joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bf00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov eax, dword [ebx]
test edx, edx
je 0x41c020
cmp eax, 1
je 0x41bf54
mov eax, ebx
call fcn.0041aee0
lea edi, [eax + 4]
mov esi, eax
mov dword [esp], edi
call fcn.0041a760
mov ebp, dword [ebx]
test ebp, ebp
je 0x41bf60
cmp ebp, 1
jne 0x41bff0
mov dword [esp], edi
call fcn.0041aaa0
test esi, esi
je 0x41bf54
mov eax, esi
call fcn.0041b1d0
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x14], 0x41b290
mov dword [esp + 0x18], esi
call fcn.0041b540
mov eax, dword [0x4b8424]
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x41c058
mov eax, dword [eax + 0xc]
mov dword [esp + 0x1c], eax
lock or dword [esp], 0
call fcn.0041b540
mov eax, dword [0x4b8424]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x41c040
lea edx, [esp + 0x14]
mov dword [eax + 0xc], edx
lock or dword [esp], 0
call dword [esp + 0x44]
call fcn.0041b540
mov eax, dword [0x4b8424]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x41c030
mov edx, dword [esp + 0x1c]
mov dword [eax + 0xc], edx
mov dword [ebx], 1
jmp 0x41bf41
mov dword [esp], 2
call dword [0x4b8410]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], ebx
mov dword [esp + 4], str._once__p_is__d_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x41bf41
add esp, 0x2c
mov eax, 0x16
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0041b600
test eax, eax
jne 0x41bfd8
jmp 0x4b1175
call fcn.0041b600
test eax, eax
jne 0x41bfb2
jmp 0x4b1187
call fcn.0041b600
test eax, eax
jne 0x41bf8c
jmp 0x4b1180
mov eax, dword [esp + 0x1c]
mov dword [0], eax
ud2
mov eax, dword [pe_dos_header]
ud2
lea eax, [esp + 0x14]
mov dword [0], eax
ud2

Function at 0x41c2b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.0041b540
mov eax, dword [0x4b8424]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41c328
lea ebp, [ebx + 0x38]
xor edi, edi
mov dword [esp], ebp
call fcn.0041adf0
mov eax, dword [ebx + 0x28]
cmp dword [esp + 0x30], eax
jae 0x41c304
mov eax, dword [ebx + 0x30]
mov edx, dword [esp + 0x30]
cmp byte [eax + edx], 0
je 0x41c304
mov eax, dword [ebx + 0x2c]
mov edi, dword [eax + edx*4]
mov dword [esp], ebp
call fcn.0041ae40
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0041b600
mov ebx, eax
jmp 0x41c2db
Function at 0x41c340
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
call fcn.0041b540
mov eax, dword [0x4b8424]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41c460
lea edi, [ebx + 0x38]
mov dword [esp], edi
call fcn.0041adf0
cmp esi, dword [ebx + 0x28]
jae 0x41c3c0
mov edx, dword [ebx + 0x2c]
mov eax, dword [esp + 0x44]
mov dword [edx + esi*4], eax
mov eax, dword [ebx + 0x30]
mov byte [eax + esi], 1
mov dword [esp], edi
call fcn.0041ae40
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebp, [esi + 1]
lea eax, [ebp*4]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
test eax, eax
je 0x41c46c
mov dword [esp + 0x1c], eax
mov dword [esp + 4], ebp
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
mov edx, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x18], eax
je 0x41c46c
mov ecx, dword [ebx + 0x28]
mov eax, ebp
mov dword [esp + 4], 0
mov dword [esp + 0x1c], edx
sub eax, ecx
lea ecx, [edx + ecx*4]
shl eax, 2
mov dword [esp], ecx
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebx + 0x28]
mov edx, dword [esp + 0x18]
mov ecx, ebp
mov dword [esp + 4], 0
sub ecx, eax
add eax, edx
mov dword [esp + 8], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x28], ebp
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], eax
jmp 0x41c388
call fcn.0041b600
mov ebx, eax
jmp 0x41c375
mov dword [esp], edi
call fcn.0041ae40
mov eax, 0xc
jmp 0x41c3b0

Function at 0x41c4f0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.0041b540
mov eax, dword [0x4b8424]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41c518
mov eax, dword [eax + 0x18]
add esp, 0x1c
ret
call fcn.0041b600
test eax, eax
jne 0x41c50d
add esp, 0x1c
ret

Function at 0x41c580
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.0041b540
mov eax, dword [0x4b8424]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41c5a8
add eax, 0xc
add esp, 0x1c
ret
call fcn.0041b600
test eax, eax
jne 0x41c59d
jmp 0x41c5a0
Function at 0x41c5e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.0041b750
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x41c602
call fcn.0041b780
test byte [ebx + 0x20], 0x30
jne 0x41c61c
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [0x4b8424]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x41c65d
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x41c69d
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x41c652
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov dword [ebx + 0x18], eax
test byte [ebx + 0x24], 4
jne 0x41c666
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push ecx
mov dword [ebx + 0x14], eax
mov eax, ebx
call fcn.0041b520
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x4b8424]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x41c65d
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x41c6b1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], eax
jmp 0x41c67e

Function at 0x41c6c0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x506bfc]
test eax, eax
jne 0x41c6d0
xor eax, eax
ret
sub esp, 0x1c
call fcn.0041b540
mov eax, dword [0x4b8424]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41c710
mov edx, dword [eax + 0x10]
test edx, edx
jle 0x41c700
xor eax, eax
add esp, 0x1c
ret
test byte [eax + 0x20], 3
je 0x41c6f4
mov eax, dword [eax + 0x24]
and eax, 1
jmp 0x41c6f6
call fcn.0041b600
test eax, eax
jne 0x41c6ed
jmp 0x41c6f4

Function at 0x41c720
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.0041b540
mov eax, dword [0x4b8424]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41c760
mov edx, dword [esp + 0x20]
test edx, edx
jle 0x41c750
lock add dword [eax + 0x10], 1
add esp, 0x1c
ret
lock sub dword [eax + 0x10], 1
add esp, 0x1c
ret
call fcn.0041b600
test eax, eax
jne 0x41c73d
add esp, 0x1c
ret
Function at 0x41c860
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call fcn.0041b540
mov eax, dword [0x4b8424]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41c8d0
test byte [ebx + 0x20], 0xc
jne 0x41c890
mov eax, dword [0x506bfc]
test eax, eax
jne 0x41c8a0
add esp, 0x14
pop ebx
pop esi
ret
lea esi, [ebx + 0x1c]
mov dword [esp], esi
call fcn.0041a760
movzx eax, byte [ebx + 0x20]
test al, 3
je 0x41c8c2
mov edx, dword [ebx + 0x24]
test dl, 1
je 0x41c8c2
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jle 0x41c8e1
mov dword [esp], esi
call fcn.0041aaa0
add esp, 0x14
pop ebx
pop esi
ret
call fcn.0041b600
mov ebx, eax
test eax, eax
jne 0x41c881
add esp, 0x14
pop ebx
pop esi
ret
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [ebx + 0x24], edx
mov byte [ebx + 0x20], al
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x41c901
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
mov dword [esp], esi
call fcn.0041aaa0
call fcn.0041c770
nop
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x20]
test eax, eax
je 0x41c990
mov dword [esp], eax
call fcn.0041a4a0
mov edi, eax
mov eax, 0xfffffffe
cmp eax, edi
mov eax, 0
sbb eax, edx
jb 0x41c9d0
call fcn.0041b540
mov eax, dword [0x4b8424]
mov esi, edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x41ca30
test edi, edi
je 0x41c9aa
call fcn.0041c860
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x41ca08
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0041a5b0
call fcn.0041c860
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
call fcn.0041b540
mov eax, dword [0x4b8424]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x41ca20
call fcn.0041c860
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
call fcn.0041c860
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
call fcn.0041b540
mov eax, dword [0x4b8424]
mov esi, 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
jne 0x41c962
call fcn.0041b600
mov ebx, eax
jmp 0x41c962
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
jmp 0x41c97e
call fcn.0041b600
jmp 0x41c9aa
call fcn.0041b600
mov ebx, eax
jmp 0x41c95e
Function at 0x477a70
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll__fileno_1
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll__read
mov ebp, eax
cmp eax, 0xffffffff
je 0x477ab0
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
je 0x477a81
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x401150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
test eax, eax
je 0x4012df
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x4012df
cmp eax, edx
jae 0x4012df
mov ebx, 0x5632
lea esp, [esp]
mov eax, 0x2aaaaaab
imul ebx
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x401180
mov ecx, 0xe5a
jmp 0x4011a0
mov eax, 0x3159721f
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x4011a0
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
mov ecx, 0x4636
mov dword [ebp + 0xc], eax
mov edi, 0x4265
mov eax, 0x8c08c08d
imul edi
add edx, edi
sar edx, 6
mov edi, edx
shr edi, 0x1f
add edi, edx
jne 0x4011c6
mov edx, 0x1a92
mov dword [ebp - 4], 0xdd
mov eax, 0x30
lea esp, [esp]
cmp eax, 0xdd
cmovg eax, dword [ebp - 4]
dec edx
jne 0x4011f0
mov esi, 0x3590
mov eax, 0x2fa0be83
imul esi
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x401201
mov esi, 0x7fc2
lea esp, [esp]
mov eax, 0x83993053
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x401220
xor ebx, ebx
inc ebx
mov eax, 0x38e38e39
imul ebx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, ebx
lea eax, [eax + eax*8]
sub ecx, eax
jne 0x401254
add ebx, 2
cmp ebx, 0x5dd0
jl 0x401237
mov ebx, 0x52
inc edi
mov eax, 0x2aaaaaab
imul edi
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
add ecx, ecx
mov eax, edi
sub eax, ecx
jne 0x40127d
add edi, edi
cmp edi, 0x7599
jl 0x401261
mov edi, dword [ebp + 0xc]
xor ecx, ecx
test edi, edi
je 0x4012a0
mov edx, dword [ebp + 8]
mov al, byte [ecx + edx + 1]
add al, 0x30
xor byte [ecx + edx], al
inc ecx
cmp ecx, edi
jb 0x401291
nop
mov eax, 0x81848da9
imul esi
add edx, esi
sar edx, 7
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x4012a0
mov ecx, 0x655
mov edx, 0x39
mov eax, 0x30
cmp eax, 0x39
cmovg eax, edx
dec ecx
jne 0x4012c4
mov eax, 0xf4a
mov ecx, 0x18
cmp ebx, ecx
cmovg ebx, ecx
dec eax
jne 0x4012d7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4035d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0x40362d
mov eax, dword [ebp + 8]
push ebx
push esi
mov ecx, dword [ebp + 0xc]
inc edi
mov bh, byte [edi + ecx - 1]
inc byte [eax]
movzx esi, byte [eax]
movzx edx, byte [esi + eax + 2]
movzx ecx, byte [eax + 1]
add esi, eax
add ecx, edx
movzx edx, cl
mov byte [eax + 1], cl
movzx ecx, byte [edx + eax + 2]
mov bl, byte [esi + 2]
mov byte [esi + 2], cl
mov byte [edx + eax + 2], bl
movzx ecx, byte [esi + 2]
mov edx, dword [ebp + 0xc]
add cl, bl
movzx ecx, cl
movzx ecx, byte [ecx + eax + 2]
xor cl, bh
mov byte [edi + edx - 1], cl
cmp edi, dword [ebp + 0x10]
jb 0x4035e0
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x404a8c
Capabilities:
Create pipe
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1284
call fcn.00413e00
mov eax, dword [0x4dcee8]
mov ecx, dword [0x4dbe3c]
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x404b93
mov ebx, ecx
mov dword [ebp - 8], eax
cmp dword [0x4dcee8], 0x959
jne 0x404b81
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputA]
xor eax, eax
mov word [ebp - 4], ax
lea edi, [ebp - 2]
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
push esi
push esi
lea eax, [ebp - 0xa80]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push esi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
lea eax, [ebp - 0x280]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 0x4040d8
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push esi
push esi
push esi
push esi
push esi
push esi
push 0x404128
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
lea eax, [ebp - 0x1280]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_InterlockedFlushSList]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
call fcn.00404895
add ebx, 8
dec dword [ebp - 8]
jne 0x404ab9
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4071db
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b708]
jne 0x4071e5
repz ret
jmp fcn.0040ed2c

Function at 0x410aa7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040895d
and dword [ebp - 4], 0
cmp dword [0x42da30], 0
mov ebx, eax
jne 0x410b58
push 0x40380c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x410c09
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403800
push edi
call esi
test eax, eax
je 0x410c09
push eax
call fcn.004088eb
mov dword [esp], 0x4037f0
push edi
mov dword [0x42da30], eax
call esi
push eax
call fcn.004088eb
mov dword [esp], 0x4037dc
push edi
mov dword [0x42da34], eax
call esi
push eax
call fcn.004088eb
mov dword [esp], 0x4037c0
push edi
mov dword [0x42da38], eax
call esi
push eax
call fcn.004088eb
pop ecx
mov dword [0x42da40], eax
test eax, eax
je 0x410b58
push 0x4037a8
push edi
call esi
push eax
call fcn.004088eb
pop ecx
mov dword [0x42da3c], eax
mov eax, dword [0x42da3c]
cmp eax, ebx
je 0x410bb0
cmp dword [0x42da40], ebx
je 0x410bb0
push eax
call fcn.00408966
push dword [0x42da40]
mov esi, eax
call fcn.00408966
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x410bb0
test edi, edi
je 0x410bb0
call esi
test eax, eax
je 0x410ba7
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x410ba7
test byte [ebp - 0xc], 1
jne 0x410bb0
or dword [ebp + 0x10], 0x200000
jmp 0x410be9
mov eax, dword [0x42da34]
cmp eax, ebx
je 0x410be9
push eax
call fcn.00408966
pop ecx
test eax, eax
je 0x410be9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x410be9
mov eax, dword [0x42da38]
cmp eax, ebx
je 0x410be9
push eax
call fcn.00408966
pop ecx
test eax, eax
je 0x410be9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42da30]
call fcn.00408966
pop ecx
test eax, eax
je 0x410c09
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x410c0b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x710c78
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x7109ec
pop edx
add edi, eax
inc edi
add edi, 1
call fcn.00710cbc
push eax
mov edi, dword [esp]
add esp, 4
and eax, eax
and eax, eax
xor dword [ebx], edx
add edi, eax
sub eax, eax
dec eax
add ebx, 1
dec edi
cmp ebx, esi
jne fcn.00710c78
and eax, eax
sub edi, eax
dec edi
ret
Function at 0x4013b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x108
mov ecx, dword [eax*4 + 0x405008]
mov edx, dword [eax*4 + 0x405018]
mov eax, dword [esp + 0x114]
push esi
push ecx
mov ecx, dword [esp + 0x118]
push edx
mov edx, dword [0x405004]
push eax
push ecx
add edx, 1
push edx
push str._tr__td_class_name___u.__s:__s__td__td_class__s___s__td___tr__r_n
lea eax, [esp + 0x20]
push 0x104
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
mov ecx, dword [esp + 0x130]
add esp, 0x20
push 0
push 0
push 4
push 0
push 1
push 0x40000000
push ecx
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40144d
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 4]
push 0
lea edx, [esp + 8]
push edx
push eax
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
add esp, 0x108
ret 0xc

Function at 0x4014c0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x1108
call fcn.00401030
mov eax, dword [0x405064]
mov ecx, dword [0x405068]
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_wnsprintfA]
push eax
push ecx
push str._u__u
lea edx, [esp + 0x14]
push 0x104
push edx
call esi
lea eax, [esp + 0x1c]
push eax
push str._tr__td_colspan_2__class_date___table_class_header___tr__td_class_datetitle__Score__td__td_class_daten___s__td___tr___table___td___tr__r_n
lea ecx, [esp + 0x128]
push 0x1000
push ecx
call esi
mov edx, dword [esp + 0x1134]
add esp, 0x24
push 0
push 0
push 4
push 0
push 1
push 0x40000000
push edx
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401562
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 4]
push 0
lea eax, [esp + 8]
push eax
push ecx
lea edx, [esp + 0x118]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
add esp, 0x1108
ret 4
Function at 0x401a80
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc60
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x120]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, dword [sym.imp.SHLWAPI.dll_wnsprintfA]
lea ecx, [esp + 0x120]
push ecx
push str._splugins.dll
lea edx, [esp + 0x370]
push 0x104
push edx
call edi
add esp, 0x10
lea eax, [esp + 0x228]
push eax
lea ecx, [esp + 0x36c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
je 0x401b87
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [esp + 0x254]
push edx
lea eax, [esp + 0x124]
push eax
push str._splugins_s
lea ecx, [esp + 0x24]
push 0x104
push ecx
call edi
add esp, 0x14
lea edx, [esp + 0x18]
push edx
call ebx
test eax, eax
je 0x401b65
push str.GetTest
push eax
call ebp
test eax, eax
je 0x401b65
call eax
mov esi, eax
test esi, esi
je 0x401b65
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push eax
push ecx
lea edx, [esp + 0x478]
push str._s_:__s
push edx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0x10
lea eax, [esp + 0x470]
push eax
call fcn.00401060
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x228]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401af7
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
call fcn.00401730
mov edx, dword [0x405064]
mov eax, dword [0x405068]
push edx
push eax
push str.Score__u__u
lea ecx, [esp + 0x24]
push 0x104
push ecx
call edi
mov eax, dword [0x405050]
add esp, 0x14
lea edx, [esp + 0x18]
push edx
push 0x3f2
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402080
Capabilities:
Inspect load icon resource
Set current directory
Terminate process

Disassembly:
sub esp, 0x120
push esi
push edi
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0x104
lea eax, [esp + 0x28]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x68
push 0
call esi
mov edi, dword [sym.imp.USER32.dll_LoadIconA]
push eax
call edi
push 0x6b
push 0
mov dword [0x405048], eax
call esi
push eax
call edi
push 0x6e
push 0
mov dword [0x40505c], eax
call esi
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push str.tahoma
push 0
push 0
push 0
push 0
push 0
push 0
push 1
push 0
push 0x190
push 0
push 0
push 0
push 0xfffffffffffffff5
mov dword [0x405058], eax
call dword [sym.imp.GDI32.dll_CreateFontA]
push 0
push 0x401be0
push 0
push 0x65
push 0
mov dword [0x40504c], eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
mov dword [0x405050], eax
push 0
lea eax, [esp + 0x14]
push eax
call esi
test eax, eax
je 0x402193
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push ebp
mov ebp, dword [sym.imp.USER32.dll_IsDialogMessageA]
mov edx, dword [0x405050]
lea ecx, [esp + 0x10]
push ecx
push edx
call ebp
test eax, eax
jne 0x402180
lea eax, [esp + 0x10]
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
call ebx
push 0
push 0
push 0
lea edx, [esp + 0x1c]
push edx
call esi
test eax, eax
jne 0x402160
pop ebp
pop ebx
mov eax, dword [0x405048]
mov esi, dword [sym.imp.USER32.dll_DestroyIcon]
push eax
call esi
mov ecx, dword [0x40505c]
push ecx
call esi
mov edx, dword [0x405058]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
push edx
call esi
mov eax, dword [0x40504c]
push eax
call esi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]