joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40688b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
cmp edi, esi
jne 0x4068a4
cmp ebx, esi
jne 0x4068a8
cmp ebx, esi
jge 0x4068d9
mov dword [ebp - 4], 0x80070057
test edi, edi
je 0x4068bc
test ebx, ebx
jle 0x4068bc
xor eax, eax
mov word [edi], ax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4068c5
mov dword [eax], esi
mov eax, dword [ebp + 0x18]
pop esi
test eax, eax
je 0x4068d2
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
leave
ret 0x14
lea eax, [ebx + ebx]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 8]
test eax, eax
je 0x40690d
jle 0x406908
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
jmp 0x40691c
test edi, edi
jne 0x406921
test ecx, ecx
jbe 0x406921
mov dword [ebp - 4], 0x800700ea
cmp dword [ebp - 4], esi
jl 0x406949
mov edx, dword [ebp + 8]
xor eax, eax
cmp dword [ebp + 0x10], 2
sete al
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0x10], edx
je 0x40694c
cmp edx, 1
jne 0x406940
cmp dword [ebp + 0x10], 2
je 0x40694c
mov dword [ebp - 4], 0x8007065d
jmp 0x40694c
mov edx, dword [ebp + 8]
cmp dword [ebp - 4], 0x800700ea
jne 0x406969
xor eax, eax
shr ecx, 1
cmp edx, 7
sete al
inc eax
add ecx, eax
mov esi, ecx
jmp 0x4068af
cmp dword [ebp - 4], esi
jl 0x4068af
shr ecx, 1
mov esi, ecx
je 0x406980
cmp word [edi + esi*2 - 2], 0
je 0x406981
inc esi
cmp edx, 7
jne 0x406994
cmp esi, 2
jl 0x406993
cmp word [edi + esi*2 - 4], 0
je 0x406994
inc esi
cmp esi, ebx
jle 0x4069a4
mov dword [ebp - 4], 0x800700ea
jmp 0x4068af
dec esi
xor ecx, ecx
lea eax, [edi + esi*2]
mov word [eax], cx
cmp edx, 7
jne 0x4068bc
mov word [eax - 2], cx
jmp 0x4068bc
Function at 0x4069c4
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor esi, esi
push edi
xor edi, edi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov ebx, 0x80070057
cmp dword [ebp + 0x14], esi
je 0x406a4e
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push dword [ebp + 0x10]
mov dword [ebp - 4], esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
je 0x406a14
cmp eax, 0xea
je 0x406a14
cmp eax, esi
jle 0x406a48
and eax, 0xffff
or eax, 0x80070000
jmp 0x406a48
mov ebx, dword [ebp - 4]
shr ebx, 1
inc ebx
inc ebx
lea eax, [ebx + ebx]
push eax
call fcn.004053ac
mov edi, eax
pop ecx
cmp edi, esi
jne 0x406a32
mov ebx, 0x8007000e
jmp 0x406a4e
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040688b
mov ebx, eax
cmp ebx, esi
jge 0x406a57
push edi
call fcn.004053fa
pop ecx
xor edi, edi
mov eax, dword [ebp + 0x14]
cmp eax, esi
je 0x406a60
mov dword [eax], edi
mov eax, dword [ebp + 0x18]
cmp eax, esi
je 0x406a6c
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x1c]
cmp eax, esi
je 0x406a78
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x18

Function at 0x406cfe
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov ebx, eax
mov edi, ecx
mov esi, 0x80070057
je 0x406dbc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
lea eax, [esi + esi + 2]
push eax
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov dword [ebp - 4], eax
test eax, eax
jne 0x406d3f
mov esi, 0x8007000e
jmp 0x406dac
inc esi
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
jne 0x406d58
call fcn.00404f67
mov esi, eax
jmp 0x406dac
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x406d9a
cmp eax, 2
je 0x406d9a
cmp eax, 3
je 0x406d96
cmp eax, 4
je 0x406d82
jbe 0x406d7b
cmp eax, 6
jbe 0x406d9a
mov esi, 0x80070057
jmp 0x406dac
neg edi
sbb edi, edi
and edi, 0x7ff8fffb
add edi, 0x80070005
mov esi, edi
jmp 0x406dac
xor esi, esi
jmp 0x406dac
neg ebx
sbb ebx, ebx
and ebx, 0x7ff8fffb
add ebx, 0x80070005
mov esi, ebx
cmp dword [ebp - 4], 0
je 0x406dbc
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x39a537c
Capabilities:
Encode data using xor

Disassembly:
push 0xca12177
lodsb al, byte [esi]
pushal
rol al, 5
clc
xor al, 0xb5
call fcn.0391be04
inc edx
mov byte [0xddfa5f01], al
sar byte [edx + 0x52], cl
pop ecx
or byte [eax], bl
lcall 0x7e9c, 0x1933fef4
stosd dword es:[edi], eax
aaa
mov ch, 0x8d
cld
and byte fs:[edx - 0xbfb552a], bh
and eax, 0x9db82319
mov al, 0xf4
or ah, byte [eax + 0x16256a3a]
add ebx, edi
movsb byte es:[edi], byte [esi]
mov bl, 0x73
imul dword [ebx + 8]
movsd dword es:[edi], dword [esi]
invalid
Function at 0x4ba02d5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
pushfd
call fcn.046eedce
push edx
jmp 0x4b8d564
lea esp, [esp + 0x10]
jne 0x4b8e996
cwde
mov al, dl
push ebx
mov byte [edi - 1], 0
mov al, bl
mov dword [esp], ebx
lea eax, [ebp + 0x27965eb4]
lea eax, [0x391a713]
call fcn.0391ac3c
jmp 0x4ba3067
pushal
lea esp, [esp + 0x24]
je fcn.0391b714
rcl si, cl
setg dl
shl esi, 0x1d
mov esi, dword [eax + 0x3c]
bsf dx, bx
shrd dx, si, cl
shld dx, di, 7
add esi, eax
shr edx, cl
xor dl, 0xa1
and dh, 0xd9
pushal
mov edx, dword [esi + 0x78]
pushal
cmc
test edx, edx
push dword [esp + 4]
pushfd
mov byte [esp + 0x10], 0x48
lea esp, [esp + 0x48]
je fcn.0391b714
sub cl, cl
or cx, si
add edx, eax
bsf cx, cx
shl ch, cl
setno cl
clc
mov ecx, dword [esi + 0x7c]
cmc
test bh, 0xe6
pushfd
add ecx, edx
pushfd
cmp bh, 0x73
pushfd
mov dword [ebp - 0x10], ecx
neg ch
shld cx, bp, cl
mov ecx, dword [ebp + 0xc]
test cx, 0xea53
stc
cmp ecx, 0xffff
push dword [esp]
mov word [esp + 0xc], si
lea esp, [esp + 0x10]
jbe 0x391b5ec
cmc
btr ebx, ecx
mov edi, dword [edx + 0x24]
mov bl, ch
add edi, eax
xadd bx, cx
neg bh
xadd cl, bl
lea ebx, [edi + 0x3ed7d503]
mov ebx, dword [edx + 0x20]
bsr cx, bx
sar ecx, cl
stc
add ebx, eax
mov ecx, eax
dec ch
not cl
shld cx, dx, 2
mov dword [ebp - 8], 0
bsf cx, si
mov ecx, dword [edx + 0x18]
push esp
cmp ecx, dword [ebp - 8]
pushfd
call fcn.04b97439
into
mov edx, 0xf9369ce0
sal byte [edi + edx - 0x6a47da8c], 0x10
xchg edi, eax
loope 0x4ba317b
dec esi
lodsb al, byte [esi]
pop ecx
dec esi
out dx, al
dec esp
clc
push ebx
stc
adc eax, 0x787edecb
lahf
dec edi
or byte [ebx], dh
jnp 0x4ba31e6
push ss
mov bl, 0xd8
or byte [eax + 0x62], dh
test eax, 0xd26d68a2
mov dl, 0xc5
mov eax, dword [0x246fac4b]
imul ecx, dword [edx - 0x641e5ab9], 0xffffffbb
and ecx, ebp
push 0xa
and al, 0x6b
mov al, byte [edi - 0x5b]
loope 0x4ba311d
mov ebx, 0xa6acd23
insd dword es:[edi], dx
imul ebp, ebx, 9
cmpsd dword [esi], dword es:[edi]
xchg dh, dh
mov esi, 0xa40a15eb
add ecx, ebp
dec ebp
cdq
push edi
sbb byte [edi], bl
stosb byte es:[edi], al
lodsb al, byte [esi]
mov cl, 0xce
salc
lodsb al, byte [esi]
lea ebx, [edi + 0xa74d4b4]
pop es
jmp 0x25587a11
out 0xd, al
sub esp, 0xffffffe0
add ebx, esp
neg di
mov edi, ebx
inc al
inc al
shr al, 6
bt cx, bp
mov al, 0x2e
push edi
pushfd
repne scasb al, byte es:[edi]
pushfd
jmp 0x391ee7d
Function at 0x401050
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x429a5e
mov eax, dword fs:[0]
push eax
mov eax, 0x4080
call fcn.00413f40
mov eax, dword [0x431290]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4030], 0
jmp 0x40109b
mov eax, dword [ebp - 0x4030]
add eax, 1
mov dword [ebp - 0x4030], eax
cmp dword [ebp - 0x4030], 2
jge 0x4011af
cmp dword [ebp - 0x4030], 0
jne 0x4010bf
mov ecx, dword [0x43b5f8]
mov dword [ebp - 0x407c], ecx
jmp 0x4010cb
mov edx, dword [0x43b5fc]
mov dword [ebp - 0x407c], edx
mov eax, dword [ebp - 0x407c]
mov dword [ebp - 0x403c], eax
push 0x2000
push 0
mov ecx, dword [ebp - 0x4030]
shl ecx, 0xd
lea edx, [ebp + ecx - 0x402c]
push edx
call fcn.00413ad0
add esp, 0xc
push 0x42b208
mov eax, dword [ebp - 0x4030]
shl eax, 0xd
lea ecx, [ebp + eax - 0x402c]
push ecx
call fcn.00413aae
add esp, 8
mov edx, dword [ebp - 0x4030]
shl edx, 0xd
lea esi, [ebp + edx - 0x402c]
mov eax, dword [ebp - 0x4030]
shl eax, 0xd
lea ecx, [ebp + eax - 0x402c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [esi + eax*2]
mov dword [ebp - 0x4034], edx
push 0
push 0
push 0x147
mov eax, dword [ebp - 0x403c]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x4038], eax
cmp dword [ebp - 0x4038], 0
jne 0x40118a
push 0x42b210
mov ecx, dword [ebp - 0x4030]
shl ecx, 0xd
lea edx, [ebp + ecx - 0x402c]
push edx
call fcn.00413aae
add esp, 8
jmp 0x4011aa
mov eax, dword [ebp - 0x4034]
push eax
mov ecx, dword [ebp - 0x4038]
push ecx
push 0x148
mov edx, dword [ebp - 0x403c]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x40108c
lea ecx, [ebp - 0x2c]
call fcn.004049d0
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x202c]
push ecx
lea ecx, [ebp - 0x405c]
call fcn.00404a00
mov dword [ebp - 0x4080], eax
mov edx, dword [ebp - 0x4080]
mov dword [ebp - 0x4084], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x4084]
push eax
lea ecx, [ebp - 0x402c]
push ecx
lea ecx, [ebp - 0x4078]
call fcn.00404a00
mov dword [ebp - 0x4088], eax
mov edx, dword [ebp - 0x4088]
mov dword [ebp - 0x408c], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x408c]
push eax
call fcn.00401280
add esp, 0x10
mov byte [ebp - 0x403d], al
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4078]
call fcn.00404a40
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x405c]
call fcn.00404a40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00404a40
mov al, byte [ebp - 0x403d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413f30
mov esp, ebp
pop ebp
ret
Function at 0x402010
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x429aa4
mov eax, dword fs:[0]
push eax
mov eax, 0x4080
call fcn.00413f40
mov eax, dword [0x431290]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4030], 0
jmp 0x40205b
mov eax, dword [ebp - 0x4030]
add eax, 1
mov dword [ebp - 0x4030], eax
cmp dword [ebp - 0x4030], 2
jge 0x40216f
cmp dword [ebp - 0x4030], 0
jne 0x40207f
mov ecx, dword [0x43b5f8]
mov dword [ebp - 0x407c], ecx
jmp 0x40208b
mov edx, dword [0x43b5fc]
mov dword [ebp - 0x407c], edx
mov eax, dword [ebp - 0x407c]
mov dword [ebp - 0x403c], eax
push 0x2000
push 0
mov ecx, dword [ebp - 0x4030]
shl ecx, 0xd
lea edx, [ebp + ecx - 0x402c]
push edx
call fcn.00413ad0
add esp, 0xc
push 0x42b7f4
mov eax, dword [ebp - 0x4030]
shl eax, 0xd
lea ecx, [ebp + eax - 0x402c]
push ecx
call fcn.00413aae
add esp, 8
mov edx, dword [ebp - 0x4030]
shl edx, 0xd
lea esi, [ebp + edx - 0x402c]
mov eax, dword [ebp - 0x4030]
shl eax, 0xd
lea ecx, [ebp + eax - 0x402c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [esi + eax*2]
mov dword [ebp - 0x4034], edx
push 0
push 0
push 0x147
mov eax, dword [ebp - 0x403c]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x4038], eax
cmp dword [ebp - 0x4038], 0
jne 0x40214a
push 0x42b7fc
mov ecx, dword [ebp - 0x4030]
shl ecx, 0xd
lea edx, [ebp + ecx - 0x402c]
push edx
call fcn.00413aae
add esp, 8
jmp 0x40216a
mov eax, dword [ebp - 0x4034]
push eax
mov ecx, dword [ebp - 0x4038]
push ecx
push 0x148
mov edx, dword [ebp - 0x403c]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x40204c
lea ecx, [ebp - 0x2c]
call fcn.004049d0
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x202c]
push ecx
lea ecx, [ebp - 0x405c]
call fcn.00404a00
mov dword [ebp - 0x4080], eax
mov edx, dword [ebp - 0x4080]
mov dword [ebp - 0x4084], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x4084]
push eax
lea ecx, [ebp - 0x402c]
push ecx
lea ecx, [ebp - 0x4078]
call fcn.00404a00
mov dword [ebp - 0x4088], eax
mov edx, dword [ebp - 0x4088]
mov dword [ebp - 0x408c], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x408c]
push eax
call fcn.00402240
add esp, 0x10
mov byte [ebp - 0x403d], al
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4078]
call fcn.00404a40
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x405c]
call fcn.00404a40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00404a40
mov al, byte [ebp - 0x403d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413f30
mov esp, ebp
pop ebp
ret
Function at 0x403390
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 4
push str.HelpTextTitle
push 0x42bfc4
call fcn.00408ca0
add esp, 8
push eax
push str.HelpText
push 0x42bfd8
call fcn.00408ca0
add esp, 8
push eax
mov eax, dword [0x4345e0]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x4033f7
push 1
push 0
push 0
push str.ManualPath
push 0x42bfec
call fcn.00408ca0
add esp, 8
push eax
push str.open
mov ecx, dword [0x4345e0]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebp
ret
Function at 0x4039c0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x429b1e
mov eax, dword fs:[0]
push eax
sub esp, 0x19c
mov eax, dword [0x431290]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x18], ecx
jmp 0x403a17
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x10]
jge 0x403bf8
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + ecx*4]
push eax
lea ecx, [ebp - 0x38]
call fcn.00404a00
mov dword [ebp - 4], 0
push 0
push 0x3d
lea ecx, [ebp - 0x38]
call fcn.00404ac0
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [0x42c3ec]
je 0x403b4b
mov edx, dword [0x42c3ec]
push edx
mov eax, dword [ebp - 0x3c]
add eax, 1
push eax
lea ecx, [ebp - 0xc8]
push ecx
lea ecx, [ebp - 0x38]
call fcn.00404ae0
mov dword [ebp - 0x18c], eax
mov edx, dword [ebp - 0x18c]
mov dword [ebp - 0x190], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x190]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
push 0
lea edx, [ebp - 0xe4]
push edx
lea ecx, [ebp - 0x38]
call fcn.00404ae0
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x198], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x198]
push ecx
lea ecx, [ebp - 0xac]
call fcn.00404e00
mov dword [ebp - 0x19c], eax
mov edx, dword [ebp - 0x19c]
mov dword [ebp - 0x1a0], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x1a0]
push eax
lea ecx, [ebp - 0x74]
call fcn.00407650
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x74]
push ecx
lea edx, [ebp - 0xf0]
push edx
mov ecx, dword [ebp + 8]
call fcn.00404b90
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x74]
call fcn.00404800
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xac]
call fcn.00404800
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xe4]
call fcn.00404a40
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc8]
call fcn.00404a40
jmp 0x403be4
push 0x42c09c
lea ecx, [ebp - 0x17c]
call fcn.00404a00
mov byte [ebp - 4], 5
lea eax, [ebp - 0x17c]
push eax
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x160]
call fcn.00404e00
mov dword [ebp - 0x1a4], eax
mov edx, dword [ebp - 0x1a4]
mov dword [ebp - 0x1a8], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x1a8]
push eax
lea ecx, [ebp - 0x128]
call fcn.00407650
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x128]
push ecx
lea edx, [ebp - 0x188]
push edx
mov ecx, dword [ebp + 8]
call fcn.00404b90
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x128]
call fcn.00404800
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x160]
call fcn.00404800
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x17c]
call fcn.00404a40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00404a40
jmp 0x403a0e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00413f30
mov esp, ebp
pop ebp
ret
Function at 0x407d10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x431290]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x200
push 0
lea eax, [ebp - 0x208]
push eax
call fcn.00413ad0
add esp, 0xc
push 0x42c5e8
mov ecx, dword [ebp + 8]
push ecx
call fcn.00416151
add esp, 8
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x407d61
or eax, 0xffffffff
jmp 0x407e33
mov dword [ebp - 0x210], 0
jmp 0x407d7c
mov edx, dword [ebp - 0x210]
add edx, 1
mov dword [ebp - 0x210], edx
cmp dword [ebp - 0x210], 8
jae 0x407e30
push 0
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax*4 + 0x4311ac]
push ecx
mov edx, dword [ebp - 0x20c]
push edx
call fcn.00415d49
add esp, 0xc
mov eax, dword [ebp - 0x20c]
push eax
push 1
mov ecx, dword [ebp - 0x210]
mov edx, dword [ecx*4 + 0x43118c]
push edx
call fcn.004143d0
add esp, 4
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.0041606e
add esp, 0x10
cmp eax, 1
jne 0x407e2b
mov ecx, dword [ebp - 0x210]
mov edx, dword [ecx*4 + 0x43118c]
push edx
call fcn.004143d0
add esp, 4
push eax
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax*4 + 0x43118c]
push ecx
lea edx, [ebp - 0x208]
push edx
call fcn.0041445b
add esp, 0xc
test eax, eax
jne 0x407e2b
mov eax, dword [ebp - 0x20c]
push eax
call fcn.00413fe2
add esp, 4
mov eax, dword [ebp - 0x210]
jmp 0x407e33
jmp 0x407d6d
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413f30
mov esp, ebp
pop ebp
ret

Function at 0x408520
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
mov eax, dword [0x431290]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.00415d49
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 1
push 0x40
lea edx, [ebp - 0x48]
push edx
call fcn.0041606e
add esp, 0x10
push 1
mov eax, dword [ebp - 0xc]
sub eax, 0x40
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00415d49
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 1
push 0x18
lea eax, [ebp - 0x170]
push eax
call fcn.0041606e
add esp, 0x10
push 1
movzx ecx, word [ebp - 0x15c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00415d49
add esp, 0xc
mov ax, word [ebp - 0x16a]
mov word [ebp - 0x4c], ax
xor ecx, ecx
mov word [ebp - 0x174], cx
jmp 0x4085c1
mov dx, word [ebp - 0x174]
add dx, 1
mov word [ebp - 0x174], dx
movzx eax, word [ebp - 0x174]
movzx ecx, word [ebp - 0x4c]
cmp eax, ecx
jge 0x408639
mov edx, dword [ebp + 8]
push edx
push 1
push 0x28
lea eax, [ebp - 0x74]
push eax
call fcn.0041606e
add esp, 0x10
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004143d0
add esp, 4
test eax, eax
je 0x408620
push 8
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x74]
push eax
call fcn.0041445b
add esp, 0xc
test eax, eax
je 0x408620
push 8
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x74]
push edx
call fcn.00417299
add esp, 0xc
test eax, eax
jne 0x408634
push 1
push 0xffffffffffffffd8
mov eax, dword [ebp + 8]
push eax
call fcn.00415d49
add esp, 0xc
mov al, 1
jmp 0x40863b
jmp 0x4085af
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413f30
mov esp, ebp
pop ebp
ret
Function at 0x4086a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x431290]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.00415d49
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 1
push 0x40
lea edx, [ebp - 0x48]
push edx
call fcn.0041606e
add esp, 0x10
push 1
mov eax, dword [ebp - 0xc]
sub eax, 0x40
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00415d49
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 1
push 0x18
lea eax, [ebp - 0x140]
push eax
call fcn.0041606e
add esp, 0x10
movzx ecx, word [ebp - 0x12c]
test ecx, ecx
jle 0x408772
push 1
push 2
mov edx, dword [ebp + 8]
push edx
call fcn.00415d49
add esp, 0xc
push 1
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.00415d49
add esp, 0xc
push 1
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.00415d49
add esp, 0xc
push 1
push 4
mov edx, dword [ebp + 8]
push edx
call fcn.00415d49
add esp, 0xc
push 1
push 4
mov eax, dword [ebp + 8]
push eax
call fcn.00415d49
add esp, 0xc
push 1
push 4
mov ecx, dword [ebp + 8]
push ecx
call fcn.00415d49
add esp, 0xc
mov al, 1
jmp 0x408774
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413f30
mov esp, ebp
pop ebp
ret

Function at 0x4087e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
mov eax, dword [0x431290]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.00415d49
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 1
push 0x40
lea edx, [ebp - 0x48]
push edx
call fcn.0041606e
add esp, 0x10
push 1
mov eax, dword [ebp - 0xc]
sub eax, 0x40
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00415d49
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 1
push 0x18
lea eax, [ebp - 0x170]
push eax
call fcn.0041606e
add esp, 0x10
push 1
movzx ecx, word [ebp - 0x15c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00415d49
add esp, 0xc
mov ax, word [ebp - 0x16a]
mov word [ebp - 0x4c], ax
xor ecx, ecx
mov word [ebp - 0x174], cx
jmp 0x408881
mov dx, word [ebp - 0x174]
add dx, 1
mov word [ebp - 0x174], dx
movzx eax, word [ebp - 0x174]
movzx ecx, word [ebp - 0x4c]
cmp eax, ecx
jge 0x4088c4
mov edx, dword [ebp + 8]
push edx
push 1
push 0x28
lea eax, [ebp - 0x74]
push eax
call fcn.0041606e
add esp, 0x10
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0x68]
jb 0x4088c2
mov edx, dword [ebp - 0x68]
add edx, dword [ebp - 0x6c]
cmp dword [ebp + 0xc], edx
jae 0x4088c2
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0x68]
add eax, dword [ebp - 0x60]
jmp 0x4088c6
jmp 0x40886f
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413f30
mov esp, ebp
pop ebp
ret
Function at 0x4088e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x431290]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x4c], 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.00415d49
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 1
push 0x40
lea edx, [ebp - 0x48]
push edx
call fcn.0041606e
add esp, 0x10
push 1
mov eax, dword [ebp - 0xc]
sub eax, 0x40
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00415d49
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 1
push 0x18
lea eax, [ebp - 0x148]
push eax
call fcn.0041606e
add esp, 0x10
movzx ecx, word [ebp - 0x134]
test ecx, ecx
jle 0x4089c1
push 1
push 0x68
mov edx, dword [ebp + 8]
push edx
call fcn.00415d49
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push 1
push 4
lea ecx, [ebp - 0x14c]
push ecx
call fcn.0041606e
add esp, 0x10
mov edx, dword [ebp + 8]
push edx
push 1
push 4
lea eax, [ebp - 0x4c]
push eax
call fcn.0041606e
add esp, 0x10
push 0
mov ecx, dword [ebp - 0x14c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004087e0
add esp, 8
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00415d49
add esp, 0xc
mov eax, dword [ebp - 0x4c]
jmp 0x4089c3
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413f30
mov esp, ebp
pop ebp
ret