joyce8/EMBER2024-capa huggingface dataset:
Function at 0x143be46
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x45bef30]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x143be86
cmp byte [ebx], 0xa
jne 0x143be86
or byte [edi + eax + 0x28], 4
jmp 0x143be8b
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x143bf8a
mov dl, byte [eax]
cmp dl, 0x1a
je 0x143bf6d
inc eax
cmp dl, 0xd
je 0x143beb7
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x143bedd
cmp eax, ecx
jae 0x143beeb
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x143be9f
jmp 0x143bf8a
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x143bf68
cmp dword [ebp - 0x10], 0
je 0x143bf68
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x45bef30]
test byte [eax + edi + 0x28], 0x48
je 0x143bf42
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x143bf2d
mov byte [esi], dl
jmp 0x143bf3e
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x45bef30]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x143bf8a
cmp byte [ebp - 1], 0xa
jne 0x143bf51
cmp esi, ebx
jne 0x143bf51
mov byte [esi], 0xa
jmp 0x143bf89
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0143c9cc
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x143bf8a
mov byte [esi], 0xd
jmp 0x143bf89
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x45bef30]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x143bf87
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x143bf8a
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x143bf93
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x45bef30]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x143bfd9
cmp word [ebx], dx
jne 0x143bfd9
or byte [eax + edi + 0x28], 4
jmp 0x143bfde
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x143c141
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x143c121
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x143c01f
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x143c055
cmp eax, edx
jae 0x143c063
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x143bffa
jmp 0x143c141
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x143c11c
cmp dword [ebp - 0x18], 0
je 0x143c11c
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x45bef30]
test byte [eax + edi + 0x28], 0x48
je 0x143c0f2
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x143c0b6
mov word [esi], cx
jmp 0x143c0ed
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x45bef30]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x45bef30]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x45bef30]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x143c141
pop eax
cmp word [ebp - 4], ax
jne 0x143c102
cmp esi, ebx
jne 0x143c102
mov word [esi], ax
jmp 0x143c13e
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0143c9cc
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x143c141
push 0xd
pop eax
jmp 0x143c0fd
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x45bef30]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x143c13b
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x143c141
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x143e752
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x143e7ef
push ebx
push esi
call fcn.0143e71b
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0143e6af
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x143e79c
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x143e7ee
push edi
push eax
call fcn.014395dc
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x143e7bc
call fcn.01437c70
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x143e7ed
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0143e6af
add esp, 0x20
test eax, eax
jne 0x143e7db
push edi
call fcn.01437c70
jmp 0x143e7e3
push ebx
call fcn.01437c70
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x144125e
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.01438d89
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14412cd
cmp esi, dword [ebp - 4]
je 0x14412c8
cmp dword [ebp + 0xc], 0
je 0x14412c8
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x14412a5
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.01440db0
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x14412cf
xor eax, eax
inc eax
jmp 0x14412cf
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1441334
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x45bb068]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.01438d89
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.01438d89
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x14413ab
cmp word [ecx], dx
je 0x14413ab
mov eax, dword [0x4585234]
push edi
dec eax
push eax
push 0x4585120
call fcn.014412d3
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x144141e
cmp word [eax], dx
je 0x144141e
mov eax, dword [edi]
test eax, eax
je 0x14413cf
cmp word [eax], dx
je 0x14413cf
lea eax, [ebp - 0x10]
push eax
call fcn.01440cb6
jmp 0x14413d8
lea eax, [ebp - 0x10]
push eax
call fcn.01440d51
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1441448
mov eax, dword [0x458511c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x4584e10
call fcn.014412d3
add esp, 0xc
test al, al
je 0x1441448
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x1441413
cmp word [eax], di
je 0x1441413
lea eax, [ebp - 0x10]
push eax
call fcn.01440cb6
pop ecx
jmp 0x144144a
lea eax, [ebp - 0x10]
push eax
call fcn.01440d51
jmp 0x1441410
mov eax, dword [edi]
test eax, eax
je 0x1441435
cmp word [eax], dx
je 0x1441435
lea eax, [ebp - 0x10]
push eax
call fcn.01440c6b
pop ecx
jmp 0x1441448
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x1441513
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.01441158
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1441513
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x1441513
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x1441513
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x14414a0
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.01438284
test ebx, ebx
je 0x144150e
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.01438284
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1441513
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1441513
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.01446884
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1441515
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.014251f9
leave
ret
Function at 0x1446e36
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.01446db2
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1446fa5
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1446fa5
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1446f5a
jg 0x1446e92
test eax, eax
je 0x1446f50
push 1
push 0x1000
call fcn.01437c13
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1446eb5
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1446f47
push 0x8000
push ebx
call fcn.0143504c
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1446ede
jg 0x1446ed9
cmp ecx, 0x1000
jb 0x1446ede
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0143b39a
add esp, 0x10
cmp eax, 0xffffffff
je 0x1446f23
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1446ed9
jl 0x1446f0a
test ecx, ecx
jne 0x1446ecb
push dword [ebp - 0xc]
push ebx
call fcn.0143504c
push esi
call fcn.01437c70
add esp, 0xc
xor ebx, ebx
jmp 0x1446fb3
cmp byte [edi + 0x24], 0
je 0x1446f3a
cmp dword [edi + 0x20], 5
jne 0x1446f3a
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1446f45
mov ebx, dword [edi + 0x18]
jmp 0x1446f47
xor ebx, ebx
push esi
call fcn.01437c70
pop ecx
jmp 0x1446fb3
test ecx, ecx
jg 0x1446f1c
jl 0x1446f5a
test eax, eax
jae 0x1446f1c
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0143c9cc
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1446f7a
cmp byte [edi + 0x1c], 0
je 0x1446f1c
jmp 0x1446fab
push ebx
call fcn.0143f12e
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1446f1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1446fb3
cmp byte [edi + 0x1c], 0
je 0x1446fb0
mov ebx, dword [edi + 0x18]
jmp 0x1446fb3
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0143c9cc
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4011a0
Capabilities:
Check if file exists
Create thread
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x43a008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00409dd0
push 0x104
call fcn.0040c897
mov esi, eax
add esp, 0x10
mov ebx, 1
test esi, esi
je 0x4012fc
mov ebx, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push edi
push 0x104
push esi
call ebx
mov edi, eax
test edi, edi
je 0x4012ed
cmp edi, 0x104
jb 0x40123c
xor edx, edx
mov ecx, edi
add ecx, 0x104
setb dl
neg edx
or edx, ecx
push edx
push esi
call fcn.00411c38
add esp, 8
test eax, eax
je 0x4012ed
lea ecx, [edi + 0x104]
mov esi, eax
push ecx
push eax
call ebx
test eax, eax
je 0x4012ed
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x108]
push str._08x.exe
push eax
call fcn.004073d0
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push esi
push str.MakeRandomExePathInSystemDir:_s_n
call fcn.004013a0
add esp, 8
push esi
xor bl, bl
mov dword [ebp - 0x10c], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4012f6
push 0
lea eax, [ebp - 0x10c]
push eax
push 0x400
push 0x43aa70
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4012d9
cmp dword [ebp - 0x10c], 0x400
mov eax, 1
movzx ebx, bl
cmove ebx, eax
test edi, edi
je 0x4012e9
cmp edi, 0xffffffff
je 0x4012e9
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x4012f6
push esi
call fcn.0040c87c
add esp, 4
mov ebx, 1
pop edi
push 0x2c67
push 0x436a8c
push 2
call fcn.004074f0
add esp, 0xc
call fcn.00404240
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0
push eax
push 0
push str.155.15.133.69
push 0x404510
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x40134f
push 0x436bd0
call fcn.004013a0
add esp, 4
jmp 0x401356
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x6f74
push 0x436a8c
push 2
call fcn.004074f0
push str.pause
call fcn.0040c871
mov ecx, dword [ebp - 4]
add esp, 0x10
mov eax, ebx
xor ecx, ebp
pop esi
pop ebx
call fcn.00407ba2
mov esp, ebp
pop ebp
ret
Function at 0x4022a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x402386
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x402375
jg 0x4022e0
test edx, edx
je 0x402375
nop dword [eax]
call fcn.004036b0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x402334
jg 0x4022f7
test esi, esi
je 0x402334
cmp ebx, eax
jg 0x402307
jl 0x402301
cmp edi, esi
jae 0x402307
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.00409f70
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x402359
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x40236f
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x4022e0
jl 0x40236f
test edi, edi
jne 0x4022e0
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4023a8
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x4023aa
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x402428
jg 0x4023bd
test esi, esi
je 0x402428
test eax, eax
jl 0x40240c
jg 0x4023c7
test ebx, ebx
je 0x40240c
cmp edi, eax
jg 0x4023d7
jl 0x4023d1
cmp esi, ebx
jae 0x4023d7
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.00409f70
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x402428
jg 0x40240f
test esi, esi
je 0x402428
jmp 0x40240f
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x402428
push eax
push esi
push 1
push edx
call fcn.0041104e
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402440
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x402472
jl 0x402465
test ecx, ecx
jne 0x402472
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x402532
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.004036d0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x4024de
jg 0x40249d
test esi, esi
je 0x4024de
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x4024b5
mov eax, dword [esp + 0x10]
jl 0x4024af
cmp eax, esi
jae 0x4024b5
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.00409f70
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x4024ff
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x40251b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x402484
jl 0x40251b
test ecx, ecx
jne 0x402484
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x402571
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x402571
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.00409f70
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x4025e0
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x402597
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
mov ecx, edi
cmp edi, 0xfff
jbe 0x4025c9
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.004116a5
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x4025f4
cmp edi, eax
ja 0x4025a5
test ecx, ecx
je 0x4025e0
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.004116a5
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
sbb edx, 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402960
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x43a008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x402990
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407ba2
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4029cc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x4029cc
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407ba2
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x402ab4
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x4029f4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x402a27
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.00410166
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407ba2
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x402a87
sub eax, 1
je 0x402a87
sub eax, 2
jne 0x402ab4
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.00410166
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407ba2
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x402aa4
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0041104e
add esp, 0x10
cmp edi, eax
jne 0x402ab4
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x4029b7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407ba2
mov esp, ebp
pop ebp
ret 4