joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41da65
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.software_ahnlab_twaupdate
push 0x80000002
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41dad1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push str.frsvc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41dac8
mov esi, dword [ebp - 8]
push esi
push str._autoup__CPdTWC::IsFirstUpdate__First_update_for_master_without_engine:_d
push 1
call fcn.00408893
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x41dad6
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 2
push 0
push str.software_ahnlab_twaupdate
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41db21
push str.frsvc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push eax
push str._autoup__CPdTWC::ClearFirstUpdate__delete_frsvc_value_:_d
push 1
call fcn.00408893
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x42000b
Capabilities:
Create directory

Disassembly:
push esi
xor esi, esi
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x420032
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
sub esi, 0xb7
neg esi
sbb esi, esi
add esi, 5
mov eax, esi
pop esi
ret

Function at 0x42018d
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4201d4
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
je 0x4201d4
cmp eax, 3
je 0x4201d4
push edi
call esi
push eax
push str._AutoUp__BA_RemoveFile__ERROR:_Delete_Fail__d_:__s
push 1
call fcn.00408bf4
add esp, 0x10
push 1
pop eax
jmp 0x4201d6
xor eax, eax
pop edi
pop esi
ret
Function at 0x42020b
Capabilities:
Copy file
Delete file
Move file
Set file attributes

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebx, dword [esp + 0x14]
push 3
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
call edi
test ebp, ebp
jne 0x4202c3
cmp eax, 0x78
je 0x420256
push esi
push ebx
push eax
push str._AutoUp__BA_MoveFile__RETRY_1:___d___s______s
push 1
call fcn.00408bf4
add esp, 0x14
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call ebp
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [esp + 0x18], eax
call edi
cmp dword [esp + 0x18], 0
jne 0x4202c3
push esi
push ebx
push eax
push str._AutoUp__BA_MoveFile__RETRY_2:___d___s______s
push 1
call fcn.00408bf4
add esp, 0x14
push esi
call ebp
push 0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [esp + 0x18], eax
call edi
cmp dword [esp + 0x18], 1
mov edi, eax
jne 0x4202a5
push ebx
call ebp
cmp dword [esp + 0x18], 0
jne 0x4202c3
push esi
push ebx
push edi
push str._AutoUp__BA_MoveFile__ERROR:___d___s______s
push 1
call fcn.00408bf4
add esp, 0x14
push 0xb
pop eax
jmp 0x4202c5
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4202ca
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x80
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
pop esi
jne 0x420312
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push str._AutoUp__BA_CopyFile__ERROR:___d___s______s
push 1
call fcn.00408bf4
add esp, 0x14
push 0xb
pop eax
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4208f7
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
lea eax, [ebp - 0x140]
push esi
push eax
xor esi, esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x42092a
mov ecx, dword [ebp + 0xc]
push eax
mov dword [ecx], 1
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x42095b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x420956
cmp eax, 3
je 0x420956
cmp eax, 0x12
je 0x420956
push 1
pop esi
push dword [ebp + 8]
push eax
push str._AutoUp__BA_FileExists__ERROR__d_:__s
push esi
call fcn.00408bf4
add esp, 0x10
jmp 0x42095b
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, esi
pop esi
leave
ret

Function at 0x420ae7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x414], 0
jg 0x420aff
xor eax, eax
jmp 0x420b8b
lea eax, [ebp + 8]
push eax
push dword [esi]
call fcn.00429e40
test eax, eax
jne 0x420b8b
cmp dword [esi + 0x414], eax
jle 0x420b6c
push edi
push 0xfffffffffffffffc
pop edi
lea eax, [esi + 4]
sub edi, esi
mov ecx, dword [ebp + 8]
and ecx, 0xf
mov cl, byte [ecx + esi + 0x404]
xor byte [eax], cl
mov ecx, dword [ebp + 8]
mov dl, byte [eax]
sar ecx, 4
add ecx, 5
and ecx, 0xf
mov cl, byte [ecx + esi + 0x404]
add cl, dl
mov edx, dword [ebp + 8]
sar edx, 8
sub edx, 5
mov byte [eax], cl
and edx, 0xf
sub cl, byte [edx + esi + 0x404]
inc dword [ebp + 8]
mov byte [eax], cl
inc eax
lea ecx, [edi + eax]
cmp ecx, dword [esi + 0x414]
jl 0x420b1f
pop edi
lea eax, [ebp - 4]
push eax
lea eax, [esi + 4]
push dword [esi + 0x414]
push eax
push dword [esi]
call fcn.00429de0
test eax, eax
jne 0x420b8b
and dword [esi + 0x414], eax
pop esi
leave
ret

Function at 0x420bab
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push dword [ebp + 0xc]
call fcn.0042a010
mov ebx, eax
add ebx, 0x17
lea eax, [ebx + 5]
push eax
call fcn.0042abe0
mov esi, eax
test esi, esi
jne 0x420be5
push str._AutoUp__BA_WriteEnginePath__Out_Of_Memory:_pBuffer
push 1
call fcn.00408bf4
pop ecx
pop ecx
jmp 0x420c79
mov eax, ebx
push edi
sar eax, 8
mov byte [esi + 1], al
mov eax, ebx
sar eax, 0x10
mov byte [esi + 2], al
mov eax, ebx
lea edi, [esi + 4]
push str._V3ENGINEMODULE__r_nPATH
sar eax, 0x18
push edi
mov byte [esi], bl
mov byte [esi + 3], al
call fcn.00429ee0
push dword [ebp + 0xc]
lea eax, [esi + 0x1b]
push eax
call fcn.00429ee0
test ebx, ebx
mov ecx, 0x4e4
jle 0x420c4c
push 0xfffffffffffffffc
mov eax, edi
pop edi
sub edi, esi
mov edx, ecx
shr edx, 8
xor byte [eax], dl
movzx edx, byte [eax]
add edx, ecx
imul edx, edx, 0xce6d
add edx, 0x58bf
inc eax
mov ecx, edx
lea edx, [edi + eax]
cmp edx, ebx
jl 0x420c2a
lea eax, [ebp - 4]
push eax
push 0x8304
push dword [ebp + 8]
call fcn.00429d70
test eax, eax
pop edi
jne 0x420c73
lea eax, [ebp - 8]
add ebx, 4
push eax
push ebx
push esi
push dword [ebp - 4]
call fcn.00429de0
push esi
call fcn.0042abf0
cmp dword [ebp - 4], 0
pop esi
pop ebx
je 0x420c89
push dword [ebp - 4]
call fcn.00429d90
xor eax, eax
leave
ret
Function at 0x421b6d
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
cmp edx, esi
je 0x421b9d
cmp dword [esp + 0xc], 0x6400000
ja 0x421b9d
xor ecx, ecx
cmp dword [esp + 0xc], esi
jbe 0x421ba0
mov al, byte [ecx + edx]
add al, 0x31
xor al, 0x23
mov byte [ecx + edx], al
inc ecx
cmp ecx, dword [esp + 0xc]
jb 0x421b8a
jmp 0x421ba0
push 2
pop esi
mov eax, esi
pop esi
ret

Function at 0x421c1f
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
cmp edx, esi
je 0x421c4f
cmp dword [esp + 0xc], 0x6400000
ja 0x421c4f
xor ecx, ecx
cmp dword [esp + 0xc], esi
jbe 0x421c52
mov al, byte [ecx + edx]
xor al, 0x23
sub al, 0x31
mov byte [ecx + edx], al
inc ecx
cmp ecx, dword [esp + 0xc]
jb 0x421c3c
jmp 0x421c52
push 2
pop esi
mov eax, esi
pop esi
ret

Function at 0x422b44
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor edi, edi
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
je 0x422b94
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
jne 0x422b83
mov dword [ebp - 4], eax
jmp 0x422b86
mov eax, dword [ebp - 4]
dec eax
neg eax
sbb eax, eax
and al, 0
add eax, 0x20119
jmp 0x422b99
mov eax, 0x20019
lea ecx, [ebp - 8]
push ecx
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x422bd3
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x14]
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
je 0x422bd6
push 1
pop edi
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x4029e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x436050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [str.GR2E]
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x14], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov eax, dword [edi + 4]
sub eax, dword [edi]
xor esi, esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], eax
call fcn.0040d711
mov byte [ebp + esi - 0xc], al
inc esi
cmp esi, 8
jl 0x402a12
xorps xmm0, xmm0
movq qword [ebx], xmm0
mov dword [ebx + 8], 0
mov esi, dword [edi + 4]
sub esi, dword [edi]
add esi, 0x10
mov dword [ebx], 0
mov dword [ebp - 0x18], esi
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
je 0x402ab8
cmp esi, 0x7fffffff
ja 0x402b06
cmp esi, 0x1000
jb 0x402a8d
lea eax, [esi + 0x23]
cmp eax, esi
jbe 0x402b0b
push eax
call fcn.00409609
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x402b10
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x402a96
push esi
call fcn.00409609
add esp, 4
push dword [ebp - 0x18]
mov dword [ebx], eax
mov dword [ebx + 4], eax
add eax, esi
mov dword [ebx + 8], eax
mov esi, dword [ebx]
push 0
push esi
call fcn.0040afe0
mov eax, dword [ebp - 0x18]
add esp, 0xc
add eax, esi
mov dword [ebx + 4], eax
mov eax, dword [ebx]
xor ebx, ebx
movups xmm0, xmmword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
movups xmmword [eax], xmm0
mov eax, dword [edi + 4]
sub eax, dword [edi]
je 0x402af3
nop dword [eax]
mov eax, dword [edi]
mov ecx, ebx
and ecx, 7
mov dl, byte [ebp + ecx - 0xc]
xor dl, byte [eax + ebx]
lea eax, [ebx + 0x3f]
mov ecx, dword [esi]
xor dl, al
mov byte [ecx + ebx + 0x10], dl
inc ebx
mov ecx, dword [edi + 4]
sub ecx, dword [edi]
cmp ebx, ecx
jb 0x402ad0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004095f6
mov esp, ebp
pop ebp
ret
call fcn.004085a0
call fcn.004012c0
call fcn.004107aa
int3
Function at 0x402b20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, edx
push ebx
push esi
mov dword [ebp - 0xc], eax
mov edx, dword [eax]
mov eax, dword [eax + 4]
push edi
mov edi, ecx
sub eax, edx
mov dword [ebp - 4], edi
mov dword [ebp - 4], edi
mov dword [ebp - 4], edx
cmp eax, 0x10
jbe 0x402c3d
cmp dword [edx], 0x45325247
je 0x402b5b
push str.Invalid_encryption_signature
jmp 0x402c42
mov esi, dword [edx + 4]
add eax, 0xfffffff0
mov dword [ebp - 8], esi
cmp esi, eax
jbe 0x402b72
push str.Invalid_original_size_in_header
jmp 0x402c42
xorps xmm0, xmm0
movq qword [edi], xmm0
mov dword [edi + 8], 0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
test esi, esi
je 0x402c04
cmp esi, 0x7fffffff
ja 0x402c58
cmp esi, 0x1000
jb 0x402bd5
lea eax, [esi + 0x23]
cmp eax, esi
jbe 0x402c5d
push eax
call fcn.00409609
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x402c62
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x402bde
push esi
call fcn.00409609
add esp, 4
mov ebx, dword [ebp - 8]
mov dword [edi], eax
mov dword [edi + 4], eax
add eax, esi
push ebx
mov dword [edi + 8], eax
mov esi, dword [edi]
push 0
push esi
call fcn.0040afe0
mov edx, dword [ebp - 4]
lea eax, [esi + ebx]
add esp, 0xc
mov dword [edi + 4], eax
mov esi, ebx
xor ebx, ebx
test esi, esi
je 0x402c34
nop word [eax + eax]
mov eax, dword [ebp - 0xc]
mov ecx, ebx
and ecx, 7
mov eax, dword [eax]
mov dl, byte [ecx + edx + 8]
lea ecx, [ebx + 0x3f]
xor dl, byte [ebx + eax + 0x10]
xor dl, cl
mov ecx, dword [edi]
mov byte [ebx + ecx], dl
inc ebx
mov edx, dword [ebp - 4]
cmp ebx, esi
jb 0x402c10
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.Invalid_encrypted_file_size
lea ecx, [ebp - 0x18]
call fcn.004013d0
push 0x434f44
lea eax, [ebp - 0x18]
push eax
call fcn.0040a9f3
call fcn.004085a0
call fcn.004012c0
call fcn.004107aa
int3
Function at 0x403d90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x403e76
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x403e65
jg 0x403dd0
test edx, edx
je 0x403e65
nop dword [eax]
call fcn.00405e10
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x403e24
jg 0x403de7
test esi, esi
je 0x403e24
cmp ebx, eax
jg 0x403df7
jl 0x403df1
cmp edi, esi
jae 0x403df7
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.0040aa60
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x403e49
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x403e5f
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x403dd0
jl 0x403e5f
test edi, edi
jne 0x403dd0
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x403e98
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x403e9a
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x403f18
jg 0x403ead
test esi, esi
je 0x403f18
test eax, eax
jl 0x403efc
jg 0x403eb7
test ebx, ebx
je 0x403efc
cmp edi, eax
jg 0x403ec7
jl 0x403ec1
cmp esi, ebx
jae 0x403ec7
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.0040aa60
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x403f18
jg 0x403eff
test esi, esi
je 0x403f18
jmp 0x403eff
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x403f18
push eax
push esi
push 1
push edx
call fcn.0040f865
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x403f30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x403f62
jl 0x403f55
test ecx, ecx
jne 0x403f62
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x404022
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.00405e30
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x403fce
jg 0x403f8d
test esi, esi
je 0x403fce
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x403fa5
mov eax, dword [esp + 0x10]
jl 0x403f9f
cmp eax, esi
jae 0x403fa5
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.0040aa60
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x403fef
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x40400b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x403f74
jl 0x40400b
test ecx, ecx
jne 0x403f74
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x404061
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x404061
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.0040aa60
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x4040d0
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x404087
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
mov ecx, edi
cmp edi, 0xfff
jbe 0x4040b9
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.004101c1
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x4040e4
cmp edi, eax
ja 0x404095
test ecx, ecx
je 0x4040d0
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.004101c1
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
sbb edx, 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404450
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x436050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x404480
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004095f6
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4044bc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x4044bc
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004095f6
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x4045a4
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x4044e4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x404517
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0040d5fc
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004095f6
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x404577
sub eax, 1
je 0x404577
sub eax, 2
jne 0x4045a4
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.0040d5fc
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004095f6
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x404594
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0040f865
add esp, 0x10
cmp edi, eax
jne 0x4045a4
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x4044a7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004095f6
mov esp, ebp
pop ebp
ret 4