joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409de0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x240
mov dword [0x5356d4], 0
lea eax, [esp]
push ebx
push esi
push edi
push ebp
push eax
push str.HGL_.dll
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov esi, eax
jne 0x409e1b
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x240
ret
lea eax, [esp + 0x3c]
push 0x52f650
push eax
call fcn.00409fd0
add esp, 8
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
add dword [0x5356d4], eax
lea eax, [esp + 0x10]
push eax
push esi
call edi
test eax, eax
je 0x409e7f
mov eax, dword [0x5356d4]
lea ecx, [eax + eax*2]
shl ecx, 3
lea eax, [eax + ecx*8]
lea ecx, [esp + 0x3c]
lea edx, [eax*4 + 0x52f650]
push edx
push ecx
call fcn.00409fd0
add esp, 8
add dword [0x5356d4], eax
lea eax, [esp + 0x10]
push eax
push esi
call edi
test eax, eax
mov eax, dword [0x5356d4]
jne 0x409e4a
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [0x5356d4]
test eax, eax
jne 0x409e9f
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x240
ret
xor edx, edx
test eax, eax
je 0x409ec1
mov ecx, 0x52f950
lea esi, [edx + 0xff00]
add ecx, 0x304
inc edx
cmp eax, edx
mov dword [ecx - 0x304], esi
ja 0x409eaa
cmp eax, 1
jne 0x409ed3
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x240
ret
xor ebx, ebx
call dword [sym.imp.USER32.dll_CreateMenu]
mov dword [0x456b6c], eax
mov eax, dword [0x5356d4]
cmp eax, ebx
je 0x409f60
mov edi, 0x52f850
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
mov ebp, dword [sym.imp.USER32.dll_AppendMenuA]
xor eax, eax
mov al, byte [edi]
test eax, eax
jne 0x409f1d
lea eax, [edi - 0x100]
lea ecx, [esp + 0x150]
push eax
push 0x456bc4
push ecx
call esi
add esp, 0xc
jmp 0x409f37
push edi
lea eax, [edi - 0x100]
lea ecx, [esp + 0x154]
push eax
push str._s__s_
push ecx
call esi
add esp, 0x10
mov edx, dword [edi + 0x100]
mov ecx, dword [0x456b6c]
lea eax, [esp + 0x150]
add edi, 0x304
push eax
inc ebx
push edx
push 0
push ecx
call ebp
cmp dword [0x5356d4], ebx
ja 0x409efa
mov eax, dword [0x52b8bc]
mov edx, dword [0x456b6c]
mov ecx, dword [eax*4 + 0x456b58]
mov eax, dword [esp + 0x254]
push ecx
push edx
push 0x410
push 1
push eax
call dword [sym.imp.USER32.dll_GetMenu]
push eax
mov ebp, dword [sym.imp.USER32.dll_InsertMenuA]
call ebp
xor ecx, ecx
mov eax, 0x52f5f0
mov dword [0x52b8a4], ecx
mov dword [eax], ecx
add eax, 0x20
cmp eax, 0x52f650
mov dword [eax - 0x18], ecx
mov dword [eax - 0x1c], ecx
mov dword [eax - 0x14], ecx
mov dword [eax - 0x10], ecx
mov dword [eax - 0xc], ecx
mov dword [eax - 8], ecx
mov dword [eax - 4], ecx
jb 0x409f9f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x240
ret
Function at 0x40e420
Capabilities:
Get disk information

Disassembly:
sub esp, 0x50
push ebx
push esi
push edi
xor ebx, ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebp, eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
mov eax, 1
mov cl, bl
shl eax, cl
test ebp, eax
je 0x40e48b
lea eax, [ebx + 0x43]
lea ecx, [esp + 0x10]
push eax
push str._c:_
push ecx
call edi
lea ecx, [esp + 0x1c]
add esp, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ebx, 0x2e
lea eax, [esp + 0x10]
push str.VCOP2PROJECTPPJ2DD.EXE
push eax
call esi
lea eax, [esp + 0x10]
push 0
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, 0xffffffff
jmp 0x40e493
inc ebx
cmp ebx, 0x20
jl 0x40e43d
jmp 0x40e49a
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, 0xffffffff
cmp ebx, 0x20
je 0x40e4a6
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x50
ret

Function at 0x426c60
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 4
push ebx
push esi
mov ebx, dword [esp + 0x14]
push edi
push ebp
xor edi, edi
mov eax, dword [ebx + 8]
cmp dword [ebx], 2
je 0x426cbe
add ebx, 4
mov ebp, dword [esp + 0x18]
mov esi, dword [ebx]
test esi, esi
je 0x426cb1
mov eax, dword [ebx + 8]
test eax, eax
je 0x426cb1
lea eax, [esp + 0x10]
push 0
push eax
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x426cb1
mov edi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebx + 0xc]
add ebx, 0x10
cmp eax, 2
jne 0x426c7c
jmp 0x426cc2
mov ebp, dword [esp + 0x18]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x446ea0
Capabilities:
Get file size
Read file via mapping

Disassembly:
sub esp, 4
push ebx
push esi
push edi
xor ebx, ebx
push ebp
xor edi, edi
mov esi, 0xffffffff
mov ebp, dword [esp + 0x24]
mov eax, ebp
mov dword [esp + 0x10], ebx
and eax, 3
je 0x446fa1
cmp eax, 3
je 0x446fa1
push 0x24
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x446ee6
mov ebp, 1
jmp 0x446fa6
test ebp, 2
mov dword [edi], 0x4953444d
mov dword [edi + 0x14], 0
mov dword [edi + 0x20], 0
jne 0x446f8a
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x1c]
push 0
push pe_nt_image_headers32
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 3
push 0
push 1
push 0x80000000
push eax
call ebp
cmp eax, 0xffffffff
mov esi, eax
mov dword [esp + 0x1c], 0
jne 0x446f43
mov ebp, 2
jmp 0x446fa6
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
push 0
push 0
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
test ebx, ebx
jne 0x446f6c
mov ebp, 2
jmp 0x446fa6
push 0
push 0
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x446f8e
mov ebp, 2
jmp 0x446fa6
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push ebp
push eax
push edi
call fcn.00447000
add esp, 0xc
mov ebp, eax
jmp 0x446fa6
mov ebp, 4
test ebp, ebp
je 0x446fb7
test edi, edi
je 0x446fbd
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x446fbd
mov eax, dword [esp + 0x18]
mov dword [eax], edi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x446ff1
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x446fd4
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test ebx, ebx
je 0x446fe3
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
jmp 0x446fe9
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xffffffff
je 0x446ff1
push esi
call edi
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x448b10
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44df30
push 0x44a0c4
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x4cd978], eax
xor eax, eax
mov al, byte [0x4cd979]
mov dword [0x4cd984], eax
mov eax, dword [0x4cd978]
shr dword [0x4cd978], 0x10
and eax, 0xff
mov dword [0x4cd980], eax
shl eax, 8
add eax, dword [0x4cd984]
mov dword [0x4cd97c], eax
call fcn.0044a080
test eax, eax
jne 0x448b84
push 0x1c
call fcn.00448cb0
add esp, 4
mov dword [ebp - 4], 0
call fcn.00449ea0
call fcn.00449e90
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x806bec], eax
call fcn.00449a40
mov dword [0x4cd930], eax
test eax, eax
je 0x448bb7
cmp dword [0x806bec], 0
jne 0x448bc1
push 0xffffffffffffffff
call fcn.004492e0
add esp, 4
call fcn.004497c0
call fcn.004496d0
call fcn.004492b0
mov esi, dword [0x806bec]
mov al, byte [esi]
cmp al, 0x22
je 0x448be8
cmp al, 0x20
jbe 0x448c15
inc esi
cmp byte [esi], 0x20
ja 0x448be0
jmp 0x448c15
inc esi
cmp byte [esi], 0x22
je 0x448c14
mov bl, byte [ebp - 0x28]
mov bl, byte [esi]
test bl, bl
je 0x448c0f
xor eax, eax
mov al, bl
push eax
call fcn.00449670
add esp, 4
test eax, eax
je 0x448c09
inc esi
inc esi
cmp byte [esi], 0x22
jne 0x448bf1
cmp byte [esi], 0x22
jne 0x448c15
inc esi
cmp byte [esi], 0
je 0x448c25
cmp byte [esi], 0x20
ja 0x448c25
inc esi
cmp byte [esi], 0
jne 0x448c1a
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x44], 1
mov eax, 0xa
je 0x448c49
mov eax, dword [ebp - 0x40]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.004492e0
jmp 0x448c8a
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x449320
Capabilities:
Terminate process

Disassembly:
cmp dword [0x4cd9b4], 1
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
jne 0x44933e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x4cd9b0], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x4cd9ac], bl
jne 0x449398
cmp dword [0x806be8], 0
je 0x449386
mov edi, dword [0x806be4]
sub edi, 4
cmp edi, dword [0x806be8]
jb 0x449386
mov eax, dword [edi]
test eax, eax
je 0x44937b
call eax
sub edi, 4
cmp edi, dword [0x806be8]
jae 0x449373
push 0x44f014
push 0x44f010
call fcn.004493d0
add esp, 8
push 0x44f01c
push 0x44f018
call fcn.004493d0
add esp, 8
test ebx, ebx
jne 0x4493bf
mov dword [0x4cd9b4], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
ret
Function at 0x449a40
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
push ebx
push esi
push edi
xor ebx, ebx
push ebp
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp dword [0x4cda58], ebx
jne 0x449a8f
call esi
cmp eax, ebx
mov edi, eax
je 0x449a6d
mov dword [0x4cda58], 1
jmp 0x449a8f
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
je 0x449a85
mov dword [0x4cda58], 2
jmp 0x449a8f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x4cda58], 1
jne 0x449b3e
test edi, edi
jne 0x449ab2
call esi
mov edi, eax
test edi, edi
jne 0x449ab2
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp word [edi], 0
mov esi, edi
je 0x449acc
add esi, 2
cmp word [esi], 0
jne 0x449aba
add esi, 2
cmp word [esi], 0
jne 0x449aba
sub esi, edi
push 0
sar esi, 1
push 0
inc esi
push 0
push 0
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
test ebp, ebp
je 0x449b2d
push ebp
call fcn.0044ae60
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x449b2d
push 0
push 0
push ebp
push ebx
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x449b1c
push ebx
call fcn.0044ae10
add esp, 4
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x4cda58], 2
jne 0x449bc2
test ebx, ebx
jne 0x449b61
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
jne 0x449b61
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ebp, ebx
cmp byte [ebx], 0
je 0x449b76
inc ebp
cmp byte [ebp], 0
jne 0x449b68
inc ebp
cmp byte [ebp], 0
jne 0x449b68
sub ebp, ebx
inc ebp
push ebp
call fcn.0044ae60
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x449b9b
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov esi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x44a1e0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1a8
xor ecx, ecx
mov eax, 0x4cdc88
push ebx
mov edx, dword [esp + 0x1b0]
push esi
push edi
push ebp
cmp dword [eax], edx
je 0x44a207
add eax, 8
inc ecx
cmp eax, 0x4cdd18
jb 0x44a1f8
cmp dword [ecx*8 + 0x4cdc88], edx
lea ebx, [ecx*8]
jne 0x44a3cb
cmp dword [0x4cd93c], 1
je 0x44a387
cmp dword [0x4cd93c], 0
jne 0x44a23e
cmp dword [0x4cd940], 1
je 0x44a387
cmp edx, 0xfc
je 0x44a3cb
lea eax, [esp + 0xb4]
push 0x104
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
call ebp
test eax, eax
jne 0x44a27b
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebp, [esp + 0xb4]
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x44a2bf
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
push 3
repne scasb al, byte es:[edi]
not ecx
lea ebp, [esp + ecx + 0x7c]
push 0x44e264
push ebp
call fcn.004488c0
add esp, 0xc
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x44e244
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x4cdc8c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x12010
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x1c]
push eax
call fcn.0044b670
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
cmp dword [0x806ae0], 0
je 0x44a39d
mov eax, dword [0x806ae0]
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x44a3a7
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebx + 0x4cdc8c]
push 0
lea eax, [esp + 0x14]
mov edi, edx
push eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
Function at 0x4013d0
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, 0x47c5e8
cmp dword [esi], 0
jne 0x401416
push 0x644
push 0
call sub.KERNEL32.DLL_TerminateThread
mov ecx, eax
test ecx, ecx
jne 0x4013f3
xor eax, eax
pop esi
pop ebx
ret
mov eax, dword [0x47c5e4]
mov dword [ecx], eax
mov dword [0x47c5e4], ecx
xor edx, edx
mov eax, edx
add eax, eax
lea eax, [ecx + eax*8 + 4]
mov ebx, dword [esi]
mov dword [eax], ebx
mov dword [esi], eax
inc edx
cmp edx, 0x64
jne 0x401402
mov eax, dword [esi]
mov edx, dword [eax]
mov dword [esi], edx
pop esi
pop ebx
ret

Function at 0x401a5c
Capabilities:
Terminate thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
push ebp
push 0x401b12
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x47c5cc
call sub.KERNEL32.DLL_WaitForSingleObject
cmp byte [0x47c04d], 0
je 0x401a8a
push 0x47c5cc
call sub.KERNEL32.DLL_WriteFile
mov eax, 0x47c5ec
call fcn.00401420
mov eax, 0x47c5fc
call fcn.00401420
mov eax, 0x47c628
call fcn.00401420
push 0xff8
push 0
call sub.KERNEL32.DLL_TerminateThread
mov dword [0x47c624], eax
cmp dword [0x47c624], 0
je 0x401af1
mov eax, 3
mov edx, dword [0x47c624]
xor ecx, ecx
mov dword [edx + eax*4 - 0xc], ecx
inc eax
cmp eax, 0x401
jne 0x401ac7
mov eax, 0x47c60c
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [0x47c618], eax
mov byte [0x47c5c4], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401b19
cmp byte [0x47c04d], 0
je 0x401b11
push 0x47c5cc
call sub.KERNEL32.DLL_lstrcpyA
ret

Function at 0x401b20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x47c5c4], 0
je 0x401bfd
xor edx, edx
push ebp
push 0x401bf6
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x47c04d], 0
je 0x401b52
push 0x47c5cc
call sub.KERNEL32.DLL_WriteFile
mov byte [0x47c5c4], 0
mov eax, dword [0x47c624]
push eax
call sub.KERNEL32.DLL_VirtualAlloc
xor eax, eax
mov dword [0x47c624], eax
mov ebx, dword [0x47c5ec]
jmp 0x401b85
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_WaitForMultipleObjects
mov ebx, dword [ebx]
cmp ebx, 0x47c5ec
jne 0x401b73
mov eax, 0x47c5ec
call fcn.00401420
mov eax, 0x47c5fc
call fcn.00401420
mov eax, 0x47c628
call fcn.00401420
mov eax, dword [0x47c5e4]
test eax, eax
je 0x401bcb
mov edx, dword [eax]
mov dword [0x47c5e4], edx
push eax
call sub.KERNEL32.DLL_VirtualAlloc
mov eax, dword [0x47c5e4]
test eax, eax
jne 0x401bb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401bfd
cmp byte [0x47c04d], 0
je 0x401beb
push 0x47c5cc
call sub.KERNEL32.DLL_lstrcpyA
push 0x47c5cc
call sub.KERNEL32.DLL_Sleep
ret
pop ebx
pop ebp
ret
Function at 0x402148
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x47c5c4], 0
jne 0x402165
call fcn.00401a5c
test al, al
je 0x40216d
cmp ebx, 0x7ffffff8
jle 0x402177
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4022cb
xor ecx, ecx
push ebp
push 0x4022c4
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x47c04d], 0
je 0x402198
push 0x47c5cc
call sub.KERNEL32.DLL_WriteFile
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x4021a8
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x402247
mov eax, ebx
test eax, eax
jns 0x4021bd
add eax, 3
sar eax, 2
mov edx, dword [0x47c624]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x402247
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x4021f8
mov eax, ebx
test eax, eax
jns 0x4021e7
add eax, 3
sar eax, 2
mov ecx, dword [0x47c624]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x40221e
mov ecx, ebx
test ecx, ecx
jns 0x402201
add ecx, 3
sar ecx, 2
mov edi, dword [0x47c624]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x47c5b4]
sub ebx, 4
add dword [0x47c5b8], ebx
call fcn.00403b90
jmp 0x4022cb
cmp ebx, dword [0x47c61c]
jg 0x402299
sub dword [0x47c61c], ebx
cmp dword [0x47c61c], 0xc
jge 0x40226b
add ebx, dword [0x47c61c]
xor eax, eax
mov dword [0x47c61c], eax
mov eax, dword [0x47c620]
add dword [0x47c620], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x47c5b4]
sub ebx, 4
add dword [0x47c5b8], ebx
call fcn.00403b90
jmp 0x4022cb
mov eax, ebx
call fcn.00402054
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4022cb
cmp byte [0x47c04d], 0
je 0x4022c3
push 0x47c5cc
call sub.KERNEL32.DLL_lstrcpyA
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4022d8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x47c5c8], eax
cmp byte [0x47c5c4], 0
jne 0x402310
call fcn.00401a5c
test al, al
jne 0x402310
mov dword [0x47c5c8], 8
mov dword [ebp - 4], 8
jmp 0x402471
xor ecx, ecx
push ebp
push 0x40246a
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x47c04d], 0
je 0x402331
push 0x47c5cc
call sub.KERNEL32.DLL_WriteFile
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x40234c
mov dword [0x47c5c8], 9
jmp 0x402441
dec dword [0x47c5b4]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x47c5b8], eax
test bl, 1
je 0x4023ac
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x40237c
test edx, 0x80000003
je 0x40238b
mov dword [0x47c5c8], 0xa
jmp 0x402441
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x4023a3
mov dword [0x47c5c8], 0xa
jmp 0x402441
add ebx, edx
mov esi, eax
call fcn.00401c00
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x47c620]
jne 0x4023ec
sub dword [0x47c620], ebx
add dword [0x47c61c], ebx
cmp dword [0x47c61c], 0x3c00
jle 0x4023dd
call fcn.00401ef0
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00403b90
jmp 0x402471
mov edx, dword [eax]
test dl, 2
je 0x40240f
and edx, 0x7ffffffc
cmp edx, 4
jge 0x40240a
mov dword [0x47c5c8], 0xb
jmp 0x402441
or dword [eax], 1
jmp 0x402438
mov eax, edi
cmp dword [eax + 4], 0
je 0x402422
cmp dword [eax], 0
je 0x402422
cmp dword [eax + 8], 0xc
jge 0x40242e
mov dword [0x47c5c8], 0xb
jmp 0x402441
mov edx, dword [eax + 8]
add ebx, edx
call fcn.00401c00
mov edx, ebx
mov eax, esi
call fcn.00401e68
mov eax, dword [0x47c5c8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402471
cmp byte [0x47c04d], 0
je 0x402469
push 0x47c5cc
call sub.KERNEL32.DLL_lstrcpyA
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4028f8
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x402935
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.KERNEL32.DLL_ReadFile
push esp
call sub.KERNEL32.DLL_SetLastError
lea eax, [esp + 4]
push eax
push 0x105
call sub.KERNEL32.DLL_ReadFile
test bl, bl
je 0x402955
lea eax, [esp + 0x109]
push eax
call sub.KERNEL32.DLL_SetLastError
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.0040439c
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x4047e4
Capabilities:
Hide graphical window

Disassembly:
test eax, eax
je 0x4047f8
push eax
push 0
call sub.user32.dll_ShowWindow
test eax, eax
je 0x4047dc
ret