joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a30
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x44c
test eax, eax
push ebx
push ebp
push esi
push edi
je 0x401b9d
lea eax, [esp + 0x10]
push 0x21
push eax
call fcn.00411010
add esp, 8
test eax, eax
jne 0x401a71
push str.Unable_to_find_IE_cookie_folder
call fcn.00410250
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44c
ret
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x10]
push ecx
call esi
cmp eax, 1
jge 0x401a9b
push str.Bad_IE_cookie_folder_name
call fcn.00410250
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44c
ret
lea edx, [esp + 0x10]
push edx
call esi
mov cl, byte [esp + eax + 0xf]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp cl, 0x5c
je 0x401abd
lea eax, [esp + 0x10]
push 0x42f444
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x114]
push ecx
push edx
call ebx
lea eax, [esp + 0x114]
push str..txt
push eax
call edi
lea ecx, [esp + 0x114]
push ecx
push str.Searching_for_Gators_IE_cookie_using_mask:__s
call fcn.00410250
add esp, 8
lea edx, [esp + 0x218]
lea eax, [esp + 0x114]
mov esi, 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x401b9d
lea ecx, [esp + 0x244]
push ecx
call fcn.00429866
lea edx, [esp + 0x248]
push str._gator
push edx
call fcn.0041e940
add esp, 0xc
test eax, eax
je 0x401b7f
lea eax, [esp + 0x10]
lea ecx, [esp + 0x358]
push eax
push ecx
call ebx
lea edx, [esp + 0x244]
lea eax, [esp + 0x358]
push edx
push eax
call edi
mov ecx, dword [esp + 0x464]
lea edx, [esp + 0x358]
push ecx
push edx
call dword [esp + 0x468]
add esp, 8
mov esi, eax
test esi, esi
je 0x401b96
lea eax, [esp + 0x218]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401b1c
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44c
ret

Function at 0x401e40
Capabilities:
Delete file

Disassembly:
sub esp, 0x20c
push 0
push 0x401f00
call fcn.00401a30
lea eax, [esp + 0x110]
push eax
call fcn.00401310
add esp, 0xc
test eax, eax
je 0x401ef3
lea ecx, [esp + 0x108]
lea edx, [esp + 4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
push 0x80
push 2
push 0
push 0
lea ecx, [esp + 0x18]
push 0x40000000
push ecx
mov byte [esp + eax + 0x1f], 0x32
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x401ef3
lea edx, [esp]
push edx
push 0x401d50
call fcn.004011d0
mov eax, dword [esp + 8]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x108]
lea eax, [esp + 4]
push edx
push eax
call fcn.0041ef8b
add esp, 8
add esp, 0x20c
ret
Function at 0x402a20
Capabilities:
Encrypt data using blowfish

Disassembly:
sub esp, 8
mov ecx, 0x412
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
mov esi, 0x42f5c0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x1c]
cmp ecx, 0x48
jle 0x402a46
mov ecx, 0x48
mov edi, dword [esp + 0x20]
push ebp
mov eax, edi
mov ebp, ebx
lea esi, [ecx + edi]
mov dword [esp + 0x1c], 0x12
xor ecx, ecx
mov cl, byte [eax]
inc eax
cmp eax, esi
jb 0x402a65
mov eax, edi
xor edx, edx
mov dl, byte [eax]
shl ecx, 8
or ecx, edx
inc eax
cmp eax, esi
jb 0x402a75
mov eax, edi
xor edx, edx
mov dl, byte [eax]
shl ecx, 8
or ecx, edx
inc eax
cmp eax, esi
jb 0x402a85
mov eax, edi
xor edx, edx
mov dl, byte [eax]
shl ecx, 8
or ecx, edx
inc eax
cmp eax, esi
jb 0x402a95
mov eax, edi
mov edx, dword [ebp]
add ebp, 4
xor edx, ecx
mov ecx, dword [esp + 0x1c]
mov dword [ebp - 4], edx
dec ecx
mov dword [esp + 0x1c], ecx
jne 0x402a5a
xor eax, eax
mov esi, ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov edi, 9
pop ebp
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.00401fe0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
add esp, 8
add esi, 8
dec edi
jne 0x402abd
lea esi, [ebx + 0x48]
mov edi, 0x200
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.00401fe0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
add esp, 8
add esi, 8
dec edi
jne 0x402ae6
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x405550
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [0x43795c]
sub esp, 0x1c4
test eax, eax
push esi
je 0x40556d
mov eax, 1
pop esi
add esp, 0x1c4
ret
lea eax, [esp + 0x38]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x40563c
push edi
push eax
mov dword [0x43795c], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
mov ecx, 0xc
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push ecx
push str.GatorAsyncWndClass
push esi
call dword [sym.imp.USER32.dll_GetClassInfoExA]
test eax, eax
pop edi
jne 0x4055e7
lea edx, [esp + 8]
mov dword [esp + 8], 0x30
push edx
mov dword [esp + 0x14], 0x405670
mov dword [esp + 0x20], esi
mov dword [esp + 0x34], str.GatorAsyncWndClass
call dword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
je 0x40563c
mov byte [0x437a1c], 0
lea eax, [esp + 4]
push 0
push eax
push str.GetHostByNameTimeout
push str.softwareGator.comGatordyn
push reloc.WSOCK32.dll_bind
mov dword [esp + 0x18], 0
call fcn.00410440
add esp, 0x14
test eax, eax
je 0x405625
mov eax, dword [esp + 4]
test eax, eax
mov dword [0x430748], eax
jne 0x40562f
mov dword [0x430748], 0x14
mov eax, dword [0x43795c]
pop esi
add esp, 0x1c4
ret
xor eax, eax
pop esi
add esp, 0x1c4
ret
Function at 0x4056f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x424
push ebp
mov ebp, dword [esp + 0x42c]
push esi
mov esi, ebp
cmp byte [ebp], 0
je 0x405724
movsx eax, byte [esi]
push eax
call fcn.0041f47d
add esp, 4
test eax, eax
jne 0x40571c
cmp byte [esi], 0x2e
jne 0x405732
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x405707
pop esi
mov eax, 1
pop ebp
add esp, 0x424
ret
call fcn.00405550
test eax, eax
jne 0x405744
pop esi
pop ebp
add esp, 0x424
ret
xor esi, esi
push ebx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push closesocket
push str.GatorAsyncWnd
push str.GatorAsyncWndClass
push esi
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ebx, eax
test ebx, ebx
je 0x40587c
push edi
lea ecx, [esp + 0x34]
push 0x400
push ecx
push ebp
push 0x43e
push ebx
call sub.WSOCK32.dll_WSAAsyncGetHostByName
test eax, eax
mov dword [esp + 0x10], eax
je 0x405874
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x430748]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
lea edx, [ecx + ecx*4]
lea eax, [eax + edx*8]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [esp + 0x14], eax
jbe 0x405866
push 1
push 0
push 0
lea ecx, [esp + 0x24]
push ebx
push ecx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x405839
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [esp + 0x1c], 0x43e
jne 0x405839
mov ecx, dword [esp + 0x24]
shr ecx, 0x10
test cx, cx
jne 0x405839
mov edx, dword [esp + 0x40]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
call sub.WSOCK32.dll_inet_ntoa
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
mov al, byte [0x437a1c]
test al, al
jne 0x405866
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x4057b5
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
mov eax, esi
pop ebx
pop esi
pop ebp
add esp, 0x424
ret
test esi, esi
jne 0x405874
mov eax, dword [esp + 0x10]
push eax
call sub.WSOCK32.dll_WSACancelAsyncRequest
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
mov eax, esi
pop ebx
pop esi
pop ebp
add esp, 0x424
ret
Function at 0x405ff0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebx, ecx
push 0
push ebx
call fcn.00406bd0
add esp, 8
mov ecx, ebx
push str.send
push 0
push 1
call fcn.00406b70
test eax, eax
jne 0x40601c
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov ebp, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
test ebp, ebp
jge 0x406036
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
mov edi, edx
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x20]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
lea edx, [eax + ecx*8]
mov dword [esp + 0x14], edx
mov eax, dword [ebx]
push 0
push ebp
push edi
push eax
call sub.WSOCK32.dll_send
mov esi, eax
cmp esi, 0xffffffff
je 0x406099
mov ecx, dword [esp + 0x18]
add ecx, esi
test esi, esi
mov dword [esp + 0x18], ecx
jle 0x406093
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x20]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
lea edx, [eax + ecx*8]
mov dword [esp + 0x14], edx
add edi, esi
sub ebp, esi
jmp 0x4060af
mov ecx, ebx
call fcn.00406b60
cmp eax, 0x2733
jne 0x4060ca
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
test ebp, ebp
je 0x4060f9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [esp + 0x14]
ja 0x4060e2
mov al, byte [0x437a1c]
test al, al
jne 0x4060f9
jmp 0x406059
push eax
push str.Send_failed___d_.
push ebx
call fcn.00406bd0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 8
push str.Send_timed_out.
push ebx
call fcn.00406bd0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov dl, byte [0x437a1c]
pop edi
test dl, dl
sete al
pop esi
pop ebp
and eax, 0xff
pop ebx
ret 8
Function at 0x4067c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x10
push ebx
push esi
xor esi, esi
mov ebx, ecx
push esi
push ebx
call fcn.00406bd0
mov eax, dword [ebx + 8]
add esp, 8
cmp eax, esi
jne 0x4067f4
push str.retrieve_file_headers
push 1
push 1
mov ecx, ebx
call fcn.00406b70
test eax, eax
jne 0x4067f4
pop esi
pop ebx
add esp, 0x10
ret
mov eax, dword [ebx + 8]
push ebp
cmp eax, esi
push edi
jne 0x406934
push 0x2000
call fcn.00405bc0
mov dword [ebx + 8], eax
add esp, 4
mov byte [eax], 0
mov dword [esp + 0x10], esi
xor ebp, ebp
mov dword [esp + 0x14], esi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [ebx + 0x24]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
lea edx, [eax + ecx*8]
mov eax, dword [esp + 0x10]
test eax, eax
mov dword [esp + 0x1c], edx
jne 0x406926
cmp esi, 0x2000
jae 0x4068bf
test ebp, ebp
jne 0x4068c3
mov eax, 0x2000
sub eax, esi
cmp eax, 0x80
jbe 0x406864
mov eax, 0x80
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
mov ecx, dword [ebx + 8]
push edx
push eax
mov eax, esi
add eax, ecx
mov ecx, ebx
push eax
call fcn.00406990
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
add esi, eax
test ecx, ecx
jne 0x4068a4
test eax, eax
jne 0x4068a4
call edi
cmp eax, dword [esp + 0x1c]
ja 0x40691e
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebx + 8]
push str._r_n_r_n
push ecx
call fcn.0041e940
mov ebp, eax
mov eax, dword [esp + 0x18]
add esp, 8
test eax, eax
je 0x406845
test ebp, ebp
je 0x406926
mov ecx, ebx
mov byte [ebp], 0
call fcn.00406110
cmp eax, 0x64
jne 0x40693f
mov edx, dword [ebx + 8]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
sub esi, ecx
sub esi, 4
mov eax, esi
je 0x406904
mov ecx, eax
mov edi, edx
mov edx, ecx
lea esi, [ebp + 4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, eax
jmp 0x406909
xor esi, esi
mov byte [edx], 0
mov eax, dword [esp + 0x14]
xor ebp, ebp
inc eax
cmp eax, 2
mov dword [esp + 0x14], eax
jge 0x406934
jmp 0x40681e
mov dword [esp + 0x10], 1
push str.Reply_contains_no_headers.
push ebx
call fcn.00406bd0
add esp, 8
mov eax, dword [ebx + 8]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x10
ret
mov edi, dword [ebx + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
sub esi, ecx
add esi, 0xfffffffc
test esi, esi
mov dword [ebx + 0x10], esi
je 0x406934
push esi
call fcn.00405bc0
mov ecx, dword [ebx + 0x10]
mov dword [ebx + 0xc], eax
mov edi, eax
mov eax, ecx
lea esi, [ebp + 4]
add esp, 4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 8]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x406990
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push 0
push ebp
mov dword [esp + 0x18], 0
call fcn.00406bd0
add esp, 8
mov ecx, ebp
push str.read_file
push 1
push 1
call fcn.00406b70
test eax, eax
jne 0x4069c6
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov dword [ebx], 0
mov dword [edi], 0
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x406a93
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x406a93
mov eax, dword [esp + 0x1c]
cmp eax, ecx
jb 0x406a30
mov edi, dword [esp + 0x18]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebx], ecx
mov edx, dword [ebp + 0xc]
push edx
mov dword [ebp + 0x10], esi
call fcn.0041e9c0
add esp, 4
mov dword [ebp + 0xc], esi
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov edi, dword [esp + 0x18]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx], eax
mov ebx, dword [ebp + 0x10]
sub ebx, eax
push ebx
call fcn.00405bc0
mov esi, dword [ebp + 0xc]
mov edi, dword [esp + 0x20]
mov ecx, ebx
add esi, edi
mov dword [esp + 0x1c], eax
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0041e9c0
mov edx, dword [esp + 0x20]
add esp, 8
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], ebx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret 0x10
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [ebp]
push 0
push eax
push ecx
push edx
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x406ae4
mov ecx, ebp
call fcn.00406b60
cmp eax, 0x2733
je 0x406ad2
push eax
push str.Recv_failed___d_
push ebp
mov dword [edi], 1
call fcn.00406bd0
add esp, 0xc
jmp 0x406b01
push 0xa
mov dword [esp + 0x14], 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x406b14
test eax, eax
jle 0x406af4
mov dword [ebx], eax
mov dword [esp + 0x10], 1
jmp 0x406b14
mov ecx, ebp
mov dword [edi], 1
call fcn.00406b60
cmp dword [edi], 0
jne 0x406b14
push str.No_data_was_received
push ebp
call fcn.00406bd0
add esp, 8
mov al, byte [0x437a1c]
test al, al
je 0x406b37
mov dword [edi], 1
pop edi
mov dword [esp + 0xc], 0
pop esi
mov eax, dword [esp + 8]
pop ebp
pop ebx
pop ecx
ret 0x10
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x406b45
mov dword [edi], 1
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x4074f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebp
xor ebp, ebp
push esi
test eax, eax
push edi
mov dword [esp + 0xc], ebp
je 0x407504
mov dword [eax], ebp
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4075df
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
mov dword [esp + 0x18], edi
je 0x4075df
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x4075d0
lea ecx, [esp + 0x18]
push ecx
push ebx
call fcn.004073e0
mov ebp, dword [esp + 0x2c]
add esp, 8
test ebp, ebp
mov esi, eax
je 0x407577
cmp dword [ebp], 0
je 0x407574
test esi, esi
je 0x40756f
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov esi, dword [ebp]
jmp 0x407577
mov dword [ebp], esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4075b5
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push esi
push ebx
push edi
call fcn.00407620
mov edx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
mov dword [edx], eax
je 0x4075a6
mov dword [esp + 0x10], 1
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edi, dword [esp + 0x1c]
jmp 0x4075bd
mov dword [esp + 0x10], 1
test ebp, ebp
jne 0x4075cc
test esi, esi
je 0x4075cc
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ebp, dword [esp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
pop edi
mov eax, ebp
pop esi
pop ebp
pop ecx
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ecx
ret

Function at 0x407d00
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov ebp, dword [esp + 0x3c]
mov byte [ebp + 0xf], al
shr eax, 8
mov byte [ebp + 0xe], al
shr eax, 8
mov byte [ebp + 0xd], al
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x2c]
shr edi, 0xc
lea edx, [esp + 0x10]
shl edi, 0xc
shr ecx, 0xc
push edx
add edi, ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
shl ebx, 0xa
add ebx, eax
call esi
mov esi, eax
mov al, byte [0x437a28]
add esi, ebx
add esi, edi
test al, al
jne 0x407d72
push esi
call fcn.0041fdb3
add esp, 4
mov byte [0x437a28], 1
call fcn.0041fdc0
mov dword [esp + 0x3c], eax
call fcn.0041fdc0
mov ebx, eax
mov eax, esi
and eax, 0xff
add eax, 0xa
test eax, eax
jle 0x407da3
mov edi, eax
call fcn.0041fdc0
dec edi
mov ebx, eax
jne 0x407d99
push 0
call fcn.0041ecbd
add esp, 4
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, edi
add esi, eax
call fcn.0041fdc0
and esi, 0xff
add esi, 0xa
test esi, esi
jle 0x407dd3
call fcn.0041fdc0
dec esi
jne 0x407dcb
mov cl, byte [esp + 0x3c]
or al, 0x80
pop edi
mov byte [ebp + 0xc], cl
mov byte [ebp + 0xb], bl
mov byte [ebp + 0xa], al
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x4083b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
call fcn.00409040
mov esi, dword [esp + 0x24]
xor eax, eax
mov ecx, esi
mov edi, dword [esp + 0x20]
xor ebx, ebx
mov dword [ecx], eax
test edi, edi
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
jl 0x4084c1
push 2
push eax
push edi
call fcn.00423e77
add esp, 0xc
cmp eax, 0xffffffff
je 0x4084a3
cmp eax, 0x14
jbe 0x408485
push 2
push 0xffffffffffffffec
push edi
call fcn.00423e77
add esp, 0xc
test eax, eax
jl 0x408470
push 0x14
push esi
push edi
call fcn.0041f817
add esp, 0xc
cmp eax, 0x14
jne 0x408461
mov eax, dword [esi]
mov ecx, dword [0x43127c]
cmp ecx, eax
jne 0x408459
mov eax, dword [esi + 8]
cmp eax, 0x1000000
jne 0x408451
mov eax, dword [esi + 4]
cmp eax, 0x14
jne 0x408449
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret
push eax
push str.ReadFooter:_wrong_size
jmp 0x40847d
push eax
push str.ReadFooter:_wrong_version
jmp 0x40847d
push eax
push str.ReadFooter:_magic_header_unknown
jmp 0x40847d
call fcn.0041fecb
mov edx, dword [eax]
push edx
push str.ReadFooter:_no_read_footer
jmp 0x40847d
call fcn.0041fecb
mov eax, dword [eax]
push eax
push str.ReadFooter:_no_seek_to_footer
call fcn.00409020
add esp, 8
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4084d0
lea ecx, [esp + 0xc]
push esi
push ecx
push edi
call fcn.004084e0
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x10
ret
call fcn.0041fecb
mov edx, dword [eax]
push edx
push str.ReadFooter:_no_get_eof
call fcn.00409020
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
push 0xffffffffffffffff
push 0x431284
call fcn.00409020
add esp, 8
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x408640
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00409040
mov esi, dword [esp + 0x28]
xor eax, eax
mov ecx, esi
mov edi, dword [esp + 0x24]
xor ebx, ebx
mov dword [ecx], eax
test edi, edi
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
jl 0x408772
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0xc]
push edx
push eax
push edi
call fcn.004083b0
add esp, 0xc
test eax, eax
je 0x40875a
mov ecx, dword [esp + 0x1c]
push ebx
push ecx
push edi
call fcn.00423e77
add esp, 0xc
test eax, eax
jl 0x40873c
push 0x10
push esi
push edi
call fcn.0041f817
add esp, 0xc
cmp eax, 0x10
jne 0x40871e
mov eax, dword [esi]
mov ecx, dword [str.GXBHGXBFGXBCReadFooter:_no_file_given]
cmp ecx, eax
jne 0x408707
mov eax, dword [esi + 8]
cmp eax, 0x1000000
jne 0x4086f0
mov esi, dword [esi + 4]
cmp esi, 0x10
jne 0x4086d9
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x14
ret
push esi
push str.ReadHeader:_wrong_size
call fcn.00409020
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
push eax
push str.ReadHeader:_wrong_version
call fcn.00409020
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
push eax
push str.ReadHeader:_magic_header_unknown
call fcn.00409020
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
call fcn.0041fecb
mov edx, dword [eax]
push edx
push str.ReadHeader:_no_read_header
call fcn.00409020
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
call fcn.0041fecb
mov eax, dword [eax]
push eax
push str.ReadHeader:_no_seek_to_header
call fcn.00409020
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
push 0xffffffffffffffff
push str.ReadHeader:_no_read_footer
call fcn.00409020
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
push 0xffffffffffffffff
push str.ReadHeader:_no_file_given
call fcn.00409020
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x14
ret