joyce8/EMBER2024-capa huggingface dataset:
Function at 0x474c33
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x238], edi
je 0x474c7f
mov ecx, dword [esi + 0x230]
push 1
call fcn.0047dbc3
push 4
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
test eax, eax
je 0x474c5f
mov dword [eax], esi
jmp 0x474c61
mov eax, edi
push edi
push edi
push eax
push 0x47e8b2
push edi
push edi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x474c7f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
ret 8

Function at 0x4754c9
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x23c], edi
je 0x475515
mov ecx, dword [esi + 0x230]
push 1
call fcn.0047dbc3
push 4
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
test eax, eax
je 0x4754f5
mov dword [eax], esi
jmp 0x4754f7
mov eax, edi
push edi
push edi
push eax
push 0x47e91a
push edi
push edi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x475515
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
ret 8

Function at 0x4756b1
Capabilities:
Create thread

Disassembly:
push esi
push edi
push 0x4a3768
push 0x4a36c8
push 3
mov esi, ecx
call dword [sym.imp.CBSHost.dll_DismWriteLog]
xor edi, edi
cmp dword [esi + 0x238], edi
je 0x47571d
call fcn.0043ac79
push str.ck_W
call sym.Dismx86.exe_DismMultiLanguage
mov ecx, dword [esi + 0x230]
push eax
call fcn.0047dbc3
push 4
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
test eax, eax
je 0x4756fd
mov dword [eax], esi
jmp 0x4756ff
mov eax, edi
push edi
push edi
push eax
push 0x47e948
push edi
push edi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x47571d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
ret 8

Function at 0x4763a8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
push ebx
mov ecx, dword [edi + 0x238]
add ecx, 0x1f0
mov eax, dword [ecx]
call dword [eax]
mov esi, eax
test esi, esi
je 0x476427
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xb8]
test eax, eax
jne 0x476427
mov ecx, dword [edi + 0x234]
push 1
call fcn.0047dbc3
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 0xbc]
push 8
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
xor ecx, ecx
test eax, eax
je 0x476407
mov dword [eax], edi
mov dword [eax + 4], ebx
jmp 0x476409
mov eax, ecx
push ecx
push ecx
push eax
push 0x47ea52
push ecx
push ecx
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x476427
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4010b2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x410284]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x4010ff
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x804]
push 0x3ff
push 0x400
push eax
call fcn.0040170c
lea eax, [ebp - 0x804]
push eax
call fcn.0040170c
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ea2
leave
ret

Function at 0x40110b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x410284]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x401158
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x3ff
push 0x400
push eax
call fcn.0040170c
lea eax, [ebp - 0x404]
push eax
call fcn.0040170c
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ea2
leave
ret

Function at 0x40170c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40171b
pop dword [ebp - 0x18]
mov eax, 0x6c3daf3b
add eax, 0x940267e0
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x6709ce0e
sub dword [ebp - 0x28], 0x18b788c3
mov dword [ebp - 0x24], 0x846170de
add dword [ebp - 0x24], 0xadd1db67
mov dword [ebp - 0x20], 0x78a61de2
add dword [ebp - 0x20], 0xd3a6264c
mov dword [ebp - 0x1c], 0x7facfccd
add dword [ebp - 0x1c], 0x80530333
lea eax, [ebp - 0x28]
push eax
mov eax, 0x1b35563c
sub eax, 0x1af485e8
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x480cc21e
add dword [ebp - 0x28], 0x2c65a738
mov dword [ebp - 0x24], 0x5a44a5fb
sub dword [ebp - 0x24], 0x18d84486
mov dword [ebp - 0x20], 0xc6a83f37
add dword [ebp - 0x20], 0x9cc72d35
mov dword [ebp - 0x1c], 0xac7f4d70
sub dword [ebp - 0x1c], 0xac7f4d70
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xc660f859
add eax, 0x39dfd7f3
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x39af2
push 0
call eax
mov ecx, 0x939d07b9
add ecx, 0x6c634016
mov ebx, eax
mov esi, 0x41b000
add esi, dword [ebp - 0x18]
mov edx, 0x944b84e0
sub edx, 0x494b6c78
add dword [ebp - 0x10], eax
mov edi, dword [esi]
sub dword [ebp - 0x10], 0xd6958236
xor edi, edx
add dword [ebp - 0x14], 0x6c6fafe4
mov dword [ebx], edi
add ebx, 4
add esi, 0x4b755613
add esi, 0xb48aa9f1
loop 0x401837
add eax, 0x7ea6a7b2
sub eax, 0x7ea595a3
mov ebx, eax
add eax, 0xab9b35ec
add eax, 0x5464ca19
mov ecx, 0x2d0454f4
sub ecx, 0x2cc454f4
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.0040eb78
push str._JAVA_LAUNCHER_DEBUG
mov eax, dword [eax]
mov dword [0x433680], eax
call fcn.0041bbcc
xor ebp, ebp
pop ecx
test eax, eax
je 0x401059
push str.Windows_original_main_args:_n
call fcn.00401112
pop ecx
mov esi, ebp
call fcn.0040e6c7
cmp dword [eax], ebp
jle 0x401059
call fcn.0040e6cd
mov eax, dword [eax]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00401112
add esp, 0xc
inc esi
call fcn.0040e6c7
cmp esi, dword [eax]
jl 0x401037
call dword [sym.imp.kernel32.dll_GetCommandLineA]
push eax
call fcn.0040121d
call fcn.00401285
mov ebx, eax
lea ecx, [ebx*4 + 4]
push ecx
call fcn.00401135
pop ecx
pop ecx
mov esi, eax
call fcn.0040128b
mov edx, ebp
test ebx, ebx
jle 0x401093
mov ecx, dword [eax + edx*8]
mov dword [esi + edx*4], ecx
inc edx
cmp edx, ebx
jl 0x401088
mov edi, dword [str.java]
mov dword [esi + edx*4], ebp
test edi, edi
jne 0x4010a2
mov edi, dword [esi]
mov edx, dword [section..data]
test edx, edx
jne 0x4010ae
mov edx, dword [esi]
mov ecx, dword [0x432990]
push ebp
xor ebp, ebp
inc ebp
test ecx, ecx
push ebp
push ebp
setne al
movzx eax, al
push eax
push edi
push edx
push 0x426274
push 0x426278
push dword [0x432994]
push ebp
push ecx
push ebp
push esi
push ebx
call fcn.00401d65
add esp, 0x38
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x404305
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push ebp
call fcn.0041bbcc
mov ebx, edx
add esp, 0x10
mov esi, eax
test ebx, ebx
jl 0x404478
jg 0x404334
test esi, esi
jb 0x404478
mov edi, dword [esp + 0x20]
push 0x16
push edi
push ebp
call fcn.004175dd
add esp, 0xc
test eax, eax
js 0x404478
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x404396
push edi
call fcn.00404887
pop ecx
test eax, eax
je 0x40438d
push ebx
push esi
push edi
push ebp
call fcn.0041bbcc
add esp, 0x10
mov esi, eax
mov ebx, edx
mov eax, esi
mov edx, ebx
jmp 0x40447d
push 2
xor ebx, ebx
push ebx
push ebx
push ebp
call fcn.0041bbcc
mov ebp, eax
add esp, 0x10
mov eax, edx
mov dword [esp + 0x14], eax
cmp eax, ebx
jl 0x404478
jg 0x4043bf
cmp ebp, ebx
jb 0x404478
mov ecx, 0x10015
cmp eax, ebx
jg 0x4043d4
jl 0x4043ce
cmp ebp, ecx
jae 0x4043d4
mov esi, ebp
mov ecx, eax
jmp 0x4043d8
mov esi, ecx
mov ecx, ebx
mov eax, esi
neg eax
push 2
adc ecx, ebx
neg ecx
push ecx
push eax
push dword [esp + 0x28]
call fcn.0041bbcc
add esp, 0x10
cmp edx, ebx
jl 0x404478
jg 0x4043fe
cmp eax, ebx
jb 0x404478
push 0x10015
call fcn.0041bbcc
mov ebx, eax
pop ecx
test ebx, ebx
je 0x404478
push esi
push ebx
push dword [esp + 0x24]
call fcn.004175dd
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
js 0x404471
lea edx, [ebx + eax]
lea esi, [edx - 0x16]
jmp 0x40446d
cmp byte [esi], 0x50
jne 0x40446c
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x40446c
movzx ecx, byte [esi + 0x15]
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
lea eax, [esi + 0x16]
add eax, ecx
cmp eax, edx
je 0x404484
dec esi
cmp esi, ebx
jae 0x40442d
push ebx
call fcn.0041bbcc
pop ecx
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push 0x16
push esi
push edi
call fcn.0040a170
push ebx
call fcn.0041bbcc
mov eax, dword [esp + 0x20]
add eax, ebx
sub eax, esi
mov esi, dword [esp + 0x24]
cdq
sub ebp, eax
push edi
sbb esi, edx
call fcn.00404887
add esp, 0x14
test eax, eax
je 0x4044c4
push esi
push ebp
push edi
push dword [esp + 0x28]
call fcn.0041bbcc
add esp, 0x10
mov ebp, eax
mov esi, edx
mov eax, ebp
mov edx, esi
jmp 0x40447d
Function at 0x41bbcc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x41bbdb
pop dword [ebp - 8]
mov eax, 0x9864587a
add eax, 0x67dd6361
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x4da05837
sub dword [ebp - 0x18], 0xff4e12ec
mov dword [ebp - 0x14], 0x2ed1dd69
sub dword [ebp - 0x14], 0xfc9e9124
mov dword [ebp - 0x10], 0xf5334a6b
sub dword [ebp - 0x10], 0xa8e7063d
mov dword [ebp - 0xc], 0x507ccb41
sub dword [ebp - 0xc], 0x507ccb41
lea eax, [ebp - 0x18]
push eax
mov eax, 0x43f1111d
sub eax, 0x43aeb0c9
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xa0c41014
add dword [ebp - 0x18], 0xd3ae5942
mov dword [ebp - 0x14], 0xe3b5f9c
sub dword [ebp - 0x14], 0xcccefe27
mov dword [ebp - 0x10], 0x8ce98706
add dword [ebp - 0x10], 0xd685e566
mov dword [ebp - 0xc], 0x9b8966a7
sub dword [ebp - 0xc], 0x9b8966a7
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x35792737
add eax, 0xcac93921
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3a541
push 0
call eax
mov ecx, 0x39e3
xor edx, edx
add edx, eax
mov esi, 0x15c871f9
sub esi, 0x158487f9
add esi, dword [ebp - 8]
mov ebx, 0x3e78f192
sub ebx, 0xbd430e62
sub dword [ebp - 4], esi
mov edi, dword [esi]
sub dword [ebp - 4], ebx
xor edi, ebx
xor dword [ebp - 4], ebx
mov dword [edx], edi
add dword [ebp - 4], 0x478cea21
add edx, 0xaec4a7f3
add edx, 0x513b5811
add esi, 0x4eed28b0
sub esi, 0x4eed28ac
loop 0x41bcf9
add eax, 0x9911066a
add eax, 0x66efd3f5
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x3c433f8b
sub ecx, 0x3c033f8b
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
call fcn.00408356
pop ecx
test eax, eax
je 0x401046
push str.Windows_original_main_args:_n
call fcn.00408212
xor esi, esi
pop ecx
cmp dword [0x4212fc], esi
jle 0x401046
mov eax, dword [0x421300]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00408212
add esp, 0xc
inc esi
cmp esi, dword [0x4212fc]
jl 0x401027
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call fcn.0040362e
call fcn.00403622
mov edi, eax
lea eax, [edi*4 + 4]
push eax
call fcn.004036a4
pop ecx
pop ecx
mov esi, eax
call fcn.00403628
xor ecx, ecx
test edi, edi
jle 0x401080
mov edx, dword [eax + ecx*8]
mov dword [esi + ecx*4], edx
inc ecx
cmp ecx, edi
jl 0x401075
mov eax, dword [0x420010]
and dword [esi + ecx*4], 0
mov ebx, eax
test eax, eax
jne 0x401091
mov ebx, dword [esi]
mov ecx, dword [0x42000c]
test ecx, ecx
jne 0x40109d
mov ecx, dword [esi]
mov eax, dword [0x421100]
push 0
push 0
push 1
test eax, eax
setne dl
movzx edx, dl
push edx
push ebx
push ecx
push 0x41824c
push 0x41823c
push dword [0x421104]
push 1
push eax
push 1
push esi
push edi
call fcn.00403172
add esp, 0x38
pop edi
pop esi
pop ebx
ret
Function at 0x403b23
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x420060]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x403bc6
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.00405c82
pop ecx
pop ecx
test eax, eax
je 0x403baf
test ebx, ebx
je 0x403ba3
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.00405b49
pop ecx
pop ecx
test eax, eax
jle 0x403baf
push ebx
call fcn.0040370c
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.004036eb
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x403b70
xor edi, edi
cmp ebx, edi
jne 0x403bca
xor eax, eax
jmp 0x403c36
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x403bf9
call fcn.0040370c
pop ecx
cmp dword [ebp - 0x70], edi
je 0x403bc6
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x403bc6
call fcn.0040370c
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403be9
cmp dword [ebp - 0x70], edi
je 0x403c2c
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.004036eb
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408bf8
add ebp, 0x9c
leave
ret
Function at 0x404c3e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push 0x10000
push dword [ebp + 0x14]
xor edi, edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
push edi
call fcn.0040a68c
add esp, 0x18
mov dword [ebp - 8], eax
cmp eax, edi
jne 0x404c87
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0x14]
push dword [ebp + 8]
push dword [ebp + 0xc]
push edi
call fcn.0040a68c
add esp, 0x18
mov dword [ebp - 8], eax
cmp dword [0x42003c], edi
je 0x404d20
push str.J2D_D3D
call fcn.00408356
pop ecx
mov esi, str.false
cmp eax, edi
je 0x404cba
push esi
push eax
call fcn.00417a90
pop ecx
pop ecx
test eax, eax
jne 0x404cba
mov dword [0x42003c], edi
push ebx
push str.J2D_D3D_PRELOAD
call fcn.00408356
mov ebx, eax
pop ecx
cmp ebx, edi
je 0x404cdf
push esi
push ebx
call fcn.00417a90
pop ecx
pop ecx
test eax, eax
jne 0x404cdf
mov dword [0x42003c], edi
cmp dword [0x42003c], edi
jge 0x404d12
mov dword [0x42003c], edi
cmp ebx, edi
je 0x404d1f
push str.true
push ebx
call fcn.00417a90
pop ecx
pop ecx
test eax, eax
jne 0x404d0c
mov dword [0x42003c], 1
cmp dword [0x42003c], edi
je 0x404d1f
push str.preloadD3D
call fcn.00404b09
pop ecx
pop ebx
mov esi, dword [ebp - 8]
cmp esi, edi
je 0x404d44
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404d4d
push dword [ebp + 0x14]
call dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [0x421180], edi
pop edi
pop esi
je 0x404d5c
call fcn.00404212
mov eax, dword [ebp - 4]
leave
ret
Function at 0x404ef4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0x10
pop edi
call fcn.00404d61
push 8
mov esi, eax
call fcn.004036a4
mov dword [esp], 0x4211a0
push dword [ebp + 8]
mov ebx, eax
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x404f3e
mov dword [ebx], eax
mov dword [ebx + 4], 0x4211cc
mov edi, dword [ebx + 4]
test edi, edi
je 0x404f45
and dword [ebx + 4], 0
jmp 0x404f5e
xor eax, eax
jmp 0x40502d
push 0x4211a0
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov edi, eax
neg edi
sbb edi, edi
and edi, 0x4211cc
test edi, edi
je 0x405013
push edi
call fcn.00408570
pop ecx
cmp eax, 4
jl 0x404f31
add eax, edi
cmp byte [eax - 4], 0x2e
jne 0x404f31
add eax, 0xfffffffd
push 0x4198b4
push eax
mov dword [ebp - 4], eax
call fcn.00408c10
pop ecx
pop ecx
test eax, eax
je 0x404fa4
push 0x4198b0
push dword [ebp - 4]
call fcn.00408c10
pop ecx
pop ecx
test eax, eax
jne 0x404f31
push 0x3b
push edi
call fcn.0040a230
pop ecx
pop ecx
test eax, eax
jne 0x404f31
push dword [ebp + 8]
call fcn.00408570
push edi
mov ebx, eax
call fcn.00408570
mov dword [ebp - 4], eax
add eax, ebx
push eax
call fcn.004036a4
lea ecx, [ebx - 1]
push ecx
push dword [ebp + 8]
mov dword [ebp - 8], eax
push eax
call fcn.00408690
mov eax, dword [ebp - 4]
inc eax
push eax
push edi
mov edi, dword [ebp - 8]
lea eax, [edi + ebx - 1]
push eax
call fcn.00408690
mov ecx, dword [esi + 4]
add esp, 0x24
inc ecx
call fcn.00404db7
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov ebx, dword [ebp - 0xc]
mov dword [ecx + eax*4], edi
inc dword [esi + 4]
jmp 0x404f31
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebx + 4]
call fcn.0040370c
push ebx
call fcn.0040370c
pop ecx
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405218
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
cmp dword [esi + 4], 0xffffffff
push ebx
push edi
je 0x40526b
cmp dword [esi], 0xffffffff
je 0x40526b
push 0
push dword [esi + 8]
push dword [ebp + 8]
call fcn.00416172
add esp, 0xc
test eax, eax
js 0x40526b
mov eax, dword [esi + 4]
inc eax
push eax
call fcn.004094c7
mov ebx, eax
pop ecx
test ebx, ebx
je 0x40526b
mov edi, dword [esi + 4]
push edi
push ebx
push dword [ebp + 8]
call fcn.00415422
add esp, 0xc
cmp eax, edi
je 0x405271
push ebx
call fcn.00409608
pop ecx
xor eax, eax
pop edi
pop ebx
leave
ret
mov eax, dword [esi + 0xc]
xor ecx, ecx
cmp eax, ecx
jne 0x40528d
mov eax, dword [ebp + 0xc]
mov byte [edi + ebx], cl
cmp eax, ecx
je 0x405289
mov ecx, dword [esi + 4]
mov dword [eax], ecx
mov eax, ebx
jmp 0x40526d
cmp eax, 8
jne 0x40526b
push 0x38
push str.1.2.3
lea eax, [ebp - 0x3c]
push 0xfffffffffffffff1
push eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], edi
call fcn.00405e95
add esp, 0x10
test eax, eax
js 0x405264
mov edi, dword [esi]
lea eax, [edi + 1]
push eax
call fcn.004094c7
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x405264
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x3c]
push 1
push eax
mov dword [ebp - 0x2c], edi
call fcn.00406025
pop ecx
pop ecx
push ebx
test eax, eax
jns 0x4052f8
call fcn.00409608
push dword [ebp - 4]
call fcn.00409608
pop ecx
jmp 0x40526a
mov eax, dword [esi]
mov edi, dword [ebp - 4]
mov byte [edi + eax], 0
call fcn.00409608
lea eax, [ebp - 0x3c]
push eax
call fcn.00407261
pop ecx
pop ecx
test eax, eax
jns 0x40531b
push edi
jmp 0x405265
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x405326
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, edi
jmp 0x40526d
Function at 0x40532d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
push 2
push 0xffffffffffffffea
push edi
call fcn.00416172
mov ebx, eax
add esp, 0xc
test ebx, ebx
jns 0x405351
or eax, 0xffffffff
jmp 0x405441
push esi
mov esi, dword [ebp + 0xc]
push 0x16
push esi
push edi
call fcn.00415422
add esp, 0xc
test eax, eax
js 0x40543d
movzx eax, byte [esi + 3]
movzx ecx, byte [esi + 2]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi + 1]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi]
shl eax, 8
or eax, ecx
cmp eax, 0x6054b50
jne 0x405395
mov eax, ebx
jmp 0x405440
push 2
push 0
push edi
call fcn.00416172
add esp, 0xc
mov dword [ebp - 4], eax
test eax, eax
js 0x40543d
mov esi, 0x10015
mov ebx, eax
cmp eax, esi
jl 0x4053ba
mov ebx, esi
mov eax, ebx
push 2
neg eax
push eax
push edi
call fcn.00416172
add esp, 0xc
test eax, eax
js 0x40543d
push esi
call fcn.004094c7
mov edi, eax
pop ecx
test edi, edi
je 0x40543d
push ebx
push edi
push dword [ebp + 8]
call fcn.00415422
add esp, 0xc
test eax, eax
js 0x405436
lea ebx, [edi + eax]
lea esi, [ebx - 0x16]
jmp 0x405432
cmp byte [esi], 0x50
jne 0x405431
movzx eax, byte [esi + 3]
movzx ecx, byte [esi + 2]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi + 1]
shl eax, 8
or eax, ecx
shl eax, 8
or eax, 0x50
cmp eax, 0x6054b50
jne 0x405431
movzx eax, byte [esi + 0x15]
movzx ecx, byte [esi + 0x14]
shl eax, 8
or eax, ecx
lea eax, [eax + esi + 0x16]
cmp eax, ebx
je 0x405445
dec esi
cmp esi, edi
jae 0x4053f4
push edi
call fcn.00409608
pop ecx
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
push 0x16
push esi
push dword [ebp + 0xc]
call fcn.00408690
push edi
call fcn.00409608
mov eax, esi
sub eax, ebx
add esp, 0x10
add eax, dword [ebp - 4]
jmp 0x405440
Function at 0x408bf8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420060]
jne 0x408c02
repz ret
jmp fcn.00410041

Function at 0x40a530
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x40a557
call fcn.00409ff6
mov dword [eax], esi
call fcn.00409fe1
push 0x16
pop esi
mov dword [eax], esi
call fcn.0040c7df
mov eax, esi
jmp 0x40a5ac
test dword [ebp + 0xc], 0xfffffff9
jne 0x40a53d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40a584
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040a009
pop ecx
call fcn.00409fe1
mov eax, dword [eax]
jmp 0x40a5ac
test al, 0x10
jne 0x40a5aa
test al, 1
je 0x40a5aa
test byte [ebp + 0xc], 2
je 0x40a5aa
call fcn.00409ff6
mov dword [eax], 5
call fcn.00409fe1
mov dword [eax], 0xd
jmp 0x40a57b
xor eax, eax
pop esi
pop ebp
ret