joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412c79
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 0x24]
push eax
push 1
push 0
push str.SoftwareMicrosoftShared
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x412d40
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x30], 4
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
push str.OfficeUILanguage
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x412d12
cmp dword [ebp - 0x28], 0
je 0x412d12
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_GetACP]
push eax
call main
add esp, 8
test eax, eax
jne 0x412d19
mov dword [ebp - 0x28], 0x409
mov eax, dword [ebp - 0x28]
push eax
push 0x454844
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 8], 1
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x412dc0
push str.msi.dll
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x412dc0
push str.MsiProvideQualifiedComponentA
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x412db6
mov dword [ebp - 0x38], 0x100
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x138]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push str.71358FC1_E43B_11D1_A17F_00A0C90AB50F
call dword [ebp - 0x34]
test eax, eax
jl 0x412db6
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
cmp dword [ebp - 0xc], 0
jne 0x412dd8
push str.eeintl.dll
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x412dea
mov eax, dword [0x45bd44]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
jmp 0x412df2
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41e150
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x16000]
push edi
jmp 0x41e16a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41e171
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41e160
mov eax, 1
add ebx, ebx
jne 0x41e183
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41e178
jne 0x41e194
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41e178
xor ecx, ecx
sub eax, 3
jb 0x41e1a8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41e21a
mov ebp, eax
add ebx, ebx
jne 0x41e1b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41e1c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41e1e4
inc ecx
add ebx, ebx
jne 0x41e1d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41e1c5
jne 0x41e1e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41e1c5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41e204
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41e1f5
jmp 0x41e166
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41e204
add edi, ecx
jmp 0x41e166
pop esi
mov edi, esi
mov ecx, 0xfb8
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41e222
cmp byte [edi], 0
jne 0x41e222
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41e227
lea edi, [esi + 0x1c000]
mov eax, dword [edi]
or eax, eax
je 0x41e29f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1e8cc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1e908]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41e254
mov ecx, edi
jns 0x41e283
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1e910]
or eax, eax
je 0x41e299
mov dword [ebx], eax
add ebx, 4
jmp 0x41e271
call dword [esi + 0x1e90c]
mov ebp, dword [esi + 0x1e914]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41e2d3
sub esp, 0xffffff80
jmp 0x402fa8
Function at 0x10005a4a
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x10024050]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x10005aed
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.1001519d
pop ecx
pop ecx
test eax, eax
je 0x10005ad6
test ebx, ebx
je 0x10005aca
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.1001519d
pop ecx
pop ecx
test eax, eax
jle 0x10005ad6
push ebx
call fcn.10006dc1
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.10006da0
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x10005a97
xor edi, edi
cmp ebx, edi
jne 0x10005af1
xor eax, eax
jmp 0x10005b5d
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x10005b20
call fcn.10006dc1
pop ecx
cmp dword [ebp - 0x70], edi
je 0x10005aed
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x10005aed
call fcn.10006dc1
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x10005b10
cmp dword [ebp - 0x70], edi
je 0x10005b53
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.10006da0
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008c61
add ebp, 0x9c
leave
ret
Function at 0x10008c61
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10024050]
jne 0x10008c6b
repz ret
jmp fcn.1000d082

Function at 0x1001519d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x100151ac
pop dword [ebp - 0x28]
mov eax, 0xb23349dd
sub eax, 0xa231f831
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xc92ace92
add dword [ebp - 0x38], 0x852776b9
mov dword [ebp - 0x34], 0xe08b26f7
sub dword [ebp - 0x34], 0xae57dab2
mov dword [ebp - 0x30], 0x4c3023df
sub dword [ebp - 0x30], 0xffe3dfb1
mov dword [ebp - 0x2c], 0xba639885
sub dword [ebp - 0x2c], 0xba639885
lea eax, [ebp - 0x38]
push eax
mov eax, 0x2a1323af
sub eax, 0x1a11635f
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x3a19b8fc
sub dword [ebp - 0x38], 0xc5a74fa6
mov dword [ebp - 0x34], 0x75b13f21
add dword [ebp - 0x34], 0xcbbb2254
mov dword [ebp - 0x30], 0x96dccaab
sub dword [ebp - 0x30], 0x336d5e3f
mov dword [ebp - 0x2c], 0x9a5ae261
add dword [ebp - 0x2c], 0x65a51d9f
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x27580295
sub eax, 0x17564249
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3a049
push 0
call eax
mov ecx, 0x420b
mov esi, eax
mov edx, 0x577f4dfa
add edx, 0xb8835c06
add edx, dword [ebp - 0x28]
mov edi, 0x14c27a78
sub edi, 0x1c22f71e
mov dword [ebp - 8], 0xf72ea67c
mov ebx, dword [edx]
add dword [ebp - 0x18], ecx
xor ebx, edi
add dword [ebp - 0xc], 0x617eef32
mov dword [esi], ebx
xor dword [ebp - 0x14], 0x235ae80a
add esi, 0x7e29943
sub esi, 0x7e2993f
add edx, 4
loop 0x100152c8
add eax, 0x92b48c06
add eax, 0x6d4c6ef9
mov ebx, eax
add eax, 0x17603c5e
sub eax, 0x17603c59
mov ecx, 0xa255003
add ecx, 0x5daaffd
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x425634]
push ebx
push ebp
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
mov dword [0x425638], eax
call fcn.00408d46
xor ebx, ebx
pop ecx
test eax, eax
je 0x401053
push str.Windows_original_main_args:_n
call fcn.00408c02
xor esi, esi
pop ecx
cmp dword [0x425628], ebx
jle 0x401053
mov eax, dword [0x42562c]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00408c02
add esp, 0xc
inc esi
cmp esi, dword [0x425628]
jl 0x401034
call dword [sym.imp.kernel32.dll_GetCommandLineA]
push eax
call fcn.004093a0
call fcn.00403941
mov edi, eax
lea eax, [edi*4 + 4]
push eax
call fcn.004039c3
pop ecx
pop ecx
mov esi, eax
call fcn.00403947
xor ecx, ecx
cmp edi, ebx
jle 0x40108d
mov edx, dword [eax + ecx*8]
mov dword [esi + ecx*4], edx
inc ecx
cmp ecx, edi
jl 0x401082
mov eax, dword [str.java]
mov dword [esi + ecx*4], ebx
mov edx, eax
cmp eax, ebx
jne 0x40109d
mov edx, dword [esi]
mov ebp, dword [0x42400c]
cmp ebp, ebx
jne 0x4010a9
mov ebp, dword [esi]
mov eax, dword [0x425420]
push ebx
xor ecx, ecx
inc ecx
push ecx
push ecx
cmp eax, ebx
setne bl
movzx ebx, bl
push ebx
push edx
push ebp
push 0x41c254
push 0x41c244
push dword [0x425424]
push ecx
push eax
push ecx
push esi
push edi
call fcn.00403485
add esp, 0x38
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x403e42
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x424070]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x403ee5
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.004093a0
pop ecx
pop ecx
test eax, eax
je 0x403ece
test ebx, ebx
je 0x403ec2
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.004093a0
pop ecx
pop ecx
test eax, eax
jle 0x403ece
push ebx
call fcn.00403a2b
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.00403a0a
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x403e8f
xor edi, edi
cmp ebx, edi
jne 0x403ee9
xor eax, eax
jmp 0x403f55
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x403f18
call fcn.00403a2b
pop ecx
cmp dword [ebp - 0x70], edi
je 0x403ee5
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x403ee5
call fcn.00403a2b
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x403f08
cmp dword [ebp - 0x70], edi
je 0x403f4b
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.00403a0a
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409908
add ebp, 0x9c
leave
ret
Function at 0x4093a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x4093af
pop dword [ebp - 0x2c]
mov eax, 0x4093af
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x42775cf8
add dword [ebp - 0x3c], 0xbdae853
mov dword [ebp - 0x38], 0x4558ac7c
sub dword [ebp - 0x38], 0x13256037
mov dword [ebp - 0x34], 0x3de0028e
add dword [ebp - 0x34], 0xe6c41a0
mov dword [ebp - 0x30], 0x9f5d06bc
sub dword [ebp - 0x30], 0x9f5d06bc
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x93194ff9
sub dword [ebp - 0x3c], 0x1ea6e6a3
mov dword [ebp - 0x38], 0x78ef7451
add dword [ebp - 0x38], 0xc87ced24
mov dword [ebp - 0x34], 0x8cca0b99
sub dword [ebp - 0x34], 0x295a9f2d
mov dword [ebp - 0x30], 0xc3f3ca52
sub dword [ebp - 0x30], 0xc3f3ca52
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xb1782484
add eax, 0x4ec99bc8
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3f646
push 0
call eax
mov ecx, 0x9cd9b4d5
add ecx, 0x6326a28e
mov ebx, eax
mov edi, 0x4e55d702
sub edi, 0x4e12ad02
add edi, dword [ebp - 0x2c]
mov edx, 0xc037d770
add edx, 0xdeeebc63
xor dword [ebp - 0x20], 0x898ddaa6
mov esi, dword [edi]
add dword [ebp - 4], 0x1a4e2d82
add esi, edx
xor dword [ebp - 4], 0xbf07c77e
mov dword [ebx], esi
mov dword [ebp - 0x1c], 0xdb526e46
add ebx, 0x1b661eee
add ebx, 0xe499e116
add edi, 4
loop 0x4094c7
add eax, 0x1505f
xor ebx, ebx
add ebx, eax
add eax, 0x53737f04
sub eax, 0x53737eff
mov ecx, 0x9dca55f3
sub ecx, 0x9d8a55f3
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x409908
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424070]
jne 0x409912
repz ret
jmp fcn.0041156c
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x757f4bff
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x5fbe58b0
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x404db3
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
or dword [ecx + 0x1384], 0xffffffff
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x404dd1
pop edi
pop esi
mov dword [ecx], ebx
mov eax, ecx
pop ebx
pop ebp
ret 4

Function at 0x4062bf
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4c5114]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
mov esi, ecx
cmp bx, di
jne 0x4062e8
xor eax, eax
jmp 0x4063b4
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x406314
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x406314
dec dword [edx]
mov ax, di
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
jmp 0x4063b4
cmp dword [esi + 0x4c], 0
je 0x4063b1
mov ecx, esi
call fcn.004088bc
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x406340
push dword [esi + 0x4c]
push edi
call fcn.00403b0e
pop ecx
pop ecx
test al, al
je 0x4063b1
movzx ebx, di
jmp 0x4063b1
movzx eax, di
mov dword [ebp - 0x28], eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call edx
test eax, eax
js 0x4063b1
cmp eax, 1
jle 0x40637f
cmp eax, 3
jne 0x4063b1
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x406330
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x34], eax
je 0x4063a2
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call fcn.00473ea3
add esp, 0x10
cmp dword [ebp - 0x34], eax
jne 0x4063b1
lea eax, [ebp - 0x28]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x30], eax
mov ax, di
jne 0x4063b4
mov ax, bx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045112d
leave
ret 4
Function at 0x406b40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x406b67
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407181
jmp 0x406c1c
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x406b89
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x406b8b
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x406c10
jg 0x406ba0
test esi, esi
je 0x406c10
test ecx, ecx
jl 0x406be9
jg 0x406baa
test eax, eax
je 0x406be9
cmp edi, ecx
jg 0x406bbe
jl 0x406bb4
cmp esi, eax
jae 0x406bbe
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.00468920
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x406bec
mov edx, dword [ebp + 8]
test edi, edi
jl 0x406c10
jg 0x406bf6
test esi, esi
je 0x406c10
cmp dword [ebx + 0x4c], 0
je 0x406c10
push dword [ebx + 0x4c]
push esi
push 1
push edx
call fcn.00473ea3
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406c25
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x406c4c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040724a
jmp 0x406d1b
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x406c6e
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x406c70
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x406d0f
jg 0x406c8d
test esi, esi
je 0x406d0f
test ecx, ecx
jl 0x406cda
jg 0x406c97
test eax, eax
je 0x406cda
cmp ebx, ecx
jg 0x406cab
jl 0x406ca1
cmp esi, eax
jae 0x406cab
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.00468920
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x406ce1
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x406d0f
jg 0x406ceb
test esi, esi
je 0x406d0f
cmp dword [edi + 0x4c], 0
je 0x406d0f
mov ecx, edi
call fcn.00408bf0
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.004747e1
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406f5f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4c5114]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x406f85
xor eax, eax
jmp 0x407049
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x406fae
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x406fae
dec dword [edx]
mov eax, ebx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x407049
cmp dword [esi + 0x4c], 0
je 0x407047
mov ecx, esi
call fcn.00408bf0
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x406fda
push dword [esi + 0x4c]
push eax
call fcn.00403af4
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x407047
mov byte [ebp - 0x28], al
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call edx
test eax, eax
js 0x407047
cmp eax, 1
jle 0x407016
cmp eax, 3
jne 0x407047
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x406fcc
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x34], eax
je 0x407039
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call fcn.00473ea3
add esp, 0x10
cmp dword [ebp - 0x34], eax
jne 0x407047
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
mov eax, ebx
jne 0x407049
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045112d
leave
ret 4

Function at 0x40890c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4c5114]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x408994
cmp byte [esi + 0x3e], 0
je 0x408994
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 0xc]
cmp di, ax
je 0x408966
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x40896a
sub eax, 1
je 0x40896e
dec eax
sub eax, 1
je 0x408994
xor al, al
jmp 0x408996
mov byte [esi + 0x3e], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40898b
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00473ea3
add esp, 0x10
cmp edi, eax
jne 0x408966
cmp byte [esi + 0x3e], 0
sete al
jmp 0x408996
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0045112d
leave
ret