joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d1af
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x458160]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x42d1ef
cmp byte [ebx], 0xa
jne 0x42d1ef
or byte [edi + eax + 0x28], 4
jmp 0x42d1f4
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x42d2f3
mov dl, byte [eax]
cmp dl, 0x1a
je 0x42d2d6
inc eax
cmp dl, 0xd
je 0x42d220
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x42d246
cmp eax, ecx
jae 0x42d254
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x42d208
jmp 0x42d2f3
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42d2d1
cmp dword [ebp - 0x10], 0
je 0x42d2d1
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x458160]
test byte [eax + edi + 0x28], 0x48
je 0x42d2ab
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x42d296
mov byte [esi], dl
jmp 0x42d2a7
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x458160]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x42d2f3
cmp byte [ebp - 1], 0xa
jne 0x42d2ba
cmp esi, ebx
jne 0x42d2ba
mov byte [esi], 0xa
jmp 0x42d2f2
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0042c6c6
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x42d2f3
mov byte [esi], 0xd
jmp 0x42d2f2
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x458160]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x42d2f0
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x42d2f3
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x42d2fc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x458160]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x42d342
cmp word [ebx], dx
jne 0x42d342
or byte [eax + edi + 0x28], 4
jmp 0x42d347
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x42d4aa
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x42d48a
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x42d388
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x42d3be
cmp eax, edx
jae 0x42d3cc
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x42d363
jmp 0x42d4aa
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42d485
cmp dword [ebp - 0x18], 0
je 0x42d485
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x458160]
test byte [eax + edi + 0x28], 0x48
je 0x42d45b
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x42d41f
mov word [esi], cx
jmp 0x42d456
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x458160]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x458160]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x458160]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x42d4aa
pop eax
cmp word [ebp - 4], ax
jne 0x42d46b
cmp esi, ebx
jne 0x42d46b
mov word [esi], ax
jmp 0x42d4a7
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0042c6c6
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x42d4aa
push 0xd
pop eax
jmp 0x42d466
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x458160]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x42d4a4
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x42d4aa
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x42ef7d
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x454dc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x42efc0
call fcn.00424073
mov dword [eax], 0xf
call fcn.00424086
mov dword [eax], 0xd
call fcn.00430687
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c931
leave
ret
test eax, eax
jne 0x42efc7
inc eax
jmp 0x42efb4
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x42efb2
xor eax, eax
cmp ecx, 1
setne al
jmp 0x42efb4

Function at 0x4309d6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x443794
push 0x44378c
push str.FlsAlloc
push 0x1f
call fcn.00430895
mov esi, eax
add esp, 0x10
test esi, esi
je 0x430a0a
push dword [ebp + 8]
mov ecx, esi
call dword [0x441238]
call esi
jmp 0x430a10
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x430a54
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4437a4
push 0x44379c
push str.FlsGetValue
push 0x21
call fcn.00430895
mov esi, eax
add esp, 0x10
test esi, esi
je 0x430a8b
push dword [ebp + 8]
mov ecx, esi
call dword [0x441238]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x430a93
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4437ac
push 0x4437a4
push str.FlsSetValue
push 0x22
call fcn.00430895
mov esi, eax
add esp, 0x10
test esi, esi
je 0x430acd
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x441238]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4390c4
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x439161
push ebx
push esi
call fcn.0043908d
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0043757e
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x43910e
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x439160
push edi
push eax
call fcn.004311c4
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x43912e
call fcn.00430728
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x43915f
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0043757e
add esp, 0x20
test eax, eax
jne 0x43914d
push edi
call fcn.00430728
jmp 0x439155
push ebx
call fcn.00430728
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x439164
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x439175
pop esi
ret
push ebx
push edi
push esi
call fcn.0043908d
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.004311c4
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x43919d
push ebx
push esi
push edi
call fcn.0041ece0
add esp, 0xc
push 0
call fcn.00430728
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x4398f7
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00439412
Function at 0x43ab59
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0043aad5
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x43acc8
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x43acc8
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x43ac7d
jg 0x43abb5
test eax, eax
je 0x43ac73
push 1
push 0x1000
call fcn.004306cb
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x43abd8
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x43ac6a
push 0x8000
push ebx
call fcn.0042b2f5
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x43ac01
jg 0x43abfc
cmp ecx, 0x1000
jb 0x43ac01
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0042e419
add esp, 0x10
cmp eax, 0xffffffff
je 0x43ac46
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x43abfc
jl 0x43ac2d
test ecx, ecx
jne 0x43abee
push dword [ebp - 0xc]
push ebx
call fcn.0042b2f5
push esi
call fcn.00430728
add esp, 0xc
xor ebx, ebx
jmp 0x43acd6
cmp byte [edi + 0x24], 0
je 0x43ac5d
cmp dword [edi + 0x20], 5
jne 0x43ac5d
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x43ac68
mov ebx, dword [edi + 0x18]
jmp 0x43ac6a
xor ebx, ebx
push esi
call fcn.00430728
pop ecx
jmp 0x43acd6
test ecx, ecx
jg 0x43ac3f
jl 0x43ac7d
test eax, eax
jae 0x43ac3f
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0042c6c6
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x43ac9d
cmp byte [edi + 0x1c], 0
je 0x43ac3f
jmp 0x43acce
push ebx
call fcn.004372aa
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x43ac3f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x43acd6
cmp byte [edi + 0x1c], 0
je 0x43acd3
mov ebx, dword [edi + 0x18]
jmp 0x43acd6
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0042c6c6
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4402c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4402ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4402ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x431001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x30e24dab
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..reloc
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x48ce3967
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x41aef4
Capabilities:
Encode data using xor

Disassembly:
inc edx
movsx edi, bl
push 0xb0792c
ja 0x41aebe
imul ebx, ebp
cmp eax, 0xc43e
jae 0x41aece
dec ecx
dec eax
xchg ah, ch
test ebx, eax
not bl
and al, 0x46
call 0x41aef4
add al, 0x48
jno 0x41aeec
xor ah, 0xa2
mov edi, 0xcd1b05a1
movsx esi, dh
and eax, 0x75baed35
mov edi, edi
xor ebp, eax
and ecx, 0xffa7a12f
pop edi
jae 0x41aefa
movzx esi, di
bswap eax
test ecx, 0xf6aa42ef
cmp ebp, eax
movd mm1, edi
movd edx, mm1
mov bl, 0x29
sub eax, 0x8edc8d95
imul ebp, ebx, 0xc10e7862
add edx, 0x1e268
sub edx, 0xd0aa
lea ecx, [0x85c0a59]
lea edi, [0x3ac4a39b]
mov eax, ecx
test edx, 0xe96ad1fa
xor ebx, 0x5c95
dec cl
adc eax, 0x79fb1d6f
mov cl, dh
movzx esi, si
jmp 0x41af50
lea edi, [0xc9]
sub cl, 0xa7
add edi, 0xbc5
test ebx, ecx
bswap ebp
xor al, 0xb
sub edi, 0x77c
add edi, 0x77b
sbb al, 0x40
test ch, 0xa5
cmp edi, 0x205
jae 0x41af5f
movzx esi, ax
jae 0x41af93
adc ah, ah
test ecx, edi
lea esi, [0x62285865]
lea ebp, [0x1808adf5]
push edx
cmp edi, 0x5758
jae 0x41afa2
imul eax, eax, 0x662b895b
lea edi, [0xb526963b]
imul esi, edi
add ebp, 0xfdf30
jmp 0x41afb5
sub ebp, 0xfb3f9
mov ah, 0xa4
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x59096db2
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0xf8c201d
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x431a4d
Capabilities:
Encode data using xor

Disassembly:
inc edx
outsb dx, byte [esi]
push edi
arpl word [eax - 0x79], si
xchg ecx, eax
xchg edx, eax
in al, dx
or edx, ebx
pushfd
pop ss
jecxz fcn.004319e5
xor esi, edi
sahf
fcomp qword [edi - 0x68]
invalid
push cs
pop es

Function at 0x4ad7d9
Capabilities:
Encode data using xor

Disassembly:
lcall 0xfc9b, 0x2c3f2a23
and ebp, dword [edx]
aas
sub al, 0x9b
cld
das
cmpsw word [esi], word es:[edi]
mov dword [0xf32cd1ed], eax
xor eax, 0x94d3b085
popal
pop es
jl 0x4ad7da
fiadd word [esi + 0x3666ef22]
ret

Function at 0x4c7f91
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4d23e8
cmp edx, dword [eax]
je 0x4c7fb3
add eax, 8
inc ecx
cmp eax, 0x4d2478
jl 0x4c7fa4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4d23e8]
jne 0x4c80e1
mov eax, dword [0x4d7e10]
cmp eax, 1
je 0x4c80bb
test eax, eax
jne 0x4c7fe4
cmp dword [0x4d2310], 1
je 0x4c80bb
cmp edx, 0xfc
je 0x4c80e1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c801b
lea eax, [ebp - 0x1a4]
push 0x4cddd0
push eax
call fcn.004c8970
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c8e00
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c805e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c8e00
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4cddcc
push edi
call fcn.004cacd0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4cddb0
push eax
call fcn.004c8970
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c8980
lea eax, [ebp - 0xa0]
push 0x4cddac
push eax
call fcn.004c8980
push dword [esi + 0x4d23ec]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c8980
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4cdd84
push eax
call fcn.004cac44
add esp, 0x2c
pop edi
jmp 0x4c80e1
lea eax, [ebp + 8]
lea esi, [esi + 0x4d23ec]
push 0
push eax
push dword [esi]
call fcn.004c8e00
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401720
Capabilities:
Write file on windows

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff8
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
mov ebx, edx
sub esp, 0x40
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x401918
mov edx, eax
lea esi, [ebp - 0x1c]
cmp ebx, 0x11
je 0x4018c0
mov eax, dword [0x423724]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x30], edx
mov dword [esp + 0xc], esi
mov esi, dword [sym.imp.user32.dll_SendMessageW]
mov dword [ebp - 0x14], sym._stream_out_16
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x44a
mov dword [esp], eax
call esi
mov edx, dword [ebp - 0x30]
sub esp, 0x10
mov dword [ebp - 0x2c], eax
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [0x423724]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.user32.dll_SetFocus]
mov ecx, dword [ebp - 0x2c]
sub esp, 4
test ecx, ecx
je 0x401880
xor eax, eax
lea esi, [esi]
nop
movzx edx, word [edi + eax]
add eax, 2
mov word [eax + 0x4234fe], dx
test dx, dx
jne 0x4017f0
mov eax, 0x423500
call sym._set_caption
mov eax, dword [0x423724]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xb9
mov dword [esp], eax
call esi
mov dword [0x40f284], ebx
sub esp, 0x10
call sym._set_bar_states
call sym._set_default_font
mov eax, dword [0x40f284]
mov dword [esp], eax
call sym._reg_formatindex
mov eax, dword [eax*4 + 0x423710]
mov dword [esp + 4], eax
mov eax, dword [0x423728]
mov dword [esp], eax
call sym._target_device
mov ecx, 1
lea esp, [ebp - 0xc]
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
xor eax, eax
mov edx, 0x4b0
mov dword [esp + 0xc], 0
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
mov dword [esp + 8], eax
mov eax, dword [0x423724]
mov dword [ebp - 0x24], edx
mov dword [esp + 4], 0x45f
mov dword [esp], eax
call esi
mov ecx, dword [ebp - 0x2c]
sub esp, 0x10
test eax, eax
je 0x4017e9
jmp 0x40186c
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 2
mov dword [esp + 4], 0x411c86
mov dword [esp], eax
mov dword [ebp - 0x2c], eax
call dword [sym.imp.kernel32.dll_WriteFile]
mov edx, dword [ebp - 0x2c]
sub esp, 0x14
cmp dword [ebp - 0x1c], 2
je 0x40178b
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_CloseHandle]
xor ecx, ecx
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 5
mov dword [esp + 0xc], 0x30
sete al
mov dword [esp + 8], 0x411758
movzx eax, al
add eax, 0x6ab
mov dword [esp + 4], eax
mov eax, dword [0x423728]
mov dword [esp], eax
call dword [sym.imp.user32.dll_MessageBoxW]
xor ecx, ecx
sub esp, 0x10
jmp 0x40186c
Function at 0x407be0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov edi, dword [0x4237d4]
mov esi, dword [ebp + 8]
test edi, edi
je 0x407da0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x4237d4]
movzx eax, al
bt eax, esi
jae 0x407e00
mov ecx, dword [0x4237c4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x407ca5
test byte [0x40f290], 8
jne 0x407d40
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x40f2a0], 8
jne 0x407cf0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf_1
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x407c74
cmp esi, 3
jbe 0x407cb0
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x418760]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x407c74
mov ecx, dword [0x4237d4]
test ecx, ecx
je 0x407de0
mov dword [esp], 0x40f2a0
call dword [0x4237d4]
test al, 8
je 0x407c4b
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf_1
add edi, eax
jmp 0x407c4b
mov ebx, dword [0x4237d4]
test ebx, ebx
je 0x407dc0
mov dword [esp], 0x40f290
call dword [0x4237d4]
test al, 8
je 0x407c36
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf_1
lea edi, [ebx + eax]
jmp 0x407c3e
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4237d4
call sym._load_func.part.0
jmp 0x407bfd
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4237d4
call sym._load_func.part.0
jmp 0x407d4a
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4237d4
call sym._load_func.part.0
jmp 0x407cfe
mov eax, 0xffffffff
jmp 0x407ca5
Function at 0x407e10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x407e68
cmp byte [esi + ebx - 1], 0xa
je 0x407e3c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4237c4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret