joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4013ca
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x40a1ac], 1
mov dword [0x40a1b0], 1
mov dword [0x40a1b4], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40140b
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40142e
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401450
cmp eax, 0x20b
je 0x401475
jmp 0x4014a0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401462
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014a5
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x40148d
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014a5
mov eax, 0
leave
ret

Function at 0x401670
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x44
lea edx, [ebp - 0x34]
mov eax, 0
mov ecx, 0xa
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_RegisterClassA]
call eax
sub esp, 4
mov word [ebp - 0xa], ax
cmp word [ebp - 0xa], 0
jne 0x4016e4
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Error
mov dword [esp + 4], str.Failed_to_register_window_class
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
mov dword [esp], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
movzx eax, word [ebp - 0xa]
mov edi, dword [ebp - 4]
leave
ret
Function at 0x4016ed
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x368
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov edx, eax
lea eax, [ebp - 0x110]
add eax, edx
mov dword [eax], 0x2a2e2a5c
mov byte [eax + 4], 0
lea eax, [ebp - 0x250]
mov dword [esp + 4], eax
lea eax, [ebp - 0x110]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
call eax
sub esp, 8
mov dword [ebp - 0xc], eax
mov dword [esp + 4], 0x40706c
lea eax, [ebp - 0x250]
add eax, 0x2c
mov dword [esp], eax
call sub.api_ms_win_crt_string_l1_1_0.dll__stricmp
test eax, eax
je 0x401808
mov dword [esp + 4], 0x40706e
lea eax, [ebp - 0x250]
add eax, 0x2c
mov dword [esp], eax
call sub.api_ms_win_crt_string_l1_1_0.dll__stricmp
test eax, eax
je 0x401808
lea eax, [ebp - 0x250]
add eax, 0x2c
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s
lea eax, [ebp - 0x354]
mov dword [esp], eax
call fcn.00403c18
mov eax, dword [ebp - 0x250]
and eax, 0x10
test eax, eax
je 0x4017d5
lea eax, [ebp - 0x354]
mov dword [esp], eax
call fcn.004016ed
sub esp, 4
jmp 0x401808
lea eax, [ebp - 0x354]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call eax
sub esp, 4
test eax, eax
je 0x4017fb
mov eax, dword [0x40a05c]
add eax, 1
mov dword [0x40a05c], eax
jmp 0x401808
mov eax, dword [0x40a060]
add eax, 1
mov dword [0x40a060], eax
lea eax, [ebp - 0x250]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FindNextFileA]
call eax
sub esp, 8
test eax, eax
jne 0x40174d
mov dword [esp + 4], 0x5c
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_strrchr
mov dword [esp + 4], str.Temp
mov dword [esp], eax
call sub.api_ms_win_crt_string_l1_1_0.dll__stricmp
test eax, eax
je 0x401861
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
call eax
sub esp, 4
nop
leave
ret 4
Function at 0x401c40
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x368
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov edx, eax
lea eax, [ebp - 0x110]
add eax, edx
mov dword [eax], 0x2a2e2a5c
mov byte [eax + 4], 0
lea eax, [ebp - 0x250]
mov dword [esp + 4], eax
lea eax, [ebp - 0x110]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
call eax
sub esp, 8
mov dword [ebp - 0xc], eax
mov dword [esp + 4], 0x40706c
lea eax, [ebp - 0x250]
add eax, 0x2c
mov dword [esp], eax
call sub.api_ms_win_crt_string_l1_1_0.dll__stricmp
test eax, eax
je 0x401d52
mov dword [esp + 4], 0x40706e
lea eax, [ebp - 0x250]
add eax, 0x2c
mov dword [esp], eax
call sub.api_ms_win_crt_string_l1_1_0.dll__stricmp
test eax, eax
je 0x401d52
mov eax, dword [ebp - 0x250]
and eax, 0x10
test eax, eax
je 0x401d53
lea eax, [ebp - 0x250]
add eax, 0x2c
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_sInstaller_setup.exe
lea eax, [ebp - 0x354]
mov dword [esp], eax
call fcn.00403c18
lea eax, [ebp - 0x354]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call eax
sub esp, 4
cmp eax, 0xffffffff
je 0x401d53
lea eax, [ebp - 0x354]
mov dword [esp + 8], eax
mov dword [esp + 4], str.__s____force_uninstall___uninstall___system_level
mov dword [esp], 0x40a080
call fcn.00403c18
mov eax, 0x40a080
jmp 0x401d7a
nop
lea eax, [ebp - 0x250]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FindNextFileA]
call eax
sub esp, 8
test eax, eax
jne 0x401ca0
mov eax, 0
leave
ret
Function at 0x402c00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00403bdc
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort

Function at 0x4037d4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x4037f3
mov eax, 0
jmp 0x403837
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x403816
mov eax, 0
jmp 0x403837
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x403832
mov eax, 0
jmp 0x403837
mov eax, 1
leave
ret

Function at 0x403839
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x403898
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x403890
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x403890
mov eax, dword [ebp - 4]
jmp 0x4038ac
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x40386d
mov eax, 0
leave
ret
Function at 0x4216c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x24
mov eax, dword [0x4ba850]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov esi, dword [esp + 0x2c]
push esi
mov dword [esp + 0x10], ecx
call fcn.004215f0
test eax, eax
mov dword [esp + 8], eax
jl 0x4217fb
push 0
push 0x8000080
push 3
push 0
push 1
push DirectSoundCreate
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
test eax, eax
mov dword [esp + 4], eax
je 0x4217fb
cmp eax, 0xffffffff
je 0x4217fb
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push 0
lea ecx, [esp + 0x20]
push ecx
push 0x10
lea edx, [esp + 0x2c]
push edx
push eax
call ebp
cmp byte [esp + 0x2b], 0x32
mov eax, dword [esp + 0x2c]
mov edi, eax
jne 0x421789
lea esi, [eax + eax*4]
add esi, esi
add esi, esi
add esi, esi
push esi
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [esp + 0x10]
push 0
mov ebx, eax
lea eax, [esp + 0x20]
push eax
push esi
push ebx
push ecx
call ebp
test edi, edi
jbe 0x4217c7
mov esi, ebx
jmp 0x421770
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push esi
push edx
call fcn.00420cd0
add esi, 0x20
sub edi, 1
jne 0x421770
jmp 0x4217c7
shl eax, 5
mov esi, eax
push esi
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [esp + 0x10]
push 0
mov ebx, eax
lea eax, [esp + 0x20]
push eax
push esi
push ebx
push ecx
call ebp
test edi, edi
jbe 0x4217c7
mov esi, ebx
nop
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push esi
push edx
call fcn.00420cd0
add esi, 0x10
sub edi, 1
jne 0x4217b0
test ebx, ebx
je 0x4217d9
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
pop ebx
mov al, 1
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0048164f
add esp, 0x24
ret 4
mov ecx, dword [esp + 0x24]
pop esi
xor ecx, esp
xor al, al
call fcn.0048164f
add esp, 0x24
ret 4
Function at 0x429550
Capabilities:
Enumerate pe sections

Disassembly:
push edi
mov edi, dword [esp + 8]
mov eax, dword [edi]
movzx ecx, ax
cmp ecx, 0x5045
je 0x429569
or eax, 0xffffffff
pop edi
ret 8
mov edx, eax
and edx, 0xff0000
cmp edx, 0x10000
je 0x429582
mov eax, 0xfffffffe
pop edi
ret 8
and eax, 0xff000000
cmp eax, 0x1000000
push esi
je 0x4295c0
cmp eax, 0x2000000
jne case.0x4295dc.3
mov esi, dword [esp + 0x10]
mov dword [esi], 2
mov eax, dword [edi + 0x10]
mov dword [esi + 0x38], eax
mov ecx, dword [edi + 0x14]
lea edx, [edi + 0x18]
push edx
lea eax, [esi + 0x18]
push eax
mov dword [esi + 0x3c], ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4295ca
mov esi, dword [esp + 0x10]
mov dword [esi], 0
mov eax, dword [edi + 4]
and eax, 0xff
cmp eax, 4
ja case.0x4295dc.3
mov ecx, 8
jmp dword [eax*4 + 0x429654]
mov dword [esi + 0xc], 0x18
jmp 0x4295fb
mov dword [esi + 0xc], 0x20
jmp 0x4295fb
or dword [esi], 1
mov dword [esi + 0xc], ecx
cmp dword [esi + 0xc], ecx
mov edx, dword [edi + 8]
mov dword [esi + 4], edx
mov eax, dword [edi + 0xc]
mov dword [esi + 8], eax
jne 0x429632
movzx eax, byte [edi + 5]
test eax, eax
mov dword [esi + 0x10], eax
mov ecx, 0x100
jne 0x42961f
mov dword [esi + 0x10], ecx
movzx eax, byte [edi + 6]
test eax, eax
mov dword [esi + 0x14], eax
jne 0x429640
mov dword [esi + 0x14], ecx
pop esi
pop edi
ret 8
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
pop esi
xor eax, eax
pop edi
ret 8
pop esi
mov eax, 0xfffffffd
pop edi
ret 8
Function at 0x42de20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4990a0
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push esi
push edi
mov eax, dword [0x4ba850]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, esi
mov byte [ebp - 0x11], 1
mov dword [ebp - 0x18], ebx
jne 0x42de6f
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call edi
push esi
call edi
add eax, 0xa
push eax
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
push 0x49b0c0
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [ebp + 0xc]
add esp, 0xc
test esi, esi
je 0x42debd
push esi
call edi
add eax, 0xa
push eax
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push esi
push ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x44
lea eax, [ebp - 0x70]
push 0
push eax
mov dword [ebp - 4], 0
call fcn.004819d0
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x70]
push edx
push eax
push eax
push 0x20
push eax
push eax
push eax
push ebx
push eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x70], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x42df24
mov dword [ebp - 0x1c], eax
push 0x4b17c8
lea eax, [ebp - 0x1c]
push eax
call fcn.00481e74
mov byte [ebp - 0x11], 0
mov eax, 0x42df1f
ret
cmp byte [ebp + 0x10], 0
je 0x42df36
mov ecx, dword [ebp - 0x2c]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [ebp - 0x2c]
push eax
call esi
mov eax, dword [ebp + 8]
test eax, eax
je 0x42df5d
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test ebx, ebx
je 0x42df6f
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430ae0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x430ae9
ret
mov ecx, dword [eax + 0xc]
push 0
lea edx, [eax + 0x14]
push edx
mov edx, dword [eax + 4]
push ecx
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x430bd0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push edi
push 0
push 0x8000080
push 2
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
test edi, edi
je 0x430c5b
cmp edi, 0xffffffff
je 0x430c5b
mov edx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x18]
push 0
lea ecx, [esp + 0xc]
push ecx
push esi
push edx
push edi
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x430c2c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop edi
pop ecx
ret
cmp dword [esp + 8], esi
jae 0x430c4b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea esp, [esp]
push 0xa
call ebx
cmp dword [esp + 0xc], esi
jb 0x430c40
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, 1
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret

Function at 0x430c60
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push edi
mov edi, dword [esp + 0x14]
push 0
push 0x8000080
push 3
push 0
push 2
push 0x40000000
push edi
call ebx
mov esi, eax
test esi, esi
je 0x430c9d
cmp esi, 0xffffffff
je 0x430c9d
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x430cbd
push 0
push 0x8000080
push 2
push 0
push 2
push 0x40000000
push edi
call ebx
mov esi, eax
test esi, esi
je 0x430ce8
cmp esi, 0xffffffff
je 0x430ce8
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 0
lea eax, [esp + 0x10]
push eax
push edi
push ecx
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x430cef
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
cmp dword [esp + 0xc], edi
jae 0x430d0a
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x430d00
push 0xa
call ebx
cmp dword [esp + 0xc], edi
jb 0x430d00
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x430d20
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
push 0
push 0x8000080
push 2
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x430dae
cmp esi, 0xffffffff
je 0x430dae
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0xc]
push ecx
push edx
push eax
push esi
mov dword [esp + 0x1c], 0
call edi
test eax, eax
jne 0x430d7e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push 0
lea ecx, [esp + 0xc]
push ecx
push edx
push eax
push esi
mov dword [esp + 0x1c], 0
call edi
test eax, eax
push esi
je 0x430d72
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret

Function at 0x430e50
Capabilities:
Delete file
Move file
Write file on windows

Disassembly:
sub esp, 0x110
mov eax, dword [0x4ba850]
xor eax, esp
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x118]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push edi
mov edi, dword [esp + 0x124]
push 0
push 0x8000080
push 2
push 0
push 2
push 0x40000000
push edi
mov dword [esp + 0x2c], eax
xor bl, bl
call ebp
mov esi, eax
test esi, esi
je 0x430ea2
cmp esi, 0xffffffff
jne 0x430f15
push 0
push 0x8000080
push 3
push 0
push 1
push DirectSoundCreate
push edi
call ebp
test eax, eax
je 0x430f7b
cmp eax, 0xffffffff
je 0x430f7b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
lea ecx, [esp + 0x1c]
push 0x49b124
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x18]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x430ef5
mov bl, 1
push 0
push 0x8000080
push 2
push 0
push 2
push 0x40000000
push edi
call ebp
mov esi, eax
test esi, esi
je 0x430f6b
cmp esi, 0xffffffff
je 0x430f6b
mov ecx, dword [esp + 0x12c]
mov edx, dword [esp + 0x10]
push 0
lea eax, [esp + 0x18]
push eax
push ecx
push edx
push esi
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push esi
jne 0x430f4f
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x430f7b
push edi
lea eax, [esp + 0x1c]
push eax
jmp 0x430f75
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x430f64
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
jmp 0x430f7d
test bl, bl
je 0x430f7b
push edi
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
xor eax, eax
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048164f
add esp, 0x110
ret
Function at 0x430fa0
Capabilities:
Get file size

Disassembly:
push esi
push 0x18
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x430fb3
pop esi
ret
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x8000080
push 3
push 0
push 1
push DirectSoundCreate
push ebx
mov dword [esi], 0
call edi
test eax, eax
mov dword [esi + 4], eax
je 0x43100d
cmp eax, 0xffffffff
je 0x43100d
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0xc], eax
mov dword [esi + 8], 0
pop edi
pop ebx
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov eax, esi
pop esi
ret
mov eax, dword [esp + 0x14]
push 0
push 0x8000080
push 3
push 0
push 1
push DirectSoundCreate
push eax
call edi
test eax, eax
mov dword [esi + 4], eax
je 0x431053
cmp eax, 0xffffffff
je 0x431053
push ebx
push esi
mov dword [esi], 1
call fcn.004308e0
add esp, 8
test eax, eax
mov dword [esi + 0xc], eax
jne 0x430ff9
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop ebx
xor eax, eax
pop esi
ret
Function at 0x434730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [0x4be0d4], 0
je 0x434759
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x434759
mov eax, dword [0x4bd0c4]
and eax, 0x7fffffff
sub eax, 1
jne 0x434759
mov dword [esp + 4], ecx
jmp fcn.00443640
ret
Function at 0x452e30
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x452f95
mov eax, dword [esp + 0xc]
test eax, eax
je 0x452f95
mov edx, dword [edi + 0xc]
push ebp
push esi
mov esi, dword [eax + 0xc]
cmp edx, esi
jge 0x452e5d
mov ebp, edx
mov dword [esp + 0x10], ebp
jmp 0x452e63
mov ebp, esi
mov dword [esp + 0x10], esi
mov ecx, dword [edi + 0x10]
push ebx
mov ebx, dword [eax + 0x10]
cmp ecx, ebx
jge 0x452e70
mov ebx, ecx
cmp dword [eax + 0x14], 0
je 0x452e8a
mov ecx, dword [eax + 0x14]
mov ecx, dword [ecx + 0x120]
mov eax, dword [eax + 0x18]
mov esi, ecx
lea ecx, [eax + ecx*4 + 4]
jmp 0x452e8d
mov ecx, dword [eax + 0x18]
sub esi, ebp
cmp dword [edi + 0x14], 0
je 0x452ea9
mov edx, dword [edi + 0x14]
mov eax, dword [edx + 0x120]
mov edi, dword [edi + 0x18]
mov edx, eax
lea eax, [edi + eax*4 + 4]
jmp 0x452eac
mov eax, dword [edi + 0x18]
sub edx, ebp
test ebp, ebp
je 0x452f92
test ebx, ebx
je 0x452f92
mov edi, dword [esp + 0x1c]
sub edi, 0
je 0x452f61
sub edi, 1
je 0x452f23
sub edi, 1
jne 0x452f92
test ebx, ebx
jle 0x452f92
add esi, esi
add esi, esi
lea edi, [edx*4]
lea esp, [esp]
test ebp, ebp
jle 0x452f15
mov edx, ebp
mov ebp, dword [ecx]
xor ebp, dword [eax]
add ecx, 4
and ebp, 0xffffff
xor ebp, dword [ecx - 4]
add eax, 4
sub edx, 1
mov dword [eax - 4], ebp
jne 0x452ef6
mov ebp, dword [esp + 0x14]
add ecx, esi
add eax, edi
sub ebx, 1
jne 0x452ef0
pop ebx
pop esi
pop ebp
pop edi
ret
test ebx, ebx
jle 0x452f92
add esi, esi
add esi, esi
lea edi, [edx*4]
test ebp, ebp
jle 0x452f53
mov edx, ebp
mov ebp, dword [ecx]
xor ebp, dword [eax]
add ecx, 4
and ebp, 0xffffff
xor dword [eax], ebp
add eax, 4
sub edx, 1
jne 0x452f38
mov ebp, dword [esp + 0x14]
add ecx, esi
add eax, edi
sub ebx, 1
jne 0x452f32
pop ebx
pop esi
pop ebp
pop edi
ret
test ebx, ebx
jle 0x452f92
add esi, esi
add esi, esi
lea edi, [edx*4]
test ebp, ebp
jle 0x452f89
mov edx, ebp
mov ebp, dword [ecx]
mov dword [eax], ebp
add eax, 4
add ecx, 4
sub edx, 1
jne 0x452f76
mov ebp, dword [esp + 0x14]
add ecx, esi
add eax, edi
sub ebx, 1
jne 0x452f70
pop ebx
pop esi
pop ebp
pop edi
ret