joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100bd177
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x100bd1c1
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x100bd168
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x100bd177
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x104c2e1a
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x100bd1c8
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.100a403e
cmp eax, dword [ebp + 0xc]
pop eax
je 0x100bd267
add edi, 4
add eax, 2
dec ecx
jne 0x100bd1ad
call 0x100bd214
loope 0x100bd20a
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x100bd264
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x100bd275
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x100bd228
cmp eax, ecx
ja 0x100bd228
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x100bd2b2
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x100bd2a8
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.100a451d
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0xb940915c
pushal
xor eax, dword [eax]
sbb edx, dword [eax - 0x6f6f3f7b]
nop
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x19472ba8
nop
nop
nop
nop
test eax, eax
je 0x431084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40896e
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x4085d8
mov ebx, ebx
call fcn.00408991
sub ebx, ebx
mov ecx, ecx
xor dword [edi], esi
add ebx, ebx
dec ecx
inc edi
add ecx, 0xa44ecd51
mov ebx, ebx
cmp edi, edx
jne fcn.0040896e
ret

Function at 0x48f9e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7c000]
push edi
jmp 0x48f9fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x48fa01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48f9f0
mov eax, 1
add ebx, ebx
jne 0x48fa13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x48fa24
jne 0x48fa43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48fa43
dec eax
add ebx, ebx
jne 0x48fa30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x48fa08
add ebx, ebx
jne 0x48fa3f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x48fa95
xor ecx, ecx
sub eax, 3
jb 0x48fa5b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x48faca
sar eax, 1
mov ebp, eax
jmp 0x48fa66
add ebx, ebx
jne 0x48fa66
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48fa34
inc ecx
add ebx, ebx
jne 0x48fa74
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48fa34
add ebx, ebx
jne 0x48fa81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x48fa76
jne 0x48fa92
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x48fa76
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x48fab4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x48faa6
jmp 0x48f9f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x48fab4
add edi, ecx
jmp 0x48f9f6
pop esi
mov edi, esi
mov ecx, 0x1a9e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x48fad2
cmp byte [edi], 6
jne 0x48fad2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x48fad7
lea edi, [esi + 0x8d000]
mov eax, dword [edi]
or eax, eax
je 0x48fb4f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8f000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8f104]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x48fb04
mov ecx, edi
jns 0x48fb33
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8f108]
or eax, eax
je 0x48fb49
mov dword [ebx], eax
add ebx, 4
jmp 0x48fb21
call dword [esi + 0x8f118]
mov ebp, dword [esi + 0x8f10c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x48fb83
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x401440
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [0x472498]
mov eax, dword [0x4724a0]
push ebx
push esi
xor ebx, ebx
xor esi, esi
cmp edx, ebx
push edi
jle 0x401467
mov edi, eax
cmp byte [edi], bl
je 0x401467
inc esi
add edi, 0xac
cmp esi, edx
jl 0x401458
cmp esi, edx
jne 0x4014b2
mov edi, dword [0x47249c]
inc edx
cmp edx, edi
mov dword [0x472498], edx
jle 0x4014b2
lea edx, [edi + edi]
cmp edx, ebx
mov dword [0x47249c], edx
jne 0x401494
mov edx, 0x10
mov dword [0x47249c], edx
lea edi, [edx*8]
sub edi, edx
lea ecx, [edi + edi*2]
lea edx, [edx + ecx*2]
mov ecx, eax
shl edx, 2
call fcn.00435c40
mov dword [0x4724a0], eax
lea edx, [esi*8]
pop edi
sub edx, esi
lea edx, [edx + edx*2]
lea ecx, [esi + edx*2]
mov edx, 1
lea eax, [eax + ecx*4]
mov ecx, 0x3f800000
mov byte [eax], dl
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ebx
mov dword [eax + 0x2c], ebx
mov dword [eax + 0x30], ebx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x38], ebx
mov dword [eax + 0x3c], ebx
mov dword [eax + 0x40], ebx
mov dword [eax + 0x44], ebx
mov dword [eax + 0x48], ebx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0x50], 0x42c80000
mov dword [eax + 0x54], ecx
mov dword [eax + 0x58], ecx
mov dword [eax + 0x5c], ebx
mov dword [eax + 0x60], ebx
fld qword [0x46e198]
fst dword [eax + 0x64]
fstp dword [eax + 0x68]
mov dword [eax + 0x74], ebx
mov dword [eax + 0x7c], ebx
mov dword [eax + 0x84], ebx
mov dword [eax + 0x8c], ebx
mov byte [eax + 1], dl
mov byte [eax + 2], dl
mov dword [eax + 0x6c], ebx
mov dword [eax + 0x70], 0xffffff
mov dword [eax + 0x78], 0x40590000
mov dword [eax + 0x80], 0x3ff00000
mov dword [eax + 0x88], ebx
mov dword [eax + 0x90], ebx
mov edx, dword [0x46e198]
mov ecx, dword [0x46e19c]
mov dword [eax + 0x94], edx
mov dword [eax + 0x9c], ebx
mov dword [eax + 0x98], ecx
mov dword [eax + 0xa0], ebx
mov dword [eax + 0xa4], ebx
mov dword [eax + 0xa8], ebx
mov eax, esi
pop esi
pop ebx
ret
Function at 0x407290
Capabilities:
Delete file
Write file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
call fcn.00406c70
mov eax, dword [esp + 0x10]
push 0
push 0x80
push 2
push 0
push 0
add eax, 0xc
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 4], eax
je 0x40740e
push ebp
push esi
push edi
mov ecx, 0x8be
call fcn.00435b70
mov ebp, eax
mov ecx, 0x22f
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 1
mov edx, 0x20
mov word [ebp + 2], ax
mov word [ebp + 4], ax
mov byte [ebp + 6], dl
mov byte [ebp + 7], dl
mov dword [ebp + 0xe], 0x8a8
mov dword [ebp + 0x12], 0x16
mov dword [ebp + 0x16], 0x28
mov dword [ebp + 0x1a], edx
mov dword [ebp + 0x1e], 0x40
mov word [ebp + 0x22], ax
mov word [ebp + 0x24], 8
mov dword [ebp + 0x2a], 0x400
mov eax, dword [0x472d70]
mov ecx, 0xff
lea edi, [ebp + 0x42]
lea esi, [eax + 0x2c]
lea eax, [ebp + 0x43e]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebx]
mov ecx, 0x100
mov edi, eax
mov esi, dword [esi + 0x14]
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x400]
mov edi, 0x80
mov bl, byte [eax]
xor cl, cl
test bl, bl
jne 0x407367
mov cl, 0x80
mov bl, byte [eax + 1]
test bl, bl
jne 0x407371
or cl, 0x40
mov bl, byte [eax + 2]
test bl, bl
jne 0x40737a
or cl, dl
mov bl, byte [eax + 3]
test bl, bl
jne 0x407384
or cl, 0x10
mov bl, byte [eax + 4]
test bl, bl
jne 0x40738e
or cl, 8
mov bl, byte [eax + 5]
test bl, bl
jne 0x407398
or cl, 4
mov bl, byte [eax + 6]
test bl, bl
jne 0x4073a2
or cl, 2
mov bl, byte [eax + 7]
test bl, bl
jne 0x4073ac
or cl, 1
add eax, 8
mov byte [esi], cl
inc esi
dec edi
jne 0x40735d
mov edi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push 0
push ecx
push 0x8be
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebp
call fcn.00435be0
pop edi
test esi, esi
pop esi
pop ebp
je 0x407400
cmp dword [esp + 8], 0x8be
jne 0x407400
lea ecx, [esp + 0x10]
call fcn.0040f010
mov al, 1
pop ebx
add esp, 8
ret 4
mov edx, dword [esp + 0x10]
add edx, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x10]
call fcn.0040f010
xor al, al
pop ebx
add esp, 8
ret 4

Function at 0x407421
Capabilities:
Delete file

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4074a1
lea ecx, [esp + 4]
call fcn.0040eec0
lea ecx, [esp + 4]
call fcn.0040f810
push ecx
lea edx, [esp + 8]
mov ecx, esp
push edx
call fcn.004088b0
mov ecx, esi
call fcn.00407290
test al, al
je 0x407490
mov eax, dword [esp + 4]
mov ecx, dword [0x472ec8]
add eax, 0xc
push 0
push eax
push ecx
call dword [sym.imp.SHELL32.dll_ExtractIconA]
mov edx, dword [esi]
mov dword [edx + 8], eax
mov eax, dword [esi]
cmp dword [eax + 8], 1
jne 0x407482
mov dword [eax + 8], 0
mov eax, dword [esp + 4]
add eax, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 4]
call fcn.0040f010
mov ecx, dword [esi]
mov eax, dword [ecx + 8]
pop esi
pop ecx
ret
mov edx, dword [esi]
pop esi
mov eax, dword [edx + 8]
pop ecx
ret
Function at 0x40d2b3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
push esi
mov esi, ecx
mov al, 0x46
mov cl, 0x74
mov byte [esp + 6], al
mov byte [esp + 7], al
mov byte [esp + 0x12], cl
mov byte [esp + 0x2a], cl
mov ecx, dword [esi]
mov al, 0x61
mov byte [esp + 4], 0x52
mov byte [esp + 5], 0x49
mov byte [esp + 0xc], 0x57
mov byte [esp + 0xd], 0x41
mov byte [esp + 0xe], 0x56
mov byte [esp + 0xf], 0x45
mov byte [esp + 0x10], 0x66
mov byte [esp + 0x11], 0x6d
mov byte [esp + 0x13], 0x20
mov byte [esp + 0x28], 0x64
mov byte [esp + 0x29], al
mov byte [esp + 0x2b], al
mov edx, dword [ecx + 0xc]
mov eax, 1
cmp edx, eax
mov edx, dword [ecx + 4]
jne 0x40d3a2
add edx, 0x24
mov dword [esp + 0x14], 0x10
mov dword [esp + 8], edx
mov word [esp + 0x18], ax
mov ax, word [ecx + 0x10]
mov word [esp + 0x1a], ax
mov edx, dword [ecx + 8]
mov dword [esp + 0x1c], edx
movsx eax, word [ecx + 0x12]
cdq
and edx, 7
add eax, edx
movsx edx, word [ecx + 0x10]
sar eax, 3
imul eax, edx
imul eax, dword [ecx + 8]
mov dword [esp + 0x20], eax
movsx eax, word [ecx + 0x12]
cdq
and edx, 7
add eax, edx
mov edx, 0x2c
sar eax, 3
imul ax, word [ecx + 0x10]
mov word [esp + 0x24], ax
mov ax, word [ecx + 0x12]
mov word [esp + 0x26], ax
mov ecx, dword [ecx + 4]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 4]
call fcn.00446180
mov esi, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [esi + 0x1c]
call fcn.00446180
pop esi
add esp, 0x2c
ret
add edx, 0x14
mov dword [esp + 8], edx
mov eax, dword [ecx + 0x18]
mov dword [esp + 0x14], eax
mov edx, dword [ecx + 4]
mov eax, dword [ecx + 0x18]
lea ecx, [esp + 4]
sub edx, eax
mov dword [esp + 0x2c], edx
mov edx, 0x14
call fcn.00446180
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
mov ecx, dword [eax + 0x1c]
call fcn.00446180
mov edx, 8
lea ecx, [esp + 0x28]
call fcn.00446180
mov esi, dword [esi]
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 4]
mov ecx, dword [esi + 0x1c]
sub edx, eax
add ecx, eax
call fcn.00446180
pop esi
add esp, 0x2c
ret

Function at 0x40f810
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, ecx
push esi
push edi
mov ecx, 0x100
call fcn.00435b70
mov ecx, 0x200
mov esi, eax
call fcn.00435b70
mov edi, eax
push esi
mov byte [esi], 0
push 0xff
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push edi
push 0
push 0x4703a8
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov edx, edi
mov ecx, ebx
call fcn.004107e0
mov ecx, esi
call fcn.00435be0
mov ecx, edi
pop edi
pop esi
pop ebx
jmp fcn.00435be0
Function at 0x40f920
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov ecx, dword [eax]
dec ecx
mov dword [eax], ecx
jne 0x40f935
mov ecx, dword [edi]
call fcn.00435be0
mov ebx, dword [esp + 0x10]
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, eax
test esi, esi
jge 0x40f948
xor esi, esi
lea ecx, [esi + 0xd]
call fcn.00435b70
mov dword [edi], eax
mov dword [eax], 1
mov dword [eax + 4], esi
mov dword [eax + 8], 0xffffffff
mov byte [eax + esi + 0xc], 0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add eax, 0xc
inc ecx
push ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
pop edi
pop esi
pop ebx
ret 4

Function at 0x40f990
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
push ebx
push edi
mov edi, ecx
mov ecx, dword [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
test ebx, ebx
je 0x40fa01
mov eax, dword [edi]
mov ecx, dword [eax]
dec ecx
mov dword [eax], ecx
jne 0x40f9ba
mov ecx, dword [edi]
call fcn.00435be0
push esi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, eax
test esi, esi
jge 0x40f9ca
xor esi, esi
lea ecx, [esi + 0xd]
call fcn.00435b70
mov dword [edi], eax
mov dword [eax], 1
mov dword [eax + 4], esi
mov dword [eax + 8], 0xffffffff
mov byte [eax + esi + 0xc], 0
mov eax, dword [edi]
mov edx, dword [eax + 4]
add eax, 0xc
inc edx
push edx
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
pop esi
pop edi
pop ebx
ret 8
mov ecx, edi
call fcn.0040f4e0
pop edi
pop ebx
ret 8

Function at 0x40fa40
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push ebp
push esi
lea eax, [esp + 8]
push edi
push eax
mov ebp, ecx
push 0x104
mov byte [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
test esi, esi
jge 0x40fa6a
xor esi, esi
jmp 0x40fa77
cmp esi, 0x104
jle 0x40fa77
mov esi, 0x104
mov eax, dword [ebp]
mov ecx, dword [eax]
dec ecx
mov dword [eax], ecx
jne 0x40fa89
mov ecx, dword [ebp]
call fcn.00435be0
test esi, esi
mov edi, esi
jge 0x40fa91
xor edi, edi
lea ecx, [edi + 0xd]
call fcn.00435b70
mov dword [ebp], eax
mov dword [eax], 1
mov dword [eax + 4], edi
mov dword [eax + 8], 0xffffffff
mov ecx, esi
mov byte [eax + edi + 0xc], 0
mov edi, dword [ebp]
mov edx, ecx
lea esi, [esp + 0xc]
add edi, 0xc
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
add esp, 0x104
ret
Function at 0x41f580
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x41f5b0
push esi
call fcn.004176a0
mov al, byte [esi + 0x40]
add esp, 4
test al, al
je 0x41f5a9
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x41f633
mov eax, dword [esi + 0x190]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x41f61f
mov eax, dword [esi + 8]
test eax, eax
je 0x41f5d4
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x190]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x41f61b
cmp eax, 2
je 0x41f61f
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x41f5c7
cmp eax, 3
je 0x41f5fa
cmp eax, 1
jne 0x41f5c7
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x41f5c7
mov edx, dword [esi + 0x11c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x41f5c7
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.0041f650
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x41f644
mov dword [0x472634], 1
push esi
call fcn.0041f650
add esp, 4
pop esi
ret
Function at 0x41f7a0
Capabilities:
Get file size

Disassembly:
mov eax, dword [0x473a24]
sub esp, 0x230
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push eax
mov dword [0x472634], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
sub eax, dword [0x473a28]
mov dword [0x472630], eax
jns 0x41f7d1
mov dword [0x472630], ebx
mov ecx, dword [0x472624]
call fcn.00435be0
mov ecx, 0x400
call fcn.00435b70
cmp eax, ebx
mov dword [0x472624], eax
je 0x41f9b5
lea edx, [esp + 0x1b8]
lea ecx, [eax + 0x400]
push edx
mov dword [0x472628], ecx
mov dword [0x47262c], eax
call fcn.00416990
mov dword [esp + 0x10], eax
push 0x1ac
lea eax, [esp + 0x14]
push 0x3e
push eax
call fcn.00414180
mov eax, dword [0x472634]
add esp, 0x10
cmp eax, ebx
jne 0x41f9a4
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0xc]
mov dword [esp + 0x230], 0x46d994
mov dword [esp + 0x234], ebx
mov dword [esp + 0x238], ebx
push ebx
mov dword [ecx + 0x68], ebx
push edx
mov dword [esp + 0x58], 2
mov dword [esp + 0x60], ebx
call fcn.00416a50
mov eax, dword [0x472634]
add esp, 8
cmp eax, ebx
jne 0x41f9a4
lea eax, [esp + 0xc]
push 1
push eax
call fcn.00414240
mov eax, dword [0x472634]
add esp, 8
cmp eax, ebx
jne 0x41f9a4
mov edx, dword [esp + 0x2c]
mov esi, dword [0x47262c]
imul edx, dword [esp + 0x28]
mov ecx, dword [0x472624]
lea edi, [edx*4 + 0x400]
sub esi, ecx
mov edx, edi
call fcn.00435c40
cmp eax, ebx
je 0x41f9a4
mov dword [0x472624], eax
lea ecx, [eax + edi]
lea edx, [esp + 0xc]
add eax, esi
push ebx
push edx
mov dword [0x472628], ecx
mov dword [0x47262c], eax
call fcn.00416b80
mov esi, eax
lea eax, [esp + 0x14]
push eax
mov dword [esi + 0xc], ebx
call fcn.0041f580
mov eax, dword [0x472634]
add esp, 0xc
cmp eax, ebx
jne 0x41f9a4
lea ecx, [esp + 0xc]
push esi
push ecx
call dword [esi]
mov edx, dword [esp + 0x8c]
mov eax, dword [esp + 0x74]
add esp, 8
cmp edx, eax
jae 0x41f963
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x10]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
call fcn.0041f720
mov ecx, dword [0x472634]
add esp, 0xc
cmp ecx, ebx
jne 0x41f9a4
push eax
lea eax, [esp + 0x10]
push esi
push eax
call dword [esi + 4]
mov eax, dword [0x472634]
add esp, 0xc
cmp eax, ebx
jne 0x41f9a4
mov ecx, dword [esp + 0x84]
mov eax, dword [esp + 0x6c]
cmp ecx, eax
jb 0x41f91f
lea edx, [esp + 0xc]
push esi
push edx
call dword [esi + 8]
mov eax, dword [0x472634]
add esp, 8
cmp eax, ebx
jne 0x41f9a4
lea eax, [esp + 0xc]
push eax
call fcn.00414460
mov eax, dword [0x472634]
add esp, 4
cmp eax, ebx
jne 0x41f9a4
lea ecx, [esp + 0xc]
push ecx
call fcn.00414230
mov eax, dword [0x472634]
add esp, 4
cmp eax, ebx
je 0x41f9c1
mov ecx, dword [0x472624]
call fcn.00435be0
mov dword [0x472624], ebx
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x230
ret
mov eax, dword [0x47262c]
mov ecx, dword [0x472624]
mov edx, dword [esp + 0x240]
sub eax, ecx
pop edi
pop esi
mov dword [edx], ecx
add ecx, eax
mov dword [edx + 4], eax
mov dword [edx + 8], ecx
mov dword [0x472624], ebx
mov eax, 1
pop ebx
add esp, 0x230
ret
Function at 0x42dbd0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x472be8]
test eax, eax
je 0x42dbea
push 0
push 0x20
push 0x20
push 0x20
push 0x20
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
call fcn.0042d740
call fcn.0042d350
call fcn.004300b0
mov eax, dword [0x472be8]
test eax, eax
je 0x42dc0b
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp fcn.004300b0
Function at 0x430900
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
lea ecx, [esp + 4]
call fcn.0040f680
lea ecx, [esp + 4]
call fcn.0040f6d0
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 4]
test eax, eax
je 0x430948
cmp byte [eax + ecx + 0xb], 0x5c
jne 0x430948
dec eax
push 0x7fffffff
push eax
lea ecx, [esp + 0xc]
call fcn.0040f610
lea ecx, [esp + 4]
call fcn.0040f6d0
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43091d
add ecx, 0xc
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x430967
lea ecx, [esp + 4]
call fcn.0040f010
mov eax, 1
ret
mov eax, dword [esp + 4]
push esi
add eax, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x430991
test al, 0x10
je 0x430991
lea ecx, [esp + 8]
mov esi, 1
call fcn.0040f010
mov eax, esi
pop esi
ret
lea ecx, [esp + 8]
xor esi, esi
call fcn.0040f010
mov eax, esi
pop esi
ret

Function at 0x433520
Capabilities:
Hide graphical window

Disassembly:
mov al, byte [0x473330]
sub esp, 0x20
push ebx
mov bl, byte [esp + 0x28]
cmp bl, al
je 0x43360b
mov ecx, dword [0x473324]
lea eax, [esp + 4]
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
push eax
push ecx
mov byte [0x473330], bl
call esi
mov eax, dword [0x47332c]
lea edx, [esp + 0x18]
push edx
push eax
call esi
test bl, bl
je 0x4335b7
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
sub ecx, esi
mov edx, dword [esp + 0x10]
add eax, ecx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], eax
sub eax, ecx
push 1
push eax
mov eax, dword [esp + 0x10]
sub edx, eax
push edx
push ecx
push eax
mov eax, dword [0x473324]
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [0x47332c]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x472e98]
call fcn.00446c50
pop esi
pop ebx
add esp, 0x20
ret
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
mov eax, dword [0x47332c]
sub edx, esi
push 0
add ecx, edx
push eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
sub ecx, eax
push 1
push ecx
mov ecx, dword [esp + 0x10]
sub edx, ecx
push edx
push eax
mov eax, dword [0x473324]
push ecx
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [0x472e98]
call fcn.00446c50
pop esi
pop ebx
add esp, 0x20
ret

Function at 0x433610
Capabilities:
Set console window title

Disassembly:
mov al, byte [0x473a68]
test al, al
je 0x433628
mov eax, dword [0x473070]
add eax, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
ret