joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4619f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x493630
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004613d0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00461450
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00461450
lea ecx, [esi + 0xc]
call fcn.004843e2
lea ecx, [esi + 0x10]
call fcn.004843e2
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00463fd0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00463fd0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00463fd0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00484457
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00484457
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x462818
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x493858
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x462828
call fcn.00462d40
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x46290b
cmp byte [edi], 0
je 0x46290b
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x46284d
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.004611f0
test eax, eax
jne 0x46286d
push 0x4cc5b0
lea ecx, [esi + 0x38]
call fcn.00484594
jmp 0x46290b
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.00461240
test eax, eax
jne 0x46289c
mov ecx, esi
call fcn.00461340
push edi
add esi, 0x38
push 0x4cc58c
push esi
call fcn.00481e7a
add esp, 0xc
jmp 0x46290b
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.004635c0
test eax, eax
je 0x462904
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.004629e0
test eax, eax
jne 0x462920
push edi
lea eax, [esi + 0x38]
push 0x4cc568
push eax
call fcn.00481e7a
add esp, 0xc
mov ecx, esi
call fcn.00462d40
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x4629c8
mov ecx, dword [0x4ce560]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.00481e7a
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.004612f0
test eax, eax
jne 0x46298a
push 0x4cc54c
lea ecx, [esi + 0x38]
call fcn.00484594
jmp 0x46299a
push 0xfa
mov ecx, esi
call fcn.004635c0
test eax, eax
jne 0x4629b7
mov ecx, esi
call fcn.00462d40
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.00484457
jmp 0x46290b
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.00484457
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x468e50
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x468ef3
test eax, eax
jbe 0x468ef3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x468ef3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x468e9e
xor esi, esi
jmp 0x468ea4
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x468ecf
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0040ff60
add esi, eax
push esi
mov ebx, esi
call fcn.0040ff60
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x468eb0
pop ebp
test edi, edi
pop edi
jne 0x468ef3
test ebx, ebx
je 0x468ef3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00473a20
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x4692b5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4693cd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4693cd
mov eax, dword [esi + 0x3c]
push eax
call fcn.00485e5b
mov esi, eax
test esi, esi
je 0x4693cd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4693cd
mov ecx, esi
call fcn.00469170
cmp edi, eax
jge 0x4693cd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x469353
mov dword [esp + 0x34], 1
jmp 0x4693ae
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4693cd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.004666c0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x46c9c0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x4cc974]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x46c9d3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x46ca14
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x4cca1c]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x46ca46
mov bl, byte [esp + ecx + 0x4c]
jmp 0x46ca4a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x46ca3b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x46ca68
mov bl, byte [esp + ecx + 0x4c]
jmp 0x46ca6c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x46ca5d
xor ecx, ecx
mov eax, 0x4cc984
xor ebx, ebx
mov bl, byte [ecx + 0x4cca2c]
cmp byte [esp + ebx + 0x14], 0
je 0x46ca97
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x4cca44]
cmp byte [esp + ebx + 0x14], 0
je 0x46caae
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x46ca7e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x46ca07
lea edx, [esp + 0x84]
push edx
call fcn.0046caf0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x4867fe
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x486836
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004848b2
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0048488a
jmp 0x486842
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x487eec
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x487f2e
call fcn.0048db55
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x487f2e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x487f25
xor eax, eax
jmp 0x487f36
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00487f3c
pop edi
pop esi
pop ebx
ret 4

Function at 0x48e085
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x48e0b3
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x48e0d1
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0048dfeb
jmp 0x48e0d1
mov eax, dword [esi + 0x14]
test eax, eax
je 0x48e0d1
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0048dfeb
test edi, edi
mov eax, edi
jne 0x48e0bb
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401320
Capabilities:
Terminate process

Disassembly:
cmp eax, 0x30
je 0x4013b0
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, eax
lea eax, [eax - 0x68]
sub esp, 0x20
cmp eax, 0xf
ja case.0x40133b.105
jmp dword [eax*4 + 0x404070]
mov dword [esp + 4], str.winepath
mov dword [esp], str.Usage:__s__OPTION___PATH_..._n
call sym._printf
mov dword [esp], str.Convert_PATH_s__to_Unix_or_Windows_long_or_short_paths._n_n___u____unix____converts_a_Windows_path_to_a_Unix_path_n___w____windows_converts_a_Unix_path_to_a_long_Windows_path_n___l____long____converts_the_short_Windows_path_of_an_existing_file_or_n________________directory_to_the_long_format_n___s____short___converts_the_long_Windows_path_of_an_existing_file_or_n________________directory_to_the_short_format_n___0____________separate_output_with_0_character__instead_of_a_newline_n___h____help____output_this_help_message_and_exit_n_nIf_more_than_one_option_is_given_then_the_input_paths_are_output_in_nall_formats_specified__in_the_order_long__short__Unix__Windows._nIf_no_option_is_given_the_default_is_Unix_format._n
call sym._printf
mov dword [esp], 0
call dword [sym.imp.ucrtbase.dll_exit]
lea esi, [esi]
mov eax, 2
add esp, 0x20
pop ebx
pop esi
pop ebp
ret
add esp, 0x20
mov eax, 8
pop ebx
pop esi
pop ebp
ret
mov eax, 4
jmp 0x40137d
mov eax, 1
jmp 0x40137d
mov eax, 0x10
ret
mov dword [ebp - 0xc], edx
mov esi, dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], 2
call esi
mov dword [esp + 8], str.winepath
mov dword [esp + 4], str._s:_invalid_option
mov dword [esp], eax
call sym._fprintf
mov edx, dword [ebp - 0xc]
test edx, edx
je 0x40143b
mov eax, edx
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp], 2
mov ebx, eax
call esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x404049
mov dword [esp], eax
call sym._fprintf
mov dword [esp], 2
call esi
mov dword [esp + 8], str.winepath
mov dword [esp + 4], str.Try__s___help_for_help_n
mov dword [esp], eax
call sym._fprintf
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll_exit]
mov dword [esp], 2
call esi
mov dword [esp + 8], ebx
mov dword [esp + 4], str.__c_n
mov dword [esp], eax
call sym._fprintf
jmp 0x40140d
Function at 0x401d60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x401dbb
cmp byte [esi + ebx - 1], 0xa
je 0x401d8f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4060a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x402820
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
Function at 0x402370
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
mov ecx, dword [esi]
push 0
add eax, 0xffffffe8
push eax
push ecx
call fcn.00408570
add esp, 0xc
test eax, eax
je 0x402393
or eax, 0xffffffff
pop esi
ret
mov edx, dword [esi]
push edi
push edx
push 1
lea edi, [esi + 0x10]
push 0x18
push edi
call fcn.004084c9
add esp, 0x10
cmp eax, 1
jae 0x4023b2
pop edi
or eax, 0xffffffff
pop esi
ret
push 8
push 0x416298
push edi
call fcn.00408169
add esp, 0xc
neg eax
pop edi
sbb eax, eax
pop esi
ret

Function at 0x4023d0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi]
push 0
push 0
push eax
mov dword [esp + 0x14], 0
call fcn.00408570
mov ecx, dword [esi]
push ecx
push 2
lea edx, [esp + 0x18]
push 1
push edx
call fcn.004084c9
mov ax, word [esp + 0x20]
add esp, 0x1c
cmp al, 0x4d
jne 0x40245b
cmp ah, 0x5a
jne 0x40245b
mov eax, dword [esi]
push 0
push 0x3c
push eax
call fcn.00408570
mov ecx, dword [esi]
push ecx
push 1
lea edx, [esp + 0x1c]
push 4
push edx
call fcn.004084c9
mov eax, dword [esp + 0x24]
mov ecx, dword [esi]
push 0
add eax, 0x98
push eax
push ecx
call fcn.00408570
mov edx, dword [esi]
push edx
push 1
lea eax, [esp + 0x38]
push 4
push eax
call fcn.004084c9
mov eax, dword [esp + 0x40]
add esp, 0x38
test eax, eax
jne 0x40245e
or eax, 0xffffffff
pop esi
add esp, 8
ret

Function at 0x402470
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
lea eax, [esi + 0x28]
push 0x4162f4
push eax
call fcn.00408a45
add esp, 8
mov dword [esi], eax
test eax, eax
jne 0x402491
or eax, 0xffffffff
pop esi
ret
push edi
push 2
push 0
push eax
call fcn.00408570
mov ecx, dword [esi]
push ecx
call fcn.00408913
mov edi, eax
push edi
push esi
call fcn.00402370
add esp, 0x18
test eax, eax
jge 0x4024ef
push esi
call fcn.004023d0
mov edi, eax
add esp, 4
cmp edi, 1
jl 0x4025a1
push ebx
xor ebx, ebx
jmp 0x4024d0
push edi
push esi
call fcn.00402370
add esp, 8
test eax, eax
jge 0x4024e5
inc ebx
dec edi
cmp ebx, 8
jl 0x4024d0
cmp ebx, 8
pop ebx
je 0x4025a1
mov edx, dword [esi + 0x18]
push edx
call fcn.00406b78
sub edi, eax
mov eax, dword [esi + 0x1c]
push 0
push eax
mov dword [esi + 4], edi
call fcn.00406b78
add eax, dword [esi + 4]
mov ecx, dword [esi]
push eax
push ecx
call fcn.00408570
mov edx, dword [esi + 0x20]
add esp, 0xc
push edx
call fcn.00406b78
push eax
call fcn.004086ac
add esp, 4
mov dword [esi + 8], eax
test eax, eax
jne 0x402543
push 0x4162d0
call fcn.004020f0
add esp, 4
pop edi
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esi]
mov ecx, dword [esi + 0x20]
push eax
push 1
push ecx
call fcn.00406b78
mov edx, dword [esi + 8]
push eax
push edx
call fcn.004084c9
add esp, 0x10
cmp eax, 1
jae 0x402576
push 0x4162b4
call fcn.004020f0
add esp, 4
pop edi
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esi + 0x20]
push eax
call fcn.00406b78
add eax, dword [esi + 8]
mov ecx, dword [esi]
push ecx
mov dword [esi + 0xc], eax
call fcn.00408629
add esp, 4
test eax, eax
je 0x4025a7
push 0x4162a4
call fcn.004020f0
add esp, 4
pop edi
or eax, 0xffffffff
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x4031f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
mov eax, dword [ebp + 4]
push esi
push edi
push 0
push eax
call fcn.00406b78
mov edi, dword [esp + 0x14]
add eax, dword [edi + 4]
mov ecx, dword [edi]
push eax
push ecx
call fcn.00408570
mov edx, dword [ebp + 8]
add esp, 0xc
push edx
call fcn.00406b78
push eax
call fcn.004086ac
mov esi, eax
add esp, 4
test esi, esi
jne 0x403240
push 0x416dfc
call fcn.00402160
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
ret
mov eax, dword [edi]
mov ecx, dword [ebp + 8]
push eax
push 1
push ecx
call fcn.00406b78
push eax
push esi
call fcn.004084c9
add esp, 0x10
cmp eax, 1
jae 0x403270
push 0x416de0
call fcn.00402160
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
ret
cmp byte [ebp + 0x10], 2
jne 0x403360
mov eax, dword [0x41d2d8]
test eax, eax
jne 0x403296
push 0x416ddc
call dword [0x41d270]
add esp, 4
mov dword [0x41d2d8], eax
push ebx
push eax
call dword [0x41d298]
mov edi, eax
push 0x416dd8
push edi
call dword [0x41d29c]
push 0x416dcc
push edi
mov dword [esp + 0x28], eax
call dword [0x41d29c]
push eax
call dword [0x41d2d0]
mov ebx, eax
push ebx
call fcn.004086ac
push ebx
push 0
push eax
mov dword [esp + 0x40], eax
call fcn.00406bc0
mov edx, dword [esp + 0x40]
add esp, 0x28
push ebx
push edx
push 0x416dc0
push edi
call dword [0x41d29c]
add esp, 8
push eax
mov eax, dword [esp + 0x20]
push 0x20
push esi
push 0x416db8
push eax
call dword [0x41d294]
mov ecx, dword [ebp + 8]
add esp, 0x1c
push ecx
mov edi, eax
call fcn.00406b78
sub eax, 0x20
push eax
lea edx, [esi + 0x20]
push edx
push 0x416db4
push 0x416dac
push edi
call dword [0x41d2b0]
mov ebx, eax
mov eax, dword [ebp + 8]
add esp, 0x14
push eax
call fcn.00406b78
sub eax, 0x20
push eax
push ebx
call dword [0x41d290]
add esp, 4
push eax
push esi
call fcn.00408c50
push edi
call dword [0x41d25c]
push ebx
call dword [0x41d25c]
add esp, 0x14
pop ebx
mov al, byte [ebp + 0x10]
cmp al, 1
je 0x40336b
cmp al, 2
jne 0x40339a
push ebp
push esi
call fcn.00403100
push esi
mov edi, eax
call fcn.00407dc8
add esp, 0xc
mov esi, edi
test edi, edi
jne 0x40339a
add ebp, 0x12
push ebp
push 0x416d94
call fcn.00402160
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x403570
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
push ebx
push edi
call fcn.004031f0
add esp, 8
mov dword [esp + 8], eax
call fcn.00403500
cmp eax, 0xffffffff
jne 0x403599
pop edi
or eax, eax
pop ebx
pop ecx
ret
push ebp
push esi
lea ebp, [ebx + 0x12]
push ebp
add edi, 0x232
push edi
call fcn.004033a0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4035cb
push ebp
push 0x416e8c
call fcn.004020f0
add esp, 8
pop esi
pop ebp
pop edi
or eax, 0xffffffff
pop ebx
pop ecx
ret
mov eax, dword [ebx + 0xc]
push esi
push 1
push eax
call fcn.00406b78
mov edi, dword [esp + 0x18]
push eax
push edi
call fcn.004092cb
push esi
call fcn.004090ed
push edi
call fcn.00407dc8
add esp, 0x18
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x4036b0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x1004
call fcn.00409410
mov eax, dword [0x41c010]
xor eax, esp
mov dword [esp + 0x1000], eax
mov eax, dword [esp + 0x1008]
push ebx
push esi
push edi
push 0x4162f4
push eax
mov edi, ecx
mov ebx, edx
call fcn.00408a45
push ebx
push edi
mov esi, eax
call fcn.004033a0
add esp, 0x10
xor ebx, ebx
mov edi, eax
test esi, esi
je 0x40379d
test edi, edi
je 0x40379d
push esi
call fcn.004085f5
add esp, 4
test eax, eax
jne 0x403774
mov edi, edi
push esi
push 1
lea eax, [esp + 0x14]
push 0x1000
push eax
call fcn.004084c9
add esp, 0x10
cmp eax, 0xffffffff
jne 0x40373a
push esi
call fcn.00408629
add esp, 4
test eax, eax
je 0x403759
push esi
jmp 0x403769
push edi
push 1
lea ecx, [esp + 0x14]
push 0x1000
push ecx
call fcn.004092cb
push edi
call fcn.00408629
add esp, 0x14
test eax, eax
jne 0x403768
push esi
call fcn.004085f5
add esp, 4
test eax, eax
je 0x403710
jmp 0x403774
push edi
call fcn.004093fa
add esp, 4
or ebx, 0xffffffff
push esi
call fcn.004090ed
push edi
call fcn.004090ed
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.00406bad
add esp, 0x1004
ret
mov ecx, dword [esp + 0x100c]
pop edi
pop esi
pop ebx
xor ecx, esp
or eax, 0xffffffff
call fcn.00406bad
add esp, 0x1004
ret
Function at 0x408360
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x10], edi
je 0x408268
cmp dword [ebp + 0x14], edi
je 0x408268
cmp ecx, edi
jne 0x40826f
call fcn.0040a77f
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.0040ab53
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x408283
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x4082a4
cmp ebx, 0xffffffff
je 0x408293
push ebx
push edi
push ecx
call fcn.00406bc0
add esp, 0xc
cmp esi, edi
je 0x408250
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x408250
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test dword [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x4082c1
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x4082c8
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x4083ba
test dword [esi + 0xc], 0x10c
je 0x40831d
mov eax, dword [esi + 4]
test eax, eax
je 0x40831d
jl 0x40841b
mov edi, ebx
cmp ebx, eax
jb 0x4082ee
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x4083c2
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0040e42c
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x4083b2
cmp ebx, dword [ebp - 0xc]
jb 0x40838a
cmp dword [ebp - 0xc], 0
je 0x408347
mov ecx, 0x7fffffff
xor edx, edx
cmp ebx, ecx
jbe 0x40833c
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x408343
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x408352
mov eax, 0x7fffffff
cmp ebx, eax
ja 0x408352
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x4083ee
push eax
push dword [ebp - 8]
push esi
call fcn.0040e3fa
pop ecx
push eax
call fcn.0040e2fd
add esp, 0xc
test eax, eax
je 0x40842d
cmp eax, 0xffffffff
je 0x40841b
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x4083b2
push esi
call fcn.0040dc10
pop ecx
cmp eax, 0xffffffff
je 0x40841f
cmp dword [ebp - 4], 0
je 0x4083ee
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x4082d0
mov eax, dword [ebp + 0x14]
jmp 0x40826a
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x4083d9
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.00406bc0
add esp, 0xc
call fcn.0040a77f
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x408260
cmp dword [ebp + 0xc], 0xffffffff
je 0x408404
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00406bc0
add esp, 0xc
call fcn.0040a77f
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x408260
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x40826a
or dword [esi + 0xc], 0x10
jmp 0x40841f