joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408770
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x45c050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetEvent]
push edi
mov edi, ecx
mov dword [ebp - 0xc], eax
push dword [edi + 0x30]
call esi
push dword [edi + 0x30]
call esi
test eax, eax
jne 0x4087b5
pop edi
mov eax, 0x2000
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004245df
mov esp, ebp
pop ebp
ret 8
push ebx
mov ebx, dword [ebp + 0xc]
lea esi, [edi + 0x20]
push esi
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp - 0xc]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x408822
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x4087e6
mov esi, 0x2004
jmp 0x408824
push 0x3e8
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4087ff
mov esi, 0x2006
jmp 0x408824
push 0
lea eax, [ebp - 8]
push eax
push esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov esi, 0x2004
test eax, eax
je 0x408824
xor eax, eax
cmp ebx, dword [ebp - 8]
cmove esi, eax
jmp 0x408824
xor esi, esi
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [ebp - 4]
mov eax, esi
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.004245df
mov esp, ebp
pop ebp
ret 8
Function at 0x408850
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x86c
mov eax, dword [0x45c050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x430]
mov dword [ebp - 0x868], 0
push eax
push 1
lea eax, [ebp - 0x424]
mov dword [ebp - 0x450], 0x1c
push eax
push str.PORTS
or ebx, 0xffffffff
call dword [sym.imp.SETUPAPI.dll_SetupDiClassGuidsFromNameW]
test eax, eax
jne 0x4088a9
mov dword [ebp - 0x868], 0x1000
jmp 0x408a54
push 0xa
push 0
push 0
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x408a54
push edi
lea eax, [ebp - 0x450]
xor edi, edi
push eax
push edi
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x408a53
push esi
nop dword [eax]
nop word [eax + eax]
lea eax, [ebp - 0x428]
mov dword [ebp - 0x428], 0
push eax
push 0x208
lea eax, [ebp - 0x414]
mov dword [ebp - 0x42c], 1
push eax
lea eax, [ebp - 0x434]
inc edi
push eax
push 0xc
lea eax, [ebp - 0x450]
mov dword [ebp - 0x86c], edi
push eax
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
je 0x408a3b
push 0x20019
push 1
push 0
push 1
lea eax, [ebp - 0x450]
push eax
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov esi, eax
cmp esi, 0xffffffff
je 0x408991
lea eax, [ebp - 0x428]
mov dword [ebp - 0x428], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x42c]
push eax
push 0
push str.PortName
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
lea eax, [ebp - 0x20c]
push 0x456344
push eax
call fcn.004298ac
add esp, 0xc
test eax, eax
jne 0x408a3b
lea eax, [ebp - 0x206]
push eax
call fcn.0042983a
lea eax, [ebp - 0x206]
push eax
call fcn.0042983a
mov dword [ebp - 0x864], eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x658]
push 0x104
push eax
call fcn.004293d8
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x860]
push 0x104
push eax
call fcn.004293d8
mov eax, dword [0x45ed3c]
add esp, 0x20
cmp eax, dword [0x45ed40]
je 0x408a2e
mov ecx, 0x105
lea esi, [ebp - 0x864]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
add dword [0x45ed3c], 0x414
mov edi, dword [ebp - 0x86c]
jmp 0x408a3b
lea ecx, [ebp - 0x864]
push ecx
push eax
call fcn.00408de0
lea eax, [ebp - 0x450]
push eax
push edi
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x4088f0
pop esi
pop edi
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x868]
xor ecx, ebp
pop ebx
call fcn.004245df
mov esp, ebp
pop ebp
ret
Function at 0x408fc0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x45c050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov edi, ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x409086
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x409086
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0x104
lea eax, [ebp - 0x61c]
push eax
push 0x104
lea eax, [ebp - 0x824]
push eax
push esi
call fcn.004297e3
lea eax, [ebp - 0x20c]
push eax
push 0x456354
call fcn.004294b8
add esp, 0x2c
test eax, eax
jne 0x409068
push esi
mov ecx, edi
mov dword [edi + 0x14], 1
call fcn.004090a0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004245df
mov esp, ebp
pop ebp
ret 4
mov dword [edi + 0x14], 0
mov eax, 0x3001
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004245df
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
mov eax, 0x3000
pop edi
xor ecx, ebp
pop esi
call fcn.004245df
mov esp, ebp
pop ebp
ret 4

Function at 0x4090a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [0x45c050]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push 0x80
push 3
push edi
push edi
push Ordinal_1
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4090e5
mov edi, 0x3003
jmp 0x409193
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0xc], eax
test eax, eax
je 0x409187
cmp eax, 0x40000
ja 0x409187
mov eax, dword [esi + 4]
test eax, eax
je 0x409118
push eax
call fcn.0042896c
add esp, 4
mov dword [esi + 4], edi
mov eax, dword [esi + 0xc]
mov dword [esi + 8], edi
test eax, eax
je 0x40912e
push eax
call fcn.0042896c
add esp, 4
mov dword [esi + 0xc], edi
push dword [esp + 0xc]
mov dword [esi + 0x10], edi
call fcn.00428987
add esp, 4
mov dword [esi + 4], eax
test eax, eax
jne 0x40914b
mov edi, 0x3003
jmp 0x40918c
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], edi
push ecx
push dword [esp + 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x409144
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0xc]
jne 0x409175
mov dword [esi + 8], eax
jmp 0x40917a
mov edi, 0x3003
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x409193
jmp 0x4091cf
mov edi, 0x3002
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 4]
test eax, eax
je 0x4091aa
push eax
call fcn.0042896c
add esp, 4
mov dword [esi + 4], 0
mov eax, dword [esi + 0xc]
mov dword [esi + 8], 0
test eax, eax
je 0x4091c8
push eax
call fcn.0042896c
add esp, 4
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov ecx, dword [esp + 0x14]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004245df
mov esp, ebp
pop ebp
ret 4
Function at 0x40a210
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x40a2f6
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x40a2e5
jg 0x40a250
test edx, edx
je 0x40a2e5
nop dword [eax]
call fcn.00403970
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x40a2a4
jg 0x40a267
test esi, esi
je 0x40a2a4
cmp ebx, eax
jg 0x40a277
jl 0x40a271
cmp edi, esi
jae 0x40a277
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.00425ab0
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x40a2c9
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x40a2df
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x40a250
jl 0x40a2df
test edi, edi
jne 0x40a250
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x40a318
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x40a31a
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x40a398
jg 0x40a32d
test esi, esi
je 0x40a398
test eax, eax
jl 0x40a37c
jg 0x40a337
test ebx, ebx
je 0x40a37c
cmp edi, eax
jg 0x40a347
jl 0x40a341
cmp esi, ebx
jae 0x40a347
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.00425ab0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x40a398
jg 0x40a37f
test esi, esi
je 0x40a398
jmp 0x40a37f
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x40a398
push eax
push esi
push 1
push edx
call fcn.0042a441
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40a3b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x40a3e2
jl 0x40a3d5
test ecx, ecx
jne 0x40a3e2
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x40a4a2
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.00405b80
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x40a44e
jg 0x40a40d
test esi, esi
je 0x40a44e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x40a425
mov eax, dword [esp + 0x10]
jl 0x40a41f
cmp eax, esi
jae 0x40a425
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.00425ab0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x40a46f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x40a48b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x40a3f4
jl 0x40a48b
test ecx, ecx
jne 0x40a3f4
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x40a4e1
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x40a4e1
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.00425ab0
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x40a550
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x40a507
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
mov ecx, edi
cmp edi, 0xfff
jbe 0x40a539
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.0042aa3a
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x40a564
cmp edi, eax
ja 0x40a515
test ecx, ecx
je 0x40a550
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.0042aa3a
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
sbb edx, 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40a8d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x45c050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x40a900
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004245df
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40a93c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x40a93c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004245df
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x40aa24
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x40a964
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x40a997
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.004299f4
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004245df
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x40a9f7
sub eax, 1
je 0x40a9f7
sub eax, 2
jne 0x40aa24
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.004299f4
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004245df
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40aa14
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0042a441
add esp, 0x10
cmp edi, eax
jne 0x40aa24
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x40a927
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004245df
mov esp, ebp
pop ebp
ret 4
Function at 0x40b400
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x45c050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40b4ba
cmp byte [esi + 0x3d], 0
je 0x40b4ba
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40b4a8
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40b470
sub eax, 1
je 0x40b474
sub eax, 2
jne 0x40b4a8
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004245df
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40b491
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0042a441
add esp, 0x10
cmp edi, eax
jne 0x40b4a8
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004245df
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004245df
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.004245df
mov esp, ebp
pop ebp
ret

Function at 0x40d7ec
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x45c050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0xffff
push edi
mov edi, ecx
cmp ax, bx
jne 0x40d811
xor eax, eax
jmp 0x40d86d
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x40d83e
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [ecx + esi*2]
cmp ecx, eax
jae 0x40d83e
lea ecx, [esi - 1]
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
jmp 0x40d8f4
cmp dword [edi + 0x4c], 0
je 0x40d867
mov ecx, edi
call fcn.0040d4d9
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x40d87d
push dword [edi + 0x4c]
push ebx
call fcn.0040d0d5
pop ecx
test al, al
movzx eax, bx
pop ecx
jne 0x40d86c
mov eax, 0xffff
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004245df
leave
ret 4
mov word [ebp - 0x28], bx
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x449214]
mov ecx, dword [ebp - 0x2c]
call esi
sub eax, 0
je 0x40d8c7
sub eax, 1
je 0x40d8c7
dec eax
sub eax, 1
jne 0x40d867
push dword [edi + 0x4c]
push dword [ebp - 0x28]
jmp 0x40d859
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x40d8e4
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.0042a441
add esp, 0x10
cmp esi, eax
jne 0x40d867
lea eax, [ebp - 0x28]
mov byte [edi + 0x3e], 1
cmp dword [ebp - 0x34], eax
je 0x40d867
mov ax, bx
jmp 0x40d86c
Function at 0x437f84
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00437c35

Function at 0x437f8f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00437dbf

Function at 0x43f428
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043f0a5
Function at 0x404c56
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.00443d7f
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.00443d7f
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x14], 0
push 0x10
call fcn.00443d7f
add esp, 4
mov dword [ebp - 0x18], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0
mov ebx, 0x447c70
call fcn.00443d8b
add esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
je 0x404d16
mov eax, 0
jmp 0x404e82
cmp dword [ebp + 0xc], 0
jne 0x404d42
mov dword [ebp - 0x1c], esp
mov eax, 0xd
call fcn.00443d97
cmp dword [ebp - 0x1c], esp
je 0x404d3f
push 6
call fcn.00443d91
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0
jne 0x404d6a
mov eax, str.SeDebugPrivilege
push eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0x404d64
push ebx
call fcn.00443d85
add esp, 4
pop eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
mov dword [ebp - 0x1c], esp
lea eax, [ebp - 8]
push eax
push 0x28
push dword [ebp - 4]
mov eax, 0xe
call fcn.00443d97
cmp dword [ebp - 0x1c], esp
je 0x404d95
push 6
call fcn.00443d91
add esp, 4
mov dword [ebp - 0x1c], esp
push dword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push 0x513c5f
mov eax, 0xf
call fcn.00443d97
cmp dword [ebp - 0x1c], esp
je 0x404dc1
push 6
call fcn.00443d91
add esp, 4
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], 2
mov dword [ebp - 0x1c], esp
mov eax, 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x18]
push 0x1c
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
mov eax, 0x10
call fcn.00443d97
cmp dword [ebp - 0x1c], esp
je 0x404e55
push 6
call fcn.00443d91
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 8]
mov eax, 0x11
call fcn.00443d97
cmp dword [ebp - 0x1c], esp
je 0x404e7a
push 6
call fcn.00443d91
add esp, 4
mov eax, dword [ebp - 0x14]
jmp 0x404e82
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.00443d85
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.00443d85
add esp, 4
mov ebx, dword [ebp - 0x18]
push ebx
call fcn.00443d85
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10