and ebx, 0xf
mov ebp, dword [ebx*4 + 0x4264b8]
add edx, ecx
movzx ecx, byte [esi]
sub edi, ebp
xor eax, edi
test ecx, ecx
lea edx, [edx + eax + 3]
jne 0x40aeb5
test eax, eax
pop edi
pop ebp
pop ebx
jne 0x40af07
mov eax, 1
pop esi
ret 0xc
Function at 0x40af10
Capabilities:
Encode data using xor

Disassembly:
push ecx
cmp edx, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, 0x9e3779b9
mov dword [esp + 0x10], edx
mov ebp, edx
mov ebx, edi
jb 0x40b020
mov eax, 0xaaaaaaab
mul edx
shr edx, 3
mov dword [esp + 0x18], edx
lea ecx, [ecx]
movzx eax, byte [ecx + 7]
movzx edx, byte [ecx + 6]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 5]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 4]
add edx, edi
shl eax, 8
lea edi, [edx + eax]
movzx eax, byte [ecx + 0xb]
movzx edx, byte [ecx + 0xa]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 9]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 8]
add edx, esi
shl eax, 8
lea esi, [edx + eax]
movzx eax, byte [ecx + 3]
movzx edx, byte [ecx + 2]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 1]
shl eax, 8
add eax, edx
movzx edx, byte [ecx]
shl eax, 8
add eax, edx
sub eax, esi
sub eax, edi
sub edi, esi
mov edx, esi
shr edx, 0xd
add eax, ebx
xor eax, edx
sub edi, eax
mov edx, eax
shl edx, 8
xor edi, edx
sub esi, edi
sub esi, eax
mov edx, edi
shr edx, 0xd
xor esi, edx
sub eax, esi
sub eax, edi
mov edx, esi
shr edx, 0xc
xor eax, edx
sub edi, esi
sub edi, eax
mov edx, eax
shl edx, 0x10
xor edi, edx
sub esi, edi
sub esi, eax
mov edx, edi
shr edx, 5
xor esi, edx
sub eax, esi
sub eax, edi
mov edx, esi
shr edx, 3
xor eax, edx
sub edi, esi
mov ebx, eax
shl eax, 0xa
sub edi, ebx
xor edi, eax
mov eax, dword [esp + 0x18]
sub esi, edi
mov edx, edi
sub esi, ebx
shr edx, 0xf
xor esi, edx
add ecx, 0xc
sub ebp, 0xc
dec eax
mov dword [esp + 0x18], eax
jne 0x40af40
mov edx, dword [esp + 0x10]
add esi, edx
dec ebp
cmp ebp, 0xa
ja case.default.0x40b028
jmp dword [ebp*4 + 0x40b0f8]
movzx eax, byte [ecx + 0xa]
shl eax, 0x18
add esi, eax
movzx edx, byte [ecx + 9]
shl edx, 0x10
add esi, edx
movzx eax, byte [ecx + 8]
shl eax, 8
add esi, eax
movzx edx, byte [ecx + 7]
shl edx, 0x18
add edi, edx
movzx eax, byte [ecx + 6]
shl eax, 0x10
add edi, eax
movzx edx, byte [ecx + 5]
shl edx, 8
add edi, edx
movzx eax, byte [ecx + 4]
add edi, eax
movzx edx, byte [ecx + 3]
shl edx, 0x18
add ebx, edx
movzx eax, byte [ecx + 2]
shl eax, 0x10
add ebx, eax
movzx edx, byte [ecx + 1]
shl edx, 8
add ebx, edx
movzx eax, byte [ecx]
add ebx, eax
sub ebx, esi
sub ebx, edi
sub edi, esi
mov ecx, esi
shr ecx, 0xd
xor ebx, ecx
sub edi, ebx
mov edx, ebx
shl edx, 8
xor edi, edx
sub esi, edi
sub esi, ebx
mov eax, edi
shr eax, 0xd
xor esi, eax
sub ebx, esi
sub ebx, edi
sub edi, esi
mov ecx, esi
shr ecx, 0xc
xor ebx, ecx
sub edi, ebx
mov edx, ebx
shl edx, 0x10
xor edi, edx
sub esi, edi
mov eax, edi
sub esi, ebx
shr eax, 5
xor esi, eax
mov eax, esi
sub ebx, eax
sub ebx, edi
mov ecx, eax
sub edi, eax
shr ecx, 3
xor ebx, ecx
sub edi, ebx
mov edx, ebx
shl edx, 0xa
xor edi, edx
sub eax, edi
sub eax, ebx
shr edi, 0xf
xor eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x40bf00
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, ecx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x40bf17
mov eax, 1
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40bf2d
cmp eax, 5
je 0x40bf2d
xor eax, eax
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40bf3d
xor eax, eax
pop esi
ret
movzx eax, al
shr eax, 4
and eax, 1
pop esi
ret

Function at 0x40c0c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov dword [ebp - 0xc], ecx
xor eax, eax
push esi
push edi
mov ebx, edx
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
lea eax, [edi + edi + 4]
add eax, 3
and eax, 0xfffffffc
mov dword [ebp - 8], ebx
call fcn.00425a20
mov ecx, esp
xor esi, esi
test edi, edi
mov byte [ecx], 0xd
mov byte [ecx + 1], 0xa
mov eax, 2
mov byte [ebp - 1], 0
jbe 0x40c134
jmp 0x40c110
mov ebx, dword [ebp - 8]
nop
lea esp, [esp]
mov dl, byte [esi + ebx]
cmp dl, 0xa
jne 0x40c123
cmp byte [ebp - 1], 0xd
je 0x40c123
mov byte [eax + ecx], 0xd
inc eax
mov byte [eax + ecx], dl
inc eax
inc esi
cmp esi, edi
mov byte [ebp - 1], dl
jb 0x40c108
cmp dl, 0xa
je 0x40c13e
mov byte [eax + ecx], 0xd
inc eax
mov byte [eax + ecx], 0xa
inc eax
push 0
lea edx, [ebp - 0x10]
push edx
push eax
mov byte [eax + ecx], 0
mov eax, dword [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c2f0
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x433be0]
sub esp, 0x1c8
test eax, eax
jne 0x40c31f
push 0x433be4
push 0
push str.Debug_Memory
push str.Internal
mov dword [0x433be0], 1
call fcn.004119a0
mov eax, dword [0x433be4]
test eax, eax
je 0x40c3d3
mov eax, dword [esp + 0x1d0]
test eax, eax
je 0x40c35e
cmp byte [eax], 0
je 0x40c35e
push eax
mov eax, dword [esp + 0x1d0]
push eax
push str._s___s_
lea ecx, [esp + 0xc]
push pe_nt_image_headers32
push ecx
call fcn.0040ac20
add esp, 0x14
jmp 0x40c37d
mov edx, dword [esp + 0x1cc]
push edx
push 0x42bbe8
lea eax, [esp + 8]
push pe_nt_image_headers32
push eax
call fcn.0040ac20
add esp, 0x10
mov eax, dword [0x433edc]
test eax, eax
jne 0x40c3a6
push 1
push 1
push 0
push 0xfffffffffffffffd
lea ecx, [esp + 0x10]
push ecx
push 0x8510007f
call fcn.0040b5e0
add esp, 0x1c8
ret 8
lea edx, [esp]
push edx
push str.Storm_Error_:_handle_never_released_____s_n
lea eax, [esp + 0x108]
push 0xc8
push eax
call fcn.0040ac20
add esp, 0x10
lea ecx, [esp + 0x100]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x1c8
ret 8

Function at 0x40ce10
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x433c18]
test eax, eax
jne 0x40ce52
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x433bec
push 0
push 0
push 0x40ce60
push 0
push 0
mov dword [0x433c24], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 1
push eax
mov dword [0x433c18], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
ret
Function at 0x40dc30
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
shr edx, 2
test edx, edx
mov eax, 0xeeeeeeee
je 0x40dc8b
push ebx
push ebp
push esi
push edi
mov edi, edx
mov edx, dword [esp + 0x14]
mov ebx, dword [0x433c64]
mov esi, edx
and esi, 0xff
mov ebp, dword [ebx + esi*4 + 0x1000]
mov ebx, dword [ecx]
add eax, ebp
lea esi, [eax + edx]
imul eax, eax, 0x21
xor ebx, esi
mov esi, ebx
lea eax, [eax + esi + 3]
mov esi, edx
not esi
shl esi, 0x15
add esi, 0x11111111
shr edx, 0xb
mov dword [ecx], ebx
add ecx, 4
or edx, esi
dec edi
jne 0x40dc46
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x40dd20
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], 0
nop
lea esp, [esp]
mov edi, dword [esp + 0x14]
cmp edi, 0xffffffff
je 0x40dd59
mov eax, dword [esp + 0x20]
push 0
push 0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push 0
push ebp
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp]
mov edx, dword [esp + 0x18]
add ecx, edi
test eax, eax
mov dword [edx], ecx
jne 0x40ddf9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x433c98
mov edi, eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x42bbf8]
mov ebx, dword [0x42bbfc]
push 0x433c98
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
sub eax, 0
je 0x40de14
dec eax
je 0x40ddcf
dec eax
jne 0x40dd40
mov eax, dword [esp + 0x30]
push 1
push 0
push 0
push 0xfffffffffffffffc
push eax
push edi
call fcn.0040b5e0
jmp 0x40dd40
test ebx, ebx
je 0x40de14
mov ecx, dword [esp + 0x10]
mov eax, ecx
inc ecx
push eax
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x34]
push edi
push ecx
call ebx
test eax, eax
jne 0x40dd40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x14
cmp dword [ebp], esi
jne 0x40de0d
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret 0x14
push 0x26
call fcn.0040c3e0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 0x14
Function at 0x40ef40
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x40ef71
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x40ef71
mov dword [esp + 0x10], 0x4265e8
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x18], 0x4266e8
mov dword [esp + 0x1c], 4
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x40ef81
lea eax, [esp]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
mov dword [ecx], 0
mov ecx, dword [esp + 8]
push esi
call fcn.0040cac0
mov esi, eax
test esi, esi
je 0x40f0e6
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [esp + 0x20]
push ebx
push ebp
push edi
push edx
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0
call fcn.00416220
push 0
push 0xd84
push str.C:projectsStormSourceSFile.cpp
push 0x10000
call fcn.00408f70
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
mov ebp, eax
mov eax, dword [esi + 0x128]
push 0
push eax
call ebx
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x24], edi
je 0x40f08f
mov ecx, dword [esi + 0x274]
mov edx, dword [esi + 0x128]
push 0
push 0
push ecx
push edx
call ebx
cmp eax, 0xffffffff
je 0x40f08f
mov ecx, dword [esp + 0x18]
call fcn.00416280
mov ebx, eax
add ebx, dword [esi + 0x13c]
je 0x40f07d
mov edi, edi
cmp ebx, 0x10000
mov edi, 0x10000
ja 0x40f03f
mov edi, ebx
push 0
lea eax, [esp + 0x30]
push eax
push edi
mov dword [esp + 0x38], 0
mov ecx, dword [esi + 0x128]
push ebp
push ecx
sub ebx, edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40f08f
cmp dword [esp + 0x2c], edi
jne 0x40f08f
mov ecx, dword [esp + 0x18]
push edi
mov edx, ebp
call fcn.00416290
test ebx, ebx
jne 0x40f030
mov edi, dword [esp + 0x24]
mov edx, dword [esi + 0x128]
push 0
push 0
push edi
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0xdaa
push str.C:projectsStormSourceSFile.cpp
push ebp
call fcn.0040a0f0
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
push eax
call fcn.00416350
mov ecx, dword [esp + 0x1c]
neg eax
sbb eax, eax
and eax, 4
inc eax
xor edx, edx
cmp eax, 5
sete dl
mov dword [ecx], eax
lea eax, [esi + 8]
push eax
mov edi, edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, esi
call fcn.0040cb30
mov eax, edi
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret 0x18
xor ecx, ecx
call fcn.0040cb30
xor eax, eax
pop esi
pop ecx
ret 0x18

Function at 0x40fc40
Capabilities:
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
not eax
shr eax, 4
and eax, 1
ret