joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b4560
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x86000]
push edi
or ebp, 0xffffffff
jmp 0x4b4582
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b4589
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b4578
mov eax, 1
add ebx, ebx
jne 0x4b459b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b45ac
jne 0x4b45cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b45cb
dec eax
add ebx, ebx
jne 0x4b45b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b4590
add ebx, ebx
jne 0x4b45c7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b461d
xor ecx, ecx
sub eax, 3
jb 0x4b45e3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b4652
sar eax, 1
mov ebp, eax
jmp 0x4b45ee
add ebx, ebx
jne 0x4b45ee
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b45bc
inc ecx
add ebx, ebx
jne 0x4b45fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b45bc
add ebx, ebx
jne 0x4b4609
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b45fe
jne 0x4b461a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b45fe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b463c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b462e
jmp 0x4b457e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b463c
add edi, ecx
jmp 0x4b457e
pop esi
mov edi, esi
mov ecx, 0x35dc
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b465a
cmp byte [edi], 0x12
jne 0x4b465a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b465f
lea edi, [esi + 0xb1000]
mov eax, dword [edi]
or eax, eax
je 0x4b46d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb4000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb4118]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b468c
mov ecx, edi
jns 0x4b46bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb411c]
or eax, eax
je 0x4b46d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4b46a9
call dword [esi + 0xb412c]
mov ebp, dword [esi + 0xb4120]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b470b
sub esp, 0xffffff80
jmp 0x4654a0
Function at 0x4015a0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4023a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString
push 0x400
push 0x401
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call sub.MFC42.DLL_CString::GetBufferSetLength
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::ReverseFind
push eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 0
call fcn.0040203c
push str._saa713x.inf
lea ecx, [esp + 0xc]
call fcn.0040206c
mov ecx, dword [esp + 8]
push 0
push 1
push ecx
push str.PCIVEN_1131DEV_7130
push 0
call sub.newdev.dll_UpdateDriverForPlugAndPlayDevicesA
mov edi, eax
test edi, edi
jne 0x401674
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esi + 0x60]
cmp eax, 2
mov eax, dword [ecx + 8]
jne 0x401667
push 0x404094
push eax
call sub.MFC42.DLL_CStringArray::SetAtGrow
jmp 0x401688
push 0x404078
push eax
call sub.MFC42.DLL_CStringArray::SetAtGrow
jmp 0x401688
mov eax, dword [esi + 0x68]
lea ecx, [esi + 0x60]
push 0x404060
push eax
call sub.MFC42.DLL_CStringArray::SetAtGrow
inc dword [esi + 0x78]
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.0040203c
mov ecx, dword [esp + 0x10]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4016b0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4023c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString
push 0x400
push 0x401
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call sub.MFC42.DLL_CString::GetBufferSetLength
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::ReverseFind
push eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 0
call fcn.0040203c
push str.TW68XX.inf
lea ecx, [esp + 0xc]
call fcn.0040206c
mov ecx, dword [esp + 8]
push 0
push 1
push ecx
push str.PCIVEN_1797
push 0
call sub.newdev.dll_UpdateDriverForPlugAndPlayDevicesA
mov edi, eax
test edi, edi
jne 0x401784
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esi + 0x60]
cmp eax, 2
mov eax, dword [ecx + 8]
jne 0x401777
push 0x404108
push eax
call sub.MFC42.DLL_CStringArray::SetAtGrow
jmp 0x401798
push 0x4040f0
push eax
call sub.MFC42.DLL_CStringArray::SetAtGrow
jmp 0x401798
mov eax, dword [esi + 0x68]
lea ecx, [esi + 0x60]
push 0x4040d8
push eax
call sub.MFC42.DLL_CStringArray::SetAtGrow
inc dword [esi + 0x78]
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.0040203c
mov ecx, dword [esp + 0x10]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4017c0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4023e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString
push 0x400
push 0x401
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call sub.MFC42.DLL_CString::GetBufferSetLength
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::ReverseFind
push eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 0
call fcn.0040203c
push str.NVP1204.inf
lea ecx, [esp + 0xc]
call fcn.0040206c
mov ecx, dword [esp + 8]
push 0
push 1
push ecx
push str.PCIVEN_1B07DEV_1204
push 0
call sub.newdev.dll_UpdateDriverForPlugAndPlayDevicesA
mov edi, eax
test edi, edi
jne 0x401894
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esi + 0x60]
cmp eax, 2
mov eax, dword [ecx + 8]
jne 0x401887
push 0x404170
push eax
call sub.MFC42.DLL_CStringArray::SetAtGrow
jmp 0x4018a8
push 0x404154
push eax
call sub.MFC42.DLL_CStringArray::SetAtGrow
jmp 0x4018a8
mov eax, dword [esi + 0x68]
lea ecx, [esi + 0x60]
push 0x40413c
push eax
call sub.MFC42.DLL_CStringArray::SetAtGrow
inc dword [esi + 0x78]
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.0040203c
mov ecx, dword [esp + 0x10]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4018d0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x402400
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString
push 0x400
push 0x401
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call sub.MFC42.DLL_CString::GetBufferSetLength
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::ReverseFind
push eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 0
call fcn.0040203c
push str.CX25821.inf
lea ecx, [esp + 0xc]
call fcn.0040206c
mov ecx, dword [esp + 8]
push 0
push 1
push ecx
push str.PCIVEN_14F1DEV_8210SUBSYS_00000000REV_00
push 0
call sub.newdev.dll_UpdateDriverForPlugAndPlayDevicesA
mov edi, eax
test edi, edi
jne 0x4019a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esi + 0x60]
cmp eax, 2
mov eax, dword [ecx + 8]
jne 0x401997
push 0x4041e8
push eax
call sub.MFC42.DLL_CStringArray::SetAtGrow
jmp 0x4019b8
push 0x4041cc
push eax
call sub.MFC42.DLL_CStringArray::SetAtGrow
jmp 0x4019b8
mov eax, dword [esi + 0x68]
lea ecx, [esi + 0x60]
push 0x4041b4
push eax
call sub.MFC42.DLL_CStringArray::SetAtGrow
inc dword [esi + 0x78]
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.0040203c
mov ecx, dword [esp + 0x10]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4019e0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x402420
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString
push 0x400
push 0x401
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call sub.MFC42.DLL_CString::GetBufferSetLength
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::ReverseFind
push eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 0
call fcn.0040203c
push str.CX25820.inf
lea ecx, [esp + 0xc]
call fcn.0040206c
mov ecx, dword [esp + 8]
push 0
push 1
push ecx
push str.PCIVEN_14F1DEV_8200SUBSYS_00000000REV_00
push 0
call sub.newdev.dll_UpdateDriverForPlugAndPlayDevicesA
mov edi, eax
test edi, edi
jne 0x401ab4
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esi + 0x60]
cmp eax, 2
mov eax, dword [ecx + 8]
jne 0x401aa7
push 0x404278
push eax
call sub.MFC42.DLL_CStringArray::SetAtGrow
jmp 0x401ac8
push 0x40425c
push eax
call sub.MFC42.DLL_CStringArray::SetAtGrow
jmp 0x401ac8
mov eax, dword [esi + 0x68]
lea ecx, [esi + 0x60]
push 0x404244
push eax
call sub.MFC42.DLL_CStringArray::SetAtGrow
inc dword [esi + 0x78]
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.0040203c
mov ecx, dword [esp + 0x10]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x401cf0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x402460
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString
push 0x400
push 0x401
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call sub.MFC42.DLL_CString::GetBufferSetLength
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::ReverseFind
push eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 0
call fcn.0040203c
push str.cxatlas.inf
lea ecx, [esp + 0xc]
call fcn.0040206c
mov ecx, dword [esp + 8]
push 0
push 1
push ecx
push str.PCIVEN_14F1DEV_5851SUBSYS_00000000
push 0
call sub.newdev.dll_UpdateDriverForPlugAndPlayDevicesA
mov edi, eax
test edi, edi
jne 0x401dc4
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esi + 0x60]
cmp eax, 2
mov eax, dword [ecx + 8]
jne 0x401db7
push 0x404348
push eax
call sub.MFC42.DLL_CStringArray::SetAtGrow
jmp 0x401dd8
push 0x40432c
push eax
call sub.MFC42.DLL_CStringArray::SetAtGrow
jmp 0x401dd8
mov eax, dword [esi + 0x68]
lea ecx, [esi + 0x60]
push 0x404314
push eax
call sub.MFC42.DLL_CStringArray::SetAtGrow
inc dword [esi + 0x78]
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.0040203c
mov ecx, dword [esp + 0x10]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4010a0
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push edi
mov edi, dword [ebp + 8]
push 0x64
push 0x4246b0
push 0x67
push edi
call esi
push 0x64
push 0x4245e8
push 0x6d
push edi
call esi
mov eax, edi
call fcn.00401290
mov eax, dword [ebp + 0x10]
mov edx, 0x4251b8
sub edx, eax
mov edi, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4010f0
call fcn.004039b0
mov dword [0x4230b0], eax
mov ecx, 0x41dc20
mov eax, 0x4251b8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401139
test dx, dx
je 0x401135
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401139
add eax, 4
add ecx, 4
test dx, dx
jne 0x401113
xor eax, eax
jmp 0x40113e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x401158
call fcn.00401c40
test eax, eax
je 0x401158
call fcn.00403d70
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
call fcn.00401320
add esp, 4
test eax, eax
jne 0x40117b
mov ecx, dword [esp + 0x214]
pop edi
pop esi
xor ecx, esp
call fcn.0040adf2
mov esp, ebp
pop ebp
ret 0x10
push 0x6d
push edi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
push 0x206
lea eax, [esp + 0xe]
push 0
push eax
mov word [esp + 0x14], 0
call fcn.0040f6e0
mov eax, dword [0x424e00]
add esp, 0xc
test eax, eax
jbe 0x4011ce
cmp word [0x424e04], 0
jbe 0x4011ce
push eax
mov esi, 0x42364c
call fcn.00403930
mov cx, word [0x424e04]
add esp, 4
mov word [0x42365c], cx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov eax, 0x10624dd3
mul edx
mov eax, edx
xor edx, edx
shr eax, 6
mov ecx, 0x3e8
div ecx
push edx
push 0x41dc28
mov edx, 0x4253c8
call fcn.00403150
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
push 0x3e8
call edi
call fcn.00402e20
lea esi, [esp + 8]
call fcn.00403170
push 0x41dc40
mov edx, esi
push 0x104
push edx
call fcn.0040ae31
add esp, 0xc
push 0x4253c8
mov eax, esi
push 0x104
push eax
call fcn.0040ae31
add esp, 0xc
mov ecx, esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40126e
push 0x1f4
call edi
push 1
push 0
push 0x41ddf4
mov edx, esi
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x1388
call edi
call fcn.00402b40
call fcn.00403d70
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401b70
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ecx
push 0x41dccc
push eax
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0
call fcn.0040b07e
add esp, 0xc
test eax, eax
je 0x401b94
xor eax, eax
pop ecx
ret
mov edx, dword [esp]
push ebx
push ebp
push esi
push edi
push 2
push 0
push edx
call fcn.0040b155
mov eax, dword [esp + 0x1c]
push eax
call fcn.0040b372
mov ecx, dword [esp + 0x20]
push 0
push 0
push ecx
mov esi, eax
call fcn.0040b155
mov edx, dword [esp + 0x38]
lea ebp, [esi + edx]
push ebp
call fcn.0040b42f
mov edi, eax
mov eax, dword [esp + 0x30]
push eax
push 1
push esi
push edi
call fcn.0040b74f
mov ecx, dword [esp + 0x40]
push ecx
call fcn.0040b7dd
mov eax, dword [esp + 0x50]
lea ebx, [edi + esi]
call fcn.00403ce0
mov edx, dword [esp + 0x4c]
push 0x41dcd4
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.0040b07e
add esp, 0x40
test eax, eax
je 0x401c15
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x10]
push ecx
push 1
push ebp
push edi
call fcn.0040b973
mov edx, dword [esp + 0x20]
push edx
call fcn.0040b7dd
add esp, 0x14
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x402760
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x98
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x90], eax
push ebx
xor eax, eax
push esi
push edi
xor ebx, ebx
push 0x68
mov dword [esp + 0x82], eax
mov dword [esp + 0x86], eax
mov dword [esp + 0x8a], eax
mov dword [esp + 0x8e], eax
mov dword [esp + 0x92], eax
mov dword [esp + 0x96], eax
mov dword [esp + 0x9a], eax
mov word [esp + 0x9e], ax
lea eax, [esp + 0x14]
push ebx
push eax
mov edi, ecx
mov esi, edx
mov word [esp + 0x88], bx
call fcn.0040f6e0
push esi
lea ecx, [esp + 0x20]
push 0x20
push ecx
call fcn.0040aeda
mov edx, dword [esp + 0xc4]
mov ecx, dword [esp + 0xc0]
lea esi, [esp + 0x94]
mov dword [esp + 0x8c], edx
call fcn.004038b0
mov eax, esi
push eax
lea ecx, [esp + 0x6e]
push 0x10
push ecx
call fcn.0040aeda
add esp, 0x24
xor eax, eax
nop
mov dl, byte [esp + eax + 0x10]
not dl
mov byte [esp + eax + 0x10], dl
add eax, 1
cmp eax, 0x68
jb 0x402810
push 0x41dcd4
push edi
call fcn.0040b06b
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x40286d
push esi
push 0x68
lea eax, [esp + 0x18]
push 1
push eax
call fcn.0040b973
push esi
mov edi, 1
call fcn.0040b7dd
add esp, 0x14
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.0040adf2
add esp, 0x98
ret
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0040adf2
add esp, 0x98
ret

Function at 0x402890
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
push ebx
mov edi, eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4028c3
mov eax, ebx
call fcn.00403ab0
cmp eax, edi
jne 0x4028c3
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push 0x200000
call fcn.0040b42f
mov ebp, eax
mov eax, dword [esp + 0x28]
add esp, 4
push ebp
push eax
lea edx, [esp + 0x1c]
mov ecx, edi
mov dword [esp + 0x1c], 0x200000
call fcn.004060e0
add esp, 8
test eax, eax
je 0x40298e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0040aeab
add esp, 4
call fcn.0040aeb8
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fmul qword [0x41ffd8]
fmul qword [0x41fff8]
fadd qword [0x41fff0]
call fcn.004179f0
mov esi, dword [esp + 0x14]
lea ebx, [esi + ebp]
mov edi, eax
call fcn.00403ce0
add edi, esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
call fcn.0040ad80
mov esi, eax
cmp esi, 0xffffffff
je 0x40298c
push ebx
lea ecx, [esp + 0x1c]
push ecx
push edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, dword [esp + 0x18]
cmp eax, edi
jne 0x40296b
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 1
jne 0x40298c
push ebp
mov esi, ebx
call fcn.0040ba00
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
xor esi, esi
push ebp
call fcn.0040ba00
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x402f20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x434
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x430], eax
mov eax, dword [esp + 0x438]
push ebp
push esi
push edi
push eax
mov dword [esp + 0x14], ecx
call fcn.0040a4a0
add esp, 4
test eax, eax
mov dword [esp + 0xc], eax
jne 0x403136
push 0x206
push eax
lea ecx, [esp + 0x32]
push ecx
mov word [esp + 0x34], ax
call fcn.0040f6e0
add esp, 0xc
push 0x206
lea edx, [esp + 0x236]
push 0
push edx
mov word [esp + 0x23c], 0
call fcn.0040f6e0
add esp, 0xc
lea esi, [esp + 0x28]
call fcn.00403170
push 0x41dc40
mov eax, esi
push 0x104
push eax
call fcn.0040ae31
add esp, 0xc
xor eax, eax
mov byte [esp + 0x14], 0
mov dword [esp + 0x15], eax
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov word [esp + 0x25], ax
mov byte [esp + 0x27], al
mov ebp, 0x424788
cmp word [ebp], 0
je 0x4030b6
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x234]
push 0x104
push edx
call fcn.0040aeda
add esp, 0xc
push ebp
lea eax, [esp + 0x234]
push 0x104
push eax
call fcn.0040ae31
lea ecx, [esp + 0x23c]
add esp, 0xc
push ecx
lea edi, [esp + 0x18]
call fcn.004056d0
add esp, 4
test eax, eax
je 0x4030b6
mov eax, 0x14
lea ecx, [ebp + 0x104]
mov edx, edi
mov esi, dword [edx]
cmp esi, dword [ecx]
jne 0x40304f
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x403037
test eax, eax
je 0x4030ac
movzx esi, byte [edx]
movzx edi, byte [ecx]
sub esi, edi
jne 0x40309e
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4030ac
movzx esi, byte [edx]
movzx edi, byte [ecx]
sub esi, edi
jne 0x40309e
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4030ac
movzx esi, byte [edx]
movzx edi, byte [ecx]
sub esi, edi
jne 0x40309e
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4030ac
movzx esi, byte [edx]
movzx edx, byte [ecx]
sub esi, edx
je 0x4030ac
test esi, esi
mov eax, 1
jg 0x4030ae
or eax, 0xffffffff
jmp 0x4030ae
xor eax, eax
test eax, eax
jne 0x4030b6
mov word [ebp], ax
add ebp, 0x118
cmp ebp, 0x424d00
jl 0x402fd3
mov edi, dword [esp + 0x444]
mov ebp, dword [esp + 0x10]
mov esi, 0x424788
cmp word [esi], 0
je 0x4030f5
mov eax, dword [esi + 0x100]
push edi
push ebp
mov ecx, esi
mov dword [0x42477c], eax
call fcn.0040a6b0
add esp, 8
add esi, 0x118
cmp esi, 0x424d00
jl 0x4030d8
push 0x4253c8
lea ecx, [esp + 0x2c]
push 0x104
push ecx
call fcn.0040ae31
add esp, 0xc
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x403132
mov dword [esp + 0xc], 2
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x43c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0040adf2
add esp, 0x434
ret