joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418bf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x10]
push ecx
push edx
lea esi, [eax + 0x954]
push esi
push eax
mov dword [ebp - 0x10], 0x65746e49
mov dword [ebp - 0xc], 0x74656e72
mov dword [ebp - 8], 0x6e65704f
mov word [ebp - 4], 0x41
call fcn.00419280
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x418c4e
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x418c60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x958]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x6e6e6f43
mov dword [ebp - 8], 0x41746365
mov byte [ebp - 4], 0
call fcn.00419280
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x418ccf
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x418ce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x95c]
push esi
push eax
mov dword [ebp - 0x14], 0x70747448
mov dword [ebp - 0x10], 0x6e65704f
mov dword [ebp - 0xc], 0x75716552
mov dword [ebp - 8], 0x41747365
mov byte [ebp - 4], 0
call fcn.00419280
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x418d4f
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x418d60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x960]
push esi
push eax
mov dword [ebp - 0x14], 0x70747448
mov dword [ebp - 0x10], 0x646e6553
mov dword [ebp - 0xc], 0x75716552
mov dword [ebp - 8], 0x41747365
mov byte [ebp - 4], 0
call fcn.00419280
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x418dc3
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x418dd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x964]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x64616552
mov dword [ebp - 8], 0x656c6946
mov byte [ebp - 4], 0
call fcn.00419280
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x418e2f
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x418e40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x968]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x736f6c43
mov dword [ebp - 8], 0x6e614865
mov dword [ebp - 4], 0x656c64
call fcn.00419280
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x418e96
mov eax, dword [ebp + 0xc]
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x419680
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x4196e6
cmp dword [esi + 0x18], 0
je 0x419701
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041b030
add esp, 8
test eax, eax
jne 0x4196de
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x4196c0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x419701
mov eax, dword [esi + 0x18]
test eax, eax
je 0x419701
cmp eax, ecx
je 0x4196de
mov esi, dword [esi]
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x4196f4
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x419710
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x419768
cmp dword [esi + 0x18], 0
je 0x419768
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041b030
add esp, 8
test eax, eax
jne 0x419770
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x419750
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x419780
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x4197d8
cmp dword [esi + 0x18], 0
je 0x4197d8
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041b030
add esp, 8
test eax, eax
jne 0x4197e0
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x4197c0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x30]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x419890
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
xor ecx, ecx
test edx, edx
je 0x4198d4
cmp dword [eax + 0x18], 0
je 0x4198d4
mov eax, dword [eax]
inc ecx
cmp ecx, edx
jb 0x4198c7
mov esp, ebp
pop ebp
ret

Function at 0x4198e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push edi
push 0x103
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call fcn.0041a130
add esp, 0xc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 8], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
cmp dword [esi + 0x18], 0
je 0x41996b
mov edi, dword [ebp + 8]
lea esp, [esp]
mov eax, dword [esi + 0x30]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0041a750
lea edx, [ebp - 0x10c]
push edx
push edi
call fcn.00413de0
add esp, 0x10
test eax, eax
jne 0x419973
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x419940
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x419de0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x419dee
xor eax, eax
pop ebp
ret
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x419dea
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x419dea
mov edx, dword [ebp + 8]
push esi
mov dword [edx], eax
mov esi, dword [eax + 0x3c]
add esi, eax
mov dword [edx + 4], esi
mov ecx, dword [ecx + eax + 0x78]
add ecx, eax
mov dword [edx + 8], ecx
mov eax, 1
pop esi
pop ebp
ret

Function at 0x419e60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x419e84
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x419e84
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x419e8c
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x50]
mov eax, dword [ebp + 8]
push esi
inc edx
push edx
push eax
call fcn.0041a260
mov ecx, dword [ebx + 0x50]
mov esi, eax
push ecx
push esi
call fcn.0041a0e0
mov edx, dword [ebx + 0x54]
push edx
push edi
push esi
call fcn.0041a0b0
xor edx, edx
xor eax, eax
add esp, 0x1c
mov dword [ebp - 4], edx
cmp ax, word [ebx + 6]
jae 0x419f1e
mov dword [ebp + 0xc], edx
jmp 0x419ec9
xor edx, edx
mov ecx, dword [edi + 0x3c]
add ecx, dword [ebp + 0xc]
lea eax, [ecx + esi + 0xf8]
mov ecx, dword [eax + 0x10]
cmp ecx, edx
jne 0x419ee0
mov dword [eax + 0x14], edx
mov edx, dword [eax + 8]
cmp ecx, edx
jbe 0x419ef6
push edx
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add edx, edi
push edx
add eax, esi
push eax
jmp 0x419f03
mov edx, dword [eax + 0xc]
push ecx
mov ecx, dword [eax + 0x14]
add ecx, edi
push ecx
add edx, esi
push edx
call fcn.0041a0b0
mov eax, dword [ebp - 4]
movzx ecx, word [ebx + 6]
add dword [ebp + 0xc], 0x28
inc eax
add esp, 0xc
mov dword [ebp - 4], eax
cmp eax, ecx
jb 0x419ec7
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x419f30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x419f50
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x419f50
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
je 0x419f54
xor eax, eax
pop ebp
ret
mov eax, dword [eax + ecx + 0x2c]
add eax, ecx
pop ebp
ret

Function at 0x419fd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x419ff0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x419ff0
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx], 0x4550
je 0x419ff4
xor eax, eax
pop ebp
ret
mov eax, dword [eax + edx + 0x28]
test eax, eax
je 0x419ff0
add eax, dword [ebp + 0xc]
pop ebp
ret
Function at 0x41ad10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
cmp esi, 0x5d
jae 0x41af4c
push ebx
push edi
push 0x773
push eax
mov byte [ebp - 0x1c], al
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
lea eax, [ebp - 0x793]
mov cl, 0xe7
push eax
mov dword [ebp - 0x20], 0x6c6c642e
mov dword [ebp - 0x820], 0xbee14005
mov dword [ebp - 0x81c], 0xc8066c2a
mov dword [ebp - 0x818], 0xccdfc1a9
mov dword [ebp - 0x814], 0xe245063a
mov dword [ebp - 0x810], 0x3ad226d0
mov dword [ebp - 0x80c], 0x8450707
mov dword [ebp - 0x808], 0xe0c8cb23
mov dword [ebp - 0x804], 0x4337a708
mov dword [ebp - 0x800], 0x57e44962
mov dword [ebp - 0x7fc], 0xa6aa08e7
mov dword [ebp - 0x7f8], 0x6525dcb0
mov dword [ebp - 0x7f4], 0x7b08e760
mov dword [ebp - 0x7f0], 0x1eb386be
mov dword [ebp - 0x7ec], 0x8e7a01f
mov dword [ebp - 0x7e8], 0xefa2d823
mov dword [ebp - 0x7e4], 0xe7a01f26
mov dword [ebp - 0x7e0], 0xa8fc2209
mov dword [ebp - 0x7dc], 0x4f1cc7ee
mov dword [ebp - 0x7d8], 0xef094116
mov dword [ebp - 0x7d4], 0x8ca89392
mov dword [ebp - 0x7d0], 0x4157a323
mov dword [ebp - 0x7cc], 0x9f8f1d09
mov dword [ebp - 0x7c8], 0xa3269dc3
mov dword [ebp - 0x7c4], 0x74094157
mov dword [ebp - 0x7c0], 0x507d60c3
mov dword [ebp - 0x7bc], 0x41107c91
mov dword [ebp - 0x7b8], 0x6357590b
mov dword [ebp - 0x7b4], 0x1deab58a
mov dword [ebp - 0x7b0], 0xf708ac79
mov dword [ebp - 0x7ac], 0x73ade308
mov dword [ebp - 0x7a8], 0xa1651ec6
mov dword [ebp - 0x7a4], 0xca3d06e7
mov dword [ebp - 0x7a0], 0x3ad226c4
mov dword [ebp - 0x79c], 0xb2fc3308
mov dword [ebp - 0x798], 0x615506cf
mov byte [ebp - 0x794], cl
call fcn.0041a130
add esp, 0xc
lea eax, [ebp - 0x820]
test esi, esi
je 0x41aedc
dec esi
movzx ecx, byte [eax]
lea eax, [eax + ecx + 1]
jne 0x41aed2
lea esi, [eax + 1]
movzx eax, byte [eax]
lea edx, [ebp - 0x20]
push edx
push eax
push esi
call fcn.00409a30
xor eax, eax
add esp, 0xc
cmp byte [esi], al
je 0x41aefd
inc eax
cmp byte [esi + eax], 0
jne 0x41aef6
mov ebx, dword [ebp + 8]
inc eax
push eax
push esi
push ebx
call fcn.0041a0b0
add esp, 0xc
xor edi, edi
cmp byte [ebx], 0
je 0x41af1a
inc edi
cmp byte [edi + ebx], 0
jne 0x41af13
xor esi, esi
cmp byte [ebp - 0x20], 0
je 0x41af2a
inc esi
cmp byte [ebp + esi - 0x20], 0
jne 0x41af22
test esi, esi
je 0x41af3f
push esi
lea ecx, [ebp - 0x20]
lea eax, [edi + ebx]
push ecx
push eax
call fcn.0041a100
add esp, 0xc
add esi, edi
pop edi
mov byte [esi + ebx], 0
mov eax, 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x406280
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c363
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x43d054]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [0x42e094]
mov edx, eax
lea ecx, [ebp - 0xa0]
call fcn.004061e0
mov edi, eax
mov dword [ebp - 4], 0
call dword [0x42e094]
mov edx, eax
lea ecx, [ebp - 0x88]
call fcn.00405970
push eax
mov edx, 0x439aac
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x70]
call fcn.0040d190
push 0x439a9c
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
call fcn.0040d200
push edi
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x40]
call fcn.0040d360
push 0x439a90
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
call fcn.0040d200
add esp, 0x10
lea ecx, [ebp - 0x40]
call fcn.00402ce0
lea ecx, [ebp - 0x58]
call fcn.00402ce0
lea ecx, [ebp - 0x70]
call fcn.00402ce0
lea ecx, [ebp - 0x88]
call fcn.00402ce0
lea ecx, [ebp - 0xa0]
call fcn.00402ce0
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.00402cd0
push eax
push 0x439ac0
push 0
push 0
call dword [0x42e1d0]
push 0
call fcn.0041859d
int3
Function at 0x40bfc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c7af
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x43d054]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0
mov dword [ebx], 0x439c5c
mov dword [ebp - 0x1c], eax
mov dword [ebx + 0x70], 0
mov dword [ebx + 0x90], 0
mov dword [ebx + 0x94], 0
mov dword [ebx + 0x98], 0
mov dword [ebx + 0x68], 0x439c58
mov dword [ebp - 4], 0
lea esi, [ebx + 4]
mov eax, dword [ebx]
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x18], esi
mov eax, dword [eax + 4]
mov dword [ebx + eax], 0x439d20
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
push ecx
push esi
lea eax, [ecx - 8]
mov dword [ecx + ebx - 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
add ecx, ebx
call fcn.0040ce80
mov dword [ebp - 4], 2
mov eax, dword [ebx]
mov dword [ebp - 0x14], esi
mov eax, dword [eax + 4]
mov dword [ebx + eax], 0x439c50
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ecx + ebx - 4], eax
mov ecx, esi
call fcn.0040cdb0
lea eax, [ebx + 4]
lea ebx, [eax + 4]
mov dword [eax], 0x439c10
mov dword [eax + 0xc], ebx
lea ecx, [eax + 0x18]
mov dword [eax + 0x20], ecx
lea esi, [eax + 8]
mov byte [eax + 0x48], 0
lea edi, [eax + 0x14]
mov byte [eax + 0x3d], 0
lea edx, [eax + 0x24]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [0x43edb4]
mov dword [eax], 0
mov eax, dword [0x43edb0]
mov dword [ebx], 0
mov ebx, dword [ebp - 0x18]
mov dword [edi], 0
mov dword [edx], 0
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], ecx
mov dword [ebx + 0x38], 0
mov byte [ebp - 4], 3
cmp dword [ebx + 0x4c], 0
jne 0x40c195
push 0x40
push 2
push dword [ebp - 0x1c]
call fcn.0040ef44
add esp, 0xc
test eax, eax
je 0x40c195
push 1
push eax
mov ecx, ebx
call fcn.0040cc30
mov eax, dword [ebx + 0x34]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 4
push eax
call fcn.0040d400
add esp, 4
mov ecx, ebx
push eax
call fcn.0040cad0
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x40c17e
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x40c17e
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [ebp - 0x10]
push 0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
xor eax, eax
add ecx, esi
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00404a80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40cb60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x43d054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40cc1a
cmp byte [esi + 0x3d], 0
je 0x40cc1a
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40cc08
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40cbd0
sub eax, 1
je 0x40cbd4
sub eax, 2
jne 0x40cc08
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f4cf
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40cbf1
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00418ef8
add esp, 0x10
cmp edi, eax
jne 0x40cc08
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f4cf
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f4cf
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0040f4cf
mov esp, ebp
pop ebp
ret

Function at 0x40cdb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push fcn.0042c810
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x43d054]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], 0x439bb0
call fcn.0040f6df
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0040eb96
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4206f3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00420569
Function at 0x10001b24
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0
mov edi, ecx
mov eax, dword [esi]
push 0x80
mov dword [ebp - 4], eax
mov eax, dword [esi + 4]
push 3
mov dword [ebp + 8], eax
push 0
push 2
lea eax, [edi + 0x18]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 8]
push 0
push eax
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff8
add esi, 8
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov ecx, dword [0x1000ae40]
add dword [ebp + 8], eax
lea eax, [ebp - 4]
push 4
push eax
lea eax, [ebp - 0x13]
mov byte [ebp - 0x14], 0xdb
push eax
call fcn.100056b3
mov ecx, dword [0x1000ae40]
lea eax, [ebp + 8]
push 4
push eax
lea eax, [ebp - 0xf]
push eax
call fcn.100056b3
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x14]
push 9
push eax
mov ecx, edi
call fcn.10004b63
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x10001bda
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
push 0
mov esi, ecx
push 0x80
push 3
push 0
push 0
lea eax, [esi + 0x18]
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10001c17
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.10001c92
jmp 0x10001c8c
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1000ae40]
lea eax, [ebp - 4]
push 4
push eax
lea eax, [ebp - 0x17]
mov byte [ebp - 0x18], 0xdd
push eax
call fcn.100056b3
mov ecx, dword [0x1000ae40]
lea eax, [ebp - 8]
push 4
push eax
lea eax, [ebp - 0x13]
push eax
call fcn.100056b3
mov ecx, dword [0x1000ae40]
push 4
lea eax, [ebp - 0xf]
push 0x1000ae44
push eax
call fcn.100056b3
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x18]
push 0xd
push eax
mov ecx, esi
call fcn.10004b63
pop edi
pop esi
leave
ret 4