joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403b30
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x43f04c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x403b5b
xor eax, eax
jmp 0x403bd6
lea ecx, [ebp - 0xc]
push ecx
push 0x43af6c
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x403b74
xor eax, eax
jmp 0x403bd6
mov dword [ebp - 0x1c], 1
mov edx, 0xc
imul eax, edx, 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov dword [ebp + eax - 0x18], ecx
mov dword [ebp + eax - 0x14], edx
mov eax, 0xc
imul ecx, eax, 0
mov dword [ebp + ecx - 0x10], 2
push 0
push 0
push 0x10
lea edx, [ebp - 0x1c]
push edx
push 0
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x403bbf
xor eax, eax
jmp 0x403bd6
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x403bd1
xor eax, eax
jmp 0x403bd6
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040eb0d
mov esp, ebp
pop ebp
ret
Function at 0x403d90
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x364
mov eax, dword [0x43f04c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x35c], 0
push 0x5c
mov eax, dword [ebp + 8]
push eax
call fcn.004010b0
add esp, 8
mov dword [ebp - 0x360], eax
mov ecx, dword [ebp - 0x360]
add ecx, 1
mov dword [ebp - 0x360], ecx
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x35c], eax
mov dword [ebp - 0x350], 0x128
lea edx, [ebp - 0x350]
push edx
mov eax, dword [ebp - 0x35c]
push eax
call dword [sym.imp.KERNEL32.dll_Process32First]
mov dword [ebp - 0x358], 0xffffffff
mov dword [ebp - 0x228], 0x224
mov dword [ebp - 0x358], 0xffffffff
mov byte [ebp - 0x351], 0
lea ecx, [ebp - 0x350]
push ecx
call fcn.00403ae0
add esp, 4
movzx edx, al
test edx, edx
je 0x403edc
mov eax, dword [ebp - 0x348]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x358], eax
lea ecx, [ebp - 0x228]
push ecx
mov edx, dword [ebp - 0x358]
push edx
call dword [sym.imp.KERNEL32.dll_Module32First]
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0
je 0x403eb2
mov eax, dword [ebp - 0x360]
push eax
lea ecx, [ebp - 0x208]
push ecx
call fcn.00415727
add esp, 8
test eax, eax
jne 0x403e96
mov byte [ebp - 0x351], 1
lea edx, [ebp - 0x228]
push edx
mov eax, dword [ebp - 0x358]
push eax
call dword [sym.imp.KERNEL32.dll_Module32Next]
mov dword [ebp - 0x364], eax
jmp 0x403e6c
movzx ecx, byte [ebp - 0x351]
test ecx, ecx
jne 0x403ecf
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x348]
push eax
call fcn.00403bf0
mov ecx, dword [ebp - 0x358]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x350]
push edx
mov eax, dword [ebp - 0x35c]
push eax
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x403dfe
mov ecx, dword [ebp - 0x35c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040eb0d
mov esp, ebp
pop ebp
ret
Function at 0x403f20
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x43f04c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
movzx ecx, word [ebp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x403f51
xor eax, eax
jmp 0x40400a
mov edx, dword [ebp - 0xc]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
ja 0x403f6d
xor eax, eax
jmp 0x40400a
mov eax, dword [ebp - 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x403f89
xor eax, eax
jmp 0x40400a
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x403fa0
xor eax, eax
jmp 0x40400a
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x403fc9
xor eax, eax
jmp 0x40400a
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x403ff7
cmp dword [ebp - 8], 0
ja 0x403ffb
xor eax, eax
jmp 0x40400a
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040eb0d
mov esp, ebp
pop ebp
ret
Function at 0x404020
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x43f04c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0xf
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 0x140]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32First]
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0
je 0x404171
mov edx, dword [ebp + 8]
mov dword [ebp - 0x138], edx
lea eax, [ebp - 0x108]
mov dword [ebp - 0x134], eax
mov ecx, dword [ebp - 0x134]
mov dl, byte [ecx]
mov byte [ebp - 0x12d], dl
mov eax, dword [ebp - 0x138]
cmp dl, byte [eax]
jne 0x4040e7
cmp byte [ebp - 0x12d], 0
je 0x4040db
mov ecx, dword [ebp - 0x134]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x12e], dl
mov eax, dword [ebp - 0x138]
cmp dl, byte [eax + 1]
jne 0x4040e7
add dword [ebp - 0x134], 2
add dword [ebp - 0x138], 2
cmp byte [ebp - 0x12e], 0
jne 0x404089
mov dword [ebp - 0x144], 0
jmp 0x4040f2
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x144], ecx
mov edx, dword [ebp - 0x144]
mov dword [ebp - 0x14c], edx
cmp dword [ebp - 0x14c], 0
jne 0x404152
mov eax, dword [ebp - 0x124]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
je 0x404152
push 9
mov ecx, dword [ebp - 0x13c]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0xffffffffffffffff
mov edx, dword [ebp - 0x13c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x12c]
push ecx
mov edx, dword [ebp - 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_Process32Next]
mov dword [ebp - 0x148], eax
jmp 0x404067
mov eax, dword [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040eb0d
mov esp, ebp
pop ebp
ret
Function at 0x404190
Capabilities:
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x43f04c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
push 0
lea eax, [ebp - 0x110]
push eax
call fcn.004108e0
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 8], cl
push 3
mov edx, dword [ebp + 8]
push edx
push 0x104
lea eax, [ebp - 0x110]
push eax
call fcn.00402fb0
push 0x43afe8
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call fcn.00403020
mov dword [ebp - 0x118], 0
jmp 0x404209
mov edx, dword [ebp - 0x118]
add edx, 1
mov dword [ebp - 0x118], edx
cmp dword [ebp - 0x118], 4
jge 0x40423a
call fcn.00413a4b
cdq
mov ecx, 0x1a
idiv ecx
add edx, 0x61
mov byte [ebp - 0x111], dl
mov edx, dword [ebp - 0x118]
mov al, byte [ebp - 0x111]
mov byte [ebp + edx - 0xc], al
jmp 0x4041fa
lea ecx, [ebp - 0xc]
push ecx
push 0x104
lea edx, [ebp - 0x110]
push edx
call fcn.00403020
push 0x43aff8
push 0x104
lea eax, [ebp - 0x110]
push eax
call fcn.00403020
push 1
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 4
push 0
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x11c], eax
mov edx, dword [ebp - 0x11c]
and edx, 2
jne 0x4042be
mov eax, dword [ebp - 0x11c]
or eax, 2
push eax
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040eb0d
mov esp, ebp
pop ebp
ret

Function at 0x4042d0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push str.XXX5B98_0E3D_4B3B_B724_57DB0D76F78F
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4042fe
mov dword [ebp - 0xc], 1
jmp 0x404305
mov dword [ebp - 0xc], 0
mov al, byte [ebp - 0xc]
mov byte [ebp - 1], al
cmp dword [ebp - 8], 0
je 0x404319
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x404337
cmp dword [ebp - 8], 0
je 0x404333
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x404339
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x404340
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x43f04c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.004108e0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x108]
push eax
push 0x43b048
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call fcn.00403090
add esp, 0x14
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00403f20
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040eb0d
mov esp, ebp
pop ebp
ret
Function at 0x404580
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42dd20
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x43f04c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
push 0
lea eax, [ebp - 0x164]
push eax
call fcn.004108e0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edx, dword [0x43b070]
mov dword [ebp - 0x164], edx
mov eax, dword [0x43b074]
mov dword [ebp - 0x160], eax
mov ecx, dword [0x43b078]
mov dword [ebp - 0x15c], ecx
push 0xb0
lea ecx, [ebp - 0x21c]
call fcn.00402f60
push 1
lea ecx, [ebp - 0x21c]
call fcn.00405fd0
mov dword [ebp - 4], 0
push 0x40
push 8
lea edx, [ebp - 0x164]
push edx
lea ecx, [ebp - 0x21c]
call fcn.00405f00
lea eax, [ebp - 0x16c]
push eax
call fcn.004016b0
add esp, 4
lea ecx, [ebp - 0x16c]
push ecx
call fcn.00401690
add esp, 4
mov dword [ebp - 0x220], eax
mov edx, dword [ebp - 0x220]
push edx
push 0x43b07c
push 0x50
lea eax, [ebp - 0x60]
push eax
call fcn.00413a2c
add esp, 0x10
lea ecx, [ebp - 0x60]
push ecx
lea edx, [ebp - 0x21c]
push edx
call fcn.0040b2d0
add esp, 8
mov dword [ebp - 0x224], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x224]
call fcn.004060a0
mov dword [ebp - 0x228], eax
push 0x40b650
mov ecx, dword [ebp - 0x228]
call fcn.004062c0
lea ecx, [ebp - 0x21c]
call fcn.00405ec0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.00404550
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040eb0d
mov esp, ebp
pop ebp
ret
Function at 0x404890
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42dd7b
mov eax, dword fs:[0]
push eax
sub esp, 0x294
mov eax, dword [0x43f04c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x288]
push eax
lea ecx, [ebp + 0xc]
call fcn.004038d0
mov dword [ebp - 0x25c], eax
mov ecx, dword [ebp - 0x25c]
mov dword [ebp - 0x260], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x260]
mov dword [ebp - 0x264], edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x264]
call fcn.00403890
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x288]
call fcn.00403930
mov dword [ebp - 0x254], 0xffffffff
mov dword [ebp - 0x24c], 0x224
mov byte [ebp - 0x24d], 0
mov ecx, dword [ebp + 8]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x254], eax
lea edx, [ebp - 0x24c]
push edx
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_Module32First]
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0
je 0x4049a2
lea ecx, [ebp - 0x28]
call fcn.00406720
push eax
lea ecx, [ebp - 0x22c]
push ecx
call fcn.00415727
add esp, 8
test eax, eax
jne 0x404986
mov byte [ebp - 0x24d], 1
jmp 0x4049a2
lea edx, [ebp - 0x24c]
push edx
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_Module32Next]
mov dword [ebp - 0x258], eax
jmp 0x404958
movzx ecx, byte [ebp - 0x24d]
test ecx, ecx
jne 0x4049f8
lea edx, [ebp - 0x2a0]
push edx
lea ecx, [ebp + 0xc]
call fcn.00403890
mov dword [ebp - 0x268], eax
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x26c], eax
mov byte [ebp - 4], 4
push 0
mov ecx, dword [ebp - 0x26c]
call fcn.00406720
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004046f0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2a0]
call fcn.004067d0
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x270], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004067d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00403930
mov eax, dword [ebp - 0x270]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040eb0d
mov esp, ebp
pop ebp
ret
Function at 0x404be0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x43f04c]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.004042d0
movzx eax, al
test eax, eax
je 0x404c07
or eax, 0xffffffff
jmp 0x404de0
call fcn.00403b30
push 0x104
push 0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004108e0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x20c]
push eax
call fcn.00404190
add esp, 4
push 0x104
push 0
lea ecx, [ebp - 0x108]
push ecx
call fcn.004108e0
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
push 0x43b0e0
push str.HOOKDLL_64
push 0x6e
call fcn.00404340
add esp, 0xc
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
push 0x43b0fc
push str.HookDll
push 0x65
call fcn.00404340
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x43b114
push 0x104
lea edx, [ebp - 0x108]
push edx
call fcn.00403020
push 0x43b118
push 0x104
lea eax, [ebp - 0x108]
push eax
call fcn.00403020
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x43b128
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.00403020
push str.winhlpe64.exe
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.00403020
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x404d3e
push str.dll_not_found
call fcn.004043d0
add esp, 4
xor eax, eax
jmp 0x404de0
push str.start......
call fcn.004043d0
add esp, 4
push 0x43b158
call fcn.00404020
add esp, 4
lea edx, [ebp - 0x108]
push edx
lea ecx, [ebp - 0x220]
call fcn.004022d0
push eax
lea ecx, [ebp - 0x214]
call fcn.0040b690
lea ecx, [ebp - 0x214]
call fcn.00403a80
mov eax, 1
test eax, eax
je 0x404dc5
push 0
lea ecx, [ebp - 0x108]
push ecx
lea ecx, [ebp - 0x238]
call fcn.0040b2a0
lea edx, [ebp - 0x238]
push edx
call fcn.00404a50
add esp, 4
lea ecx, [ebp - 0x238]
call fcn.00403930
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x404d81
mov dword [ebp - 0x21c], 0
lea ecx, [ebp - 0x214]
call fcn.00403a30
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040eb0d
mov esp, ebp
pop ebp
ret 0x10
Function at 0x405210
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x43f04c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x10], 0
jg 0x40523a
jl 0x405231
cmp dword [ebp + 0xc], 0
ja 0x40523a
xor eax, eax
xor edx, edx
jmp 0x40537b
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x38], 0
je 0x40525c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00405cb0
jmp 0x40537b
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10]
call fcn.00407f10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x4052cb
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
call fcn.00405390
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00408070
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.004091d0
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00407ff0
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x4c], 0
je 0x40536c
mov ecx, dword [ebp - 0x10]
call fcn.00407a10
mov dword [ebp - 0x2c], 0xfff
cmp dword [ebp - 8], 0xfff
jbe 0x40533b
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.00415fb5
add esp, 0x10
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x18]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
cmp dword [ebp - 0x18], 0xfff
je 0x405339
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x40537b
jmp 0x4052e7
cmp dword [ebp - 8], 0
jbe 0x40536c
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.00415fb5
add esp, 0x10
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 8], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040eb0d
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405850
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x43f04c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x38], ecx
call fcn.004090f0
mov dword [ebp - 0x50], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x50]
push ecx
call fcn.00409150
add esp, 8
movzx edx, al
test edx, edx
je 0x405894
lea eax, [ebp + 8]
push eax
call fcn.00409100
add esp, 4
jmp 0x405a25
mov ecx, dword [ebp - 0x38]
call fcn.00408050
test eax, eax
je 0x4058da
mov ecx, dword [ebp - 0x38]
call fcn.00408050
mov esi, eax
mov ecx, dword [ebp - 0x38]
call fcn.00407fd0
cmp esi, eax
jae 0x4058da
lea ecx, [ebp + 8]
push ecx
call fcn.00405a40
add esp, 4
mov byte [ebp - 0x39], al
mov ecx, dword [ebp - 0x38]
call fcn.00407e80
mov dl, byte [ebp - 0x39]
mov byte [eax], dl
mov eax, dword [ebp + 8]
jmp 0x405a25
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x4c], 0
jne 0x4058ed
call fcn.004090f0
jmp 0x405a25
mov ecx, dword [ebp - 0x38]
call fcn.00407a10
mov ecx, dword [ebp - 0x38]
cmp dword [ecx + 0x38], 0
jne 0x405946
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x4c]
mov dword [ebp - 0x54], eax
lea ecx, [ebp + 8]
push ecx
call fcn.00405a40
add esp, 4
mov byte [ebp - 0x3a], al
mov edx, dword [ebp - 0x54]
push edx
movzx eax, byte [ebp - 0x3a]
push eax
call fcn.004039b0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x405936
mov edx, dword [ebp + 8]
mov dword [ebp - 0x48], edx
jmp 0x40593e
call fcn.004090f0
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
jmp 0x405a25
mov dword [ebp - 0x5c], 0x20
lea eax, [ebp + 8]
push eax
call fcn.00405a40
add esp, 4
mov byte [ebp - 0x2a], al
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x58], edx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x29]
push ecx
lea edx, [ebp - 0x2a]
push edx
mov eax, dword [ebp - 0x38]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x58]
call fcn.00407930
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x4059a3
cmp dword [ebp - 0x40], 1
je 0x4059a3
cmp dword [ebp - 0x40], 3
je 0x4059f0
jmp 0x405a20
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x44], ecx
je 0x4059d5
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x44]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.00415483
add esp, 0x10
cmp dword [ebp - 0x44], eax
je 0x4059d5
call fcn.004090f0
jmp 0x405a25
mov ecx, dword [ebp - 0x38]
mov byte [ecx + 0x3d], 1
lea edx, [ebp - 0x2a]
cmp dword [ebp - 0x34], edx
je 0x4059e9
mov eax, dword [ebp + 8]
jmp 0x405a25
call fcn.004090f0
jmp 0x405a25
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
movzx edx, byte [ebp - 0x2a]
push edx
call fcn.004039b0
add esp, 8
movzx eax, al
test eax, eax
je 0x405a13
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x4c], ecx
jmp 0x405a1b
call fcn.004090f0
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
jmp 0x405a25
call fcn.004090f0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040eb0d
mov esp, ebp
pop ebp
ret 4
Function at 0x407aa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x43f04c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x38], 0
je 0x407ac7
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x407ace
mov al, 1
jmp 0x407bb9
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x44], edx
call fcn.004090f0
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x30]
call dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
call fcn.004090f0
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x4c]
push edx
call fcn.00409150
add esp, 8
movzx eax, al
test eax, eax
je 0x407b14
xor al, al
jmp 0x407bb9
mov dword [ebp - 0x54], 0x20
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x50], edx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x30]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x50]
call fcn.0040a0f0
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x407b56
cmp dword [ebp - 0x34], 1
je 0x407b5d
cmp dword [ebp - 0x34], 3
je 0x407bac
jmp 0x407bb7
mov ecx, dword [ebp - 0x30]
mov byte [ecx + 0x3d], 0
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x407b8c
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 1
lea ecx, [ebp - 0x28]
push ecx
call fcn.00415483
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x407b8c
xor al, al
jmp 0x407bb9
mov edx, dword [ebp - 0x30]
movzx eax, byte [edx + 0x3d]
test eax, eax
jne 0x407ba0
mov dword [ebp - 0x3c], 1
jmp 0x407ba7
mov dword [ebp - 0x3c], 0
mov al, byte [ebp - 0x3c]
jmp 0x407bb9
mov ecx, dword [ebp - 0x30]
mov byte [ecx + 0x3d], 0
mov al, 1
jmp 0x407bb9
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040eb0d
mov esp, ebp
pop ebp
ret