joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001dc40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e4
push ebx
push esi
push edi
mov dword [ebp - 8], 0xc0
mov dword [ebp - 4], 0x1000000
lea ebx, [ebx]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
lea eax, [ebp - 0x1e0]
call fcn.1001dac0
mov edx, dword [ebp + 0x10]
push 0x40
push edx
lea esi, [ebp - 0x1e0]
call fcn.100154d0
push 4
lea eax, [ebp - 4]
push eax
call fcn.100154d0
lea ecx, [ebp - 0x90]
push ecx
mov eax, esi
call fcn.1001d950
mov ecx, 0x10
lea esi, [ebp - 0x90]
lea edi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], 0x3e7
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edx
push eax
lea eax, [ebp - 0x1e0]
call fcn.1001dac0
mov eax, dword [ebp - 0x198]
mov edi, 0x40
lea ebx, [ebp - 0x90]
test eax, eax
jne 0x1001dd14
cmp edi, 0x80
jb 0x1001dd14
lea ecx, [ebp - 0x1e0]
push ecx
mov edx, ebx
call fcn.10014730
mov eax, dword [ebp - 0x198]
add esp, 4
add dword [ebp - 0x1a0], 0x400
adc dword [ebp - 0x19c], 0
sub ebx, 0xffffff80
add edi, 0xffffff80
jmp 0x1001dd7c
mov esi, 0x80
sub esi, eax
cmp esi, edi
jbe 0x1001dd21
mov esi, edi
push esi
lea edx, [ebp + eax - 0x194]
push ebx
push edx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x198]
add eax, esi
add esp, 0xc
add ebx, esi
sub edi, esi
mov dword [ebp - 0x198], eax
cmp eax, 0x80
jne 0x1001dd7c
lea eax, [ebp - 0x1e0]
push eax
lea edx, [ebp - 0x194]
call fcn.10014730
add esp, 4
add dword [ebp - 0x1a0], 0x400
mov eax, 0
mov dword [ebp - 0x198], eax
adc dword [ebp - 0x19c], eax
test edi, edi
jne 0x1001dcd8
lea ecx, [ebp - 0x90]
push ecx
lea eax, [ebp - 0x1e0]
call fcn.1001d950
xor eax, eax
jmp 0x1001dda0
mov edx, dword [ebp + eax - 0x90]
mov ecx, dword [ebp + eax - 0x8c]
xor dword [ebp + eax - 0x50], edx
xor dword [ebp + eax - 0x4c], ecx
mov edx, dword [ebp + eax - 0x88]
mov ecx, dword [ebp + eax - 0x84]
xor dword [ebp + eax - 0x48], edx
xor dword [ebp + eax - 0x44], ecx
add eax, 0x10
cmp eax, 0x40
jl 0x1001dda0
dec dword [ebp - 0xc]
jne 0x1001dcb4
mov edx, dword [ebp - 4]
mov ebx, dword [ebp - 8]
bswap edx
inc edx
bswap edx
mov dword [ebp - 4], edx
mov esi, ebx
cmp ebx, 0x40
jb 0x1001ddf7
mov esi, 0x40
mov edi, dword [ebp + 0x14]
push esi
lea eax, [ebp - 0x50]
push eax
push edi
call sub.msvcrt.dll_memcpy
add edi, esi
add esp, 0xc
sub ebx, esi
mov dword [ebp + 0x14], edi
mov dword [ebp - 8], ebx
jne 0x1001dc60
xor eax, eax
lea edi, [ebp - 0x1e0]
mov ecx, 0x54
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x50]
mov ecx, 0x10
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x90]
mov ecx, 0x10
rep stosd dword es:[edi], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
jmp fcn.00401219

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
jmp int.00401219
Function at 0x403fd3
Capabilities:
Send icmp echo request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x49d01c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx + 0x14], 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x44], eax
jb 0x403ff4
mov ecx, dword [ecx]
push esi
push ecx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40400a
xor al, al
jmp 0x4040be
call dword [sym.imp.IPHLPAPI.DLL_IcmpCreateFile]
mov dword [ebp - 0x40], eax
cmp eax, 0xffffffff
je 0x404003
push ebx
push edi
xor eax, eax
xor ecx, ecx
inc eax
push 0x1c
pop edx
mov dword [ebp - 0x34], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00465da0
and dword [ebp - 0x3c], 0
lea edi, [ebp - 0x24]
and dword [ebp - 0x38], 0
mov ebx, eax
pop ecx
push 8
pop ecx
mov eax, 0x30303030
mov byte [ebp - 0x3c], 1
push 0x1c
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 0x40]
pop edx
mov byte [ebp - 0x25], 1
mov dword [ebp - 0x2c], edx
mov ecx, dword [ebp - 0x30]
mov eax, ecx
dec ecx
mov dword [ebp - 0x30], ecx
test eax, eax
je 0x4040ac
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x4040ac
push 0xbb8
push edx
push ebx
lea eax, [ebp - 0x3c]
push eax
push 0x20
lea eax, [ebp - 0x24]
push eax
push esi
push edi
call dword [sym.imp.IPHLPAPI.DLL_IcmpSendEcho]
test eax, eax
je 0x4040cd
mov ecx, dword [ebp - 0x44]
push ebx
call fcn.004017e0
cmp dword [ebx], esi
jne 0x4040a0
mov byte [ebp - 0x25], 0
inc byte [ebp - 0x3c]
cmp byte [ebp - 0x25], 0
mov edx, dword [ebp - 0x2c]
jne 0x40405d
push ebx
call fcn.00465da9
pop ecx
push edi
call dword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
pop edi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00465d26
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 4], 0x2af9
jne 0x4040a0
push ebx
call fcn.00465da9
mov eax, dword [ebp - 0x34]
xor ecx, ecx
push 0x1c
inc eax
pop edx
add dword [ebp - 0x2c], edx
mov dword [ebp - 0x34], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00465da0
pop ecx
pop ecx
mov ebx, eax
jmp 0x4040a3
Function at 0x4087bf
Capabilities:
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreatePipe]
lea eax, [ebp - 0x1c]
xor esi, esi
mov dword [ebp - 0x1c], 0xc
push esi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0x14], 1
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], esi
push eax
mov ebx, ecx
call edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 1
push dword [ebp - 4]
call esi
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
call edi
push 0
push 1
push dword [ebp - 8]
call esi
push 0x40
xor esi, esi
lea eax, [ebp - 0x6c]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 0xc]
lea edi, [ebp - 0x28]
mov dword [ebp - 0x30], eax
add esp, 0xc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x2c], esi
stosd dword es:[edi], eax
or dword [ebp - 0x44], 0x100
mov dword [ebp - 0x70], 0x44
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x70]
push eax
push esi
push esi
push 0x8000000
push 1
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x408899
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
call esi
push dword [ebp - 0x2c]
call esi
push dword [ebp - 0x28]
call esi
mov al, 1
jmp 0x40889b
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40f4f0
Capabilities:
Create thread

Disassembly:
push 0x54
mov eax, 0x468cb7
call fcn.00466e87
mov edi, dword [ebp + 0x5c]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, dword [ecx]
lea eax, [ebp - 0x38]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 0x54]
test ecx, ecx
je 0x40f525
mov eax, dword [ecx]
lea edx, [ebp - 0x38]
push edx
call dword [eax]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x60]
call fcn.0040f5c8
mov byte [ebp - 4], 5
cmp dword [esi + 0x5c], ebx
jne 0x40f599
lea eax, [ebp - 0x60]
push eax
lea ecx, [esi + 8]
call fcn.00413380
lea eax, [ebp - 0x38]
push eax
lea ecx, [esi + 0x30]
call fcn.004133f0
mov eax, dword [ebp + 0x58]
lea ecx, [esi + 0xc4]
push edi
mov dword [esi + 0x60], eax
mov byte [esi + 0x58], bl
call fcn.0040fd66
push ebx
push ebx
push esi
push 0x4100df
push ebx
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x40f599
lea ecx, [ebp - 0x60]
mov dword [esi + 0x5c], eax
call fcn.0040f5fd
lea ecx, [ebp - 0x38]
call fcn.0040f5fd
mov bl, 1
jmp 0x40f5a9
lea ecx, [ebp - 0x60]
call fcn.0040f5fd
lea ecx, [ebp - 0x38]
call fcn.0040f5fd
lea ecx, [ebp + 8]
call fcn.0040f5fd
lea ecx, [ebp + 0x30]
call fcn.0040f5fd
mov al, bl
call fcn.00466e50
ret 0x58

Function at 0x40fa1d
Capabilities:
Get common file path

Disassembly:
push 0x230
mov eax, 0x468d00
call fcn.00466ebb
mov dword [ebp - 0x234], edx
mov ebx, ecx
mov dword [ebp - 0x238], ebx
and dword [ebp - 0x23c], 0
lea eax, [ebp - 0x1f0]
push 0xa
pop ecx
push 0x1e0
mov esi, 0x47c018
lea edi, [ebp - 0x218]
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00406170
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x220]
test ecx, ecx
je 0x40fac5
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push 0x5c
cmovae eax, dword [ebp - 0x230]
pop edx
cmp word [eax + ecx*2 - 2], dx
je 0x40fac5
push edx
push 1
lea ecx, [ebp - 0x230]
call fcn.00413113
push dword [ebp - 0x234]
lea edx, [ebp - 0x230]
mov ecx, ebx
call fcn.0041330a
pop ecx
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.004061ab
mov eax, ebx
call fcn.00466e65
ret
Function at 0x4125b6
Capabilities:
Read file on windows

Disassembly:
push 0x458
mov eax, 0x4695f0
call fcn.00466ebb
mov ebx, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x460]
mov edx, dword [ebp + 8]
or dword [ebp - 0x460], 0xffffffff
or dword [ebp - 0x45c], 0xffffffff
push eax
push edx
call fcn.004087bf
test al, al
je 0x412771
push dword [ebp - 0x460]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
mov dword [ebp - 0x42c], 0xf
mov dword [ebp - 0x430], ecx
mov byte [ebp - 0x440], cl
mov dword [ebp - 4], ecx
xor eax, eax
mov dword [ebp - 0x414], 7
mov dword [ebp - 0x418], ecx
mov word [ebp - 0x428], ax
mov esi, 0x400
mov byte [ebp - 4], 1
push esi
push ecx
lea eax, [ebp - 0x410]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x464]
push 0
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x4126a1
cmp dword [ebp - 0x464], 0
je 0x4126b4
push dword [ebp - 0x464]
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x440]
call fcn.00407974
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x464]
push 0
push eax
push 0x400
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x45c]
call esi
test eax, eax
jne 0x41265c
push dword [ebp - 0x45c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x42c], 0x10
lea eax, [ebp - 0x440]
cmovae eax, dword [ebp - 0x440]
mov dword [ebp - 0x460], eax
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x45c], eax
call dword [sym.imp.KERNEL32.dll_GetACP]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.infra.dll_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_base::SysMultiByteToWide_class_base::BasicStringPiece_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char____const___unsigned_int_]
add esp, 0xc
lea ecx, [ebp - 0x428]
push eax
call fcn.00407877
xor esi, esi
lea ecx, [ebp - 0x458]
push esi
push 1
call fcn.004061ab
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebx + 0x6c]
call fcn.00407aa7
cmp dword [ebp - 0x414], 8
lea eax, [ebp - 0x428]
lea ecx, [ebx + 8]
cmovae eax, dword [ebp - 0x428]
push eax
push 1
call fcn.00412e15
push esi
push 1
lea ecx, [ebp - 0x428]
call fcn.004061ab
push esi
push 1
lea ecx, [ebp - 0x440]
call fcn.00401c5e
mov al, 1
jmp 0x412773
xor al, al
call fcn.00466e65
ret 8
Function at 0x414182
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x469a2c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x49d01c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
call fcn.004142f9
xor edi, edi
lea ecx, [esi + 0x168]
push ebx
inc edi
push edi
call fcn.00401c5e
push ebx
push edi
lea ecx, [esi + 0x150]
call fcn.00401c5e
push ebx
push edi
lea ecx, [esi + 0x138]
call fcn.00401c5e
push ebx
push edi
lea ecx, [esi + 0x120]
call fcn.00401c5e
push ebx
push edi
lea ecx, [esi + 0x108]
call fcn.00401c5e
push ebx
push edi
lea ecx, [esi + 0xf0]
call fcn.004061ab
push ebx
push edi
lea ecx, [esi + 0xd8]
call fcn.004061ab
push ebx
push edi
lea ecx, [esi + 0xbc]
call fcn.004061ab
push ebx
push edi
lea ecx, [esi + 0xa4]
call fcn.004061ab
lea ecx, [esi + 0xa0]
call dword [sym.imp.infra.dll_public:_void___thiscall_base::WaitableEvent::destructor_void_]
lea ecx, [esi + 0x94]
call fcn.00418587
lea ecx, [esi + 0x88]
call fcn.004182db
lea ecx, [esi + 0x48]
call fcn.0040f5fd
lea ecx, [esi + 0x30]
call dword [sym.imp.infra.dll_public:_void___thiscall_base::Lock::destructor_void_]
lea ecx, [esi + 0x24]
call fcn.004183db
push ebx
push edi
lea ecx, [esi + 0xc]
call fcn.00401c5e
mov dword [ebp - 4], ebx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x414281
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, esi
call fcn.004018e9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4165a3
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp byte [esi + 0x24], 0
je 0x4165bf
xor al, al
jmp 0x4166c4
xor ecx, ecx
inc ecx
cmp dword [esi + 0x28], 0
jne 0x4165d7
and dword [esi + 0x34], 0
mov dword [esi + 0x28], ecx
and dword [esi + 0x30], 0
and dword [esi + 0x2c], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [esi + 0x28], ecx
jne 0x416627
cmp dword [esi + 0x2c], 0
je 0x4165fa
call ebx
sub eax, dword [esi + 0x2c]
cmp eax, dword [esi + 0x30]
seta al
test al, al
je 0x416627
xor ecx, ecx
inc ecx
mov eax, dword [esi + 0x34]
inc eax
mov dword [esi + 0x34], eax
cmp eax, 4
jle 0x41660b
mov byte [esi + 0x24], cl
jmp 0x416627
push esi
mov ecx, edi
call fcn.00415083
mov dword [esi + 0x30], 0xbb8
call ebx
push 1
test eax, eax
pop ecx
cmove eax, ecx
mov dword [esi + 0x2c], eax
cmp dword [esi + 0x28], 2
jne 0x4166b3
cmp byte [esi + 0x3c], 0
je 0x416644
cmp byte [esi + 0x3d], 0
je 0x416644
mov dword [esi + 0x28], 3
cmp dword [esi + 0x2c], 0
je 0x416659
call ebx
sub eax, dword [esi + 0x2c]
cmp eax, dword [esi + 0x30]
seta al
test al, al
je 0x4166b3
mov eax, dword [esi + 0x34]
inc eax
mov dword [esi + 0x34], eax
cmp eax, 4
jle 0x41666d
xor eax, eax
inc eax
mov byte [esi + 0x24], al
jmp 0x4166b3
cmp byte [esi + 0x3c], 0
jne 0x416681
push dword [esi + 4]
mov ecx, edi
push dword [esi]
push 0
call fcn.004151b7
cmp byte [esi + 0x3d], 0
jne 0x41669f
mov eax, dword [edi + 0x70]
xor ecx, ecx
inc ecx
cmp eax, ecx
jle 0x41669f
push dword [esi + 4]
dec eax
mov ecx, edi
push dword [esi]
push eax
call fcn.004151b7
mov dword [esi + 0x30], 0xbb8
call ebx
push 1
test eax, eax
pop ecx
cmove eax, ecx
mov dword [esi + 0x2c], eax
cmp dword [esi + 0x28], 3
je 0x4165b8
cmp byte [esi + 0x24], 0
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x417f03
Capabilities:
Create thread

Disassembly:
push 0x24
mov eax, 0x46a4fb
call fcn.00466e87
mov esi, ecx
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x24]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x28]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp + 0x2c]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp + 0x30]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp + 0x34]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp + 0x3c]
mov dword [ebp - 0x30], ecx
xor ebx, ebx
lea ecx, [esi + 0x58]
mov dword [ebp - 4], ebx
cmp ecx, eax
je 0x417f62
push 0xffffffffffffffff
push ebx
push eax
call fcn.0040631c
lea ecx, [esi + 0x70]
cmp ecx, edi
je 0x417f72
push 0xffffffffffffffff
push ebx
push edi
call fcn.0040631c
mov eax, dword [ebp + 0x10]
lea ecx, [esi + 0x8c]
mov dword [esi + 0x88], eax
or edi, 0xffffffff
mov eax, dword [ebp - 0x10]
cmp ecx, eax
je 0x417f93
push edi
push ebx
push eax
call fcn.0040631c
mov eax, dword [ebp - 0x14]
lea ecx, [esi + 0xa4]
cmp ecx, eax
je 0x417fa8
push edi
push ebx
push eax
call fcn.0040631c
mov eax, dword [ebp - 0x18]
lea ecx, [esi + 0x3c]
cmp ecx, eax
je 0x417fba
push edi
push ebx
push eax
call fcn.0040631c
mov eax, dword [ebp + 0x20]
lea ecx, [esi + 0xbc]
mov dword [esi + 0x54], eax
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
je 0x417fd5
push edi
push ebx
push eax
call fcn.00401d24
mov eax, dword [ebp - 0x20]
lea ecx, [esi + 0xd4]
cmp ecx, eax
je 0x417fea
push edi
push ebx
push eax
call fcn.00401d24
mov eax, dword [ebp - 0x24]
lea ecx, [esi + 0xec]
cmp ecx, eax
je 0x417fff
push edi
push ebx
push eax
call fcn.00401d24
mov eax, dword [ebp - 0x28]
lea ecx, [esi + 0x104]
cmp ecx, eax
je 0x418014
push edi
push ebx
push eax
call fcn.00401d24
mov eax, dword [ebp - 0x2c]
lea ecx, [esi + 0x11c]
cmp ecx, eax
je 0x418029
push edi
push ebx
push eax
call fcn.00401d24
mov eax, dword [ebp + 0x38]
lea ecx, [esi + 4]
push dword [ebp - 0x30]
mov dword [esi + 0x134], eax
call fcn.00401838
lea eax, [ebp + 0x40]
push eax
lea ecx, [esi + 0x10]
call fcn.00413380
push ebx
push ebx
push esi
push 0x418079
push ebx
push ebx
mov byte [esi], bl
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x418067
mov dword [esi + 8], eax
mov bl, 1
lea ecx, [ebp + 0x40]
call fcn.0040f5fd
mov al, bl
call fcn.00466e50
ret 0x60
Function at 0x41cf87
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ecx + 0x14], 8
jb 0x41cf95
mov ecx, dword [ecx]
push ebx
push esi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 7
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x41cfbe
xor eax, eax
jmp 0x41d03f
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, 0x400
cmp eax, ecx
cmova eax, ecx
mov dword [ebp - 0xc], eax
test eax, eax
je 0x41d036
push edi
push eax
call fcn.00465da0
pop ecx
push esi
mov edi, eax
mov dword [ebp - 4], esi
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41d02e
push 2
pop eax
cmp dword [ebp - 4], eax
jb 0x41d016
cmp byte [edi], 0xff
jne 0x41d016
cmp byte [edi + 1], 0xfe
jne 0x41d016
xor esi, esi
inc esi
jmp 0x41d02e
cmp dword [ebp - 4], 3
jb 0x41d02e
cmp byte [edi], 0xef
jne 0x41d02e
cmp byte [edi + 1], 0xbb
jne 0x41d02e
cmp byte [edi + 2], 0xbf
cmove esi, eax
push edi
call fcn.00465da9
pop ecx
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4236c3
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x46bfd3
call fcn.00466ebb
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x4237bf
cmp byte [esi + 0x3d], 0
je 0x4237bf
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x4236fd
xor al, al
jmp 0x4237c1
push ecx
push ecx
lea ecx, [ebp - 0x28]
call fcn.00422306
and dword [ebp - 4], 0
mov ebx, dword [ebp - 0x28]
mov edi, dword [ebp - 0x14]
cmp edi, 0x10
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x28]
cmovae edx, ebx
lea ecx, [ebp - 0x28]
cmovae ecx, ebx
add eax, edx
push eax
push ecx
mov ecx, dword [esi + 0x38]
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x42374c
sub eax, 1
je 0x423750
dec eax
sub eax, 1
je 0x4237ad
xor bl, bl
jmp 0x4237af
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ebx, dword [ebp - 0x28]
cmp edi, 0x10
mov ecx, dword [ebp - 0x2c]
cmovae eax, ebx
sub ecx, eax
mov dword [ebp - 0x30], ecx
je 0x42378f
push dword [esi + 0x4c]
cmp edi, 0x10
lea eax, [ebp - 0x28]
push ecx
cmovae eax, ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov ecx, dword [ebp - 0x30]
add esp, 0x10
cmp ecx, eax
jne 0x423748
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x28]
cmp byte [esi + 0x3d], 0
je 0x4237ad
test ecx, ecx
jne 0x423711
push ecx
push 8
lea ecx, [ebp - 0x28]
call fcn.0040a838
jmp 0x42370b
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00401c5e
mov al, bl
jmp 0x4237c1
mov al, 1
call fcn.00466e65
ret