joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ac150
Capabilities:
Delete file

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0xc], bl
je 0x4ac1c0
mov eax, dword [esi + 4]
sub eax, ebx
je 0x4ac1bd
dec eax
je 0x4ac191
dec eax
jne 0x4ac1bd
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x4ac1bd
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp eax, 1
jne 0x4ac1bd
mov byte [esi + 0xd], bl
mov dword [esi + 8], ebx
mov dword [esi + 4], 0xffffffff
mov byte [esi + 0xc], bl
mov byte [esi + 0xd], bl
pop esi
pop ebx
ret
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x4ac1bd
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp eax, 1
jne 0x4ac1bd
lea eax, [esi + 0xd]
mov dword [esi + 8], ebx
push eax
mov byte [eax], bl
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [esi + 4], 0xffffffff
mov byte [esi + 0xc], bl
mov byte [esi + 0xd], bl
pop esi
pop ebx
ret

Function at 0x4ac1d0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, dword [esp + 0xc]
mov edi, esi
push ecx
or ecx, 0xffffffff
xor eax, eax
push 0xe041fc
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, esi
push ecx
call fcn.004cf4e1
add esp, 0xc
mov eax, esi
pop edi
pop esi
ret 0xc

Function at 0x4ac210
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
push edi
mov al, byte [esi + 0xc]
test al, al
je 0x4ac269
mov eax, dword [esi + 4]
push ebx
xor edi, edi
xor bl, bl
sub eax, edi
je 0x4ac2d4
dec eax
je 0x4ac2ad
dec eax
jne 0x4ac260
mov eax, dword [esi + 8]
cmp eax, edi
je 0x4ac2d4
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp eax, 1
jne 0x4ac2d4
mov dword [esi + 8], edi
mov byte [esi + 0xd], 0
mov bl, al
mov dword [esi + 4], 0xffffffff
mov byte [esi + 0xc], 0
test bl, bl
mov byte [esi + 0xd], 0
pop ebx
je 0x4ac2d8
mov edi, dword [esp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 8], eax
je 0x4ac2d8
or ecx, 0xffffffff
xor eax, eax
mov byte [esi + 0xc], 1
mov dword [esi + 4], 2
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esi + 0xd]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov al, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret 4
mov eax, dword [esi + 8]
cmp eax, edi
je 0x4ac2d4
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp eax, 1
jne 0x4ac2d4
lea eax, [esi + 0xd]
mov dword [esi + 8], edi
push eax
mov bl, 1
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4ac255
xor bl, bl
jmp 0x4ac260
pop edi
xor al, al
pop esi
ret 4
Function at 0x4ac2e0
Capabilities:
Delete file

Disassembly:
push ebx
push esi
mov esi, ecx
xor bl, bl
mov al, byte [esi + 0xc]
test al, al
je 0x4ac329
mov eax, dword [esi + 4]
sub eax, 0
je 0x4ac36b
dec eax
je 0x4ac32e
dec eax
jne 0x4ac325
mov eax, dword [esi + 8]
test eax, eax
je 0x4ac36b
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp eax, 1
jne 0x4ac36b
mov byte [esi + 0xd], bl
mov dword [esi + 8], 0
mov bl, al
mov dword [esi + 4], 0xffffffff
mov byte [esi + 0xc], 0
mov byte [esi + 0xd], 0
mov al, bl
pop esi
pop ebx
ret
mov eax, dword [esi + 8]
test eax, eax
je 0x4ac36b
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp eax, 1
jne 0x4ac36b
lea eax, [esi + 0xd]
mov dword [esi + 8], 0
push eax
mov bl, 1
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [esi + 4], 0xffffffff
mov byte [esi + 0xc], 0
mov byte [esi + 0xd], 0
mov al, bl
pop esi
pop ebx
ret
xor bl, bl
mov byte [esi + 0xd], bl
mov al, bl
pop esi
pop ebx
ret

Function at 0x4b8640
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0xe36898]
xor edx, edx
cmp eax, edx
jne 0x4b8666
xor eax, eax
mov byte [eax + 0xe36798], al
inc eax
cmp eax, 0x100
jl 0x4b864e
mov dword [0xe36898], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0xe36798
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4b86f7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4b86ca
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4b8698
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4b8700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4b8753
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4b873a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bf0d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ed3be
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004bf9f0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0xdddcf4
call fcn.004ddca6
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4bf163
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004ddca6
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4bf15c
push 0
mov ecx, eax
call fcn.004b6270
mov dword [esi + 0xc], eax
jmp 0x4bf165
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4bf165
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x4cf49b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4cf4bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004cea8a
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4cf4de
test byte [esp + 8], 2
je 0x4cf4de
call fcn.004ceafd
mov dword [eax], 0xd
call fcn.004ceb06
mov dword [eax], 5
jmp 0x4cf4b7
xor eax, eax
ret

Function at 0x4e0333
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4e036b
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004de3c0
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004de398
jmp 0x4e0377
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4e1a21
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4e1a63
call fcn.004e751b
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4e1a63
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4e1a5a
xor eax, eax
jmp 0x4e1a6b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004e1a71
pop edi
pop esi
pop ebx
ret 4
Function at 0x4e7a4b
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4e7a79
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4e7a97
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004e79b1
jmp 0x4e7a97
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4e7a97
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004e79b1
test edi, edi
mov eax, edi
jne 0x4e7a81
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401611
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
lea ecx, [esi + 8]
call fcn.0040f707
push dword [ebp + 0xc]
lea edi, [esi + 0xc]
mov ecx, edi
call fcn.00401370
push 0x5c
mov ecx, edi
call fcn.00401526
xor edi, edi
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x4012e3
push edi
push edi
mov dword [0x4197a4], esi
mov dword [0x4197ac], edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
cmp dword [0x4197ec], 2
mov dword [0x4197a8], eax
je 0x40166e
call fcn.0040851f
push 0xffffffffffffffff
push dword [0x4197a8]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov eax, dword [0x4197ac]
cmp eax, edi
mov dword [0x419880], edi
je 0x4016bd
cmp eax, 1
je 0x4016b1
cmp eax, 2
je 0x4016ad
cmp eax, 3
je 0x4016a9
cmp eax, 0x67
jle 0x4016a4
cmp eax, 0x6a
jle 0x401721
push eax
push 0x14
jmp 0x4016f4
push 0x12
jmp 0x4016b3
push 0x13
jmp 0x4016b3
push 0x11
push edi
call fcn.00408dbf
pop ecx
pop ecx
jmp 0x401721
cmp dword [0x419888], edi
jne 0x401721
lea eax, [ebp + 8]
push eax
push dword [0x4197a8]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeThread]
test eax, eax
mov ecx, dword [ebp + 8]
je 0x4016e4
cmp ecx, edi
jne 0x4016e4
xor eax, eax
jmp 0x401726
mov eax, 0x80070000
mov edx, ecx
and edx, eax
cmp edx, eax
je 0x4016f7
push ecx
push 0x21
push edi
jmp 0x401719
and ecx, 0xffff
cmp ecx, 0xe
jne 0x40170b
cmp dword [0x4197f0], 0xffffffff
je 0x401721
push ecx
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push dword [ebp + 8]
push 0x22
push 1
call fcn.00408dbf
add esp, 0xc
mov eax, 0x80004005
pop edi
pop esi
leave
ret 8

Function at 0x401b75
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
push 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x401bb6
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, 0xb7
cmp eax, esi
je 0x401ba0
push eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
xor eax, eax
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401bb6
test al, 0x10
jne 0x401bb6
push esi
jmp 0x401b96
xor eax, eax
inc eax
pop esi
ret
Function at 0x40411c
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4040c7
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4040e5
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x404143
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
add byte [eax], al
invalid
add byte [eax], al
or byte [ebx - 0x2cc4e7b3], 0x74
add al, 0x80
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40412a
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x404133
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40413d
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40411f
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4040a9
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x404255
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax - 0x3a]
test dword [eax + 0x56fffffc], edi
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.00403a00
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004039b5
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.00403a00
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004039b5
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82

Function at 0x406e05
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push eax
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov ecx, dword [ebp + 8]
push eax
mov dword [ecx], eax
call fcn.00406db8
add esp, 0x1c
leave
ret
Function at 0x417250
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x483068]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, 0xffff
mov esi, ecx
cmp ax, di
jne 0x417285
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004290a8
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push ebx
mov ecx, dword [eax]
test ecx, ecx
je 0x4172c3
mov edx, dword [esi + 0x30]
mov ebx, dword [edx]
lea eax, [ecx + ebx*2]
cmp ecx, eax
jae 0x4172c3
lea ecx, [ebx - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
pop ebx
mov ax, di
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004290a8
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x4173a1
mov ebx, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [ebx], eax
jne 0x4172ed
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov eax, dword [esi + 0x1c]
sar edx, 1
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x417326
push dword [esi + 0x4c]
push edi
call fcn.00445c86
mov ecx, 0xffff
add esp, 8
cmp ax, cx
movzx eax, di
jne 0x4173a6
pop ebx
pop edi
mov eax, ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004290a8
mov esp, ebp
pop ebp
ret 4
movzx eax, di
mov dword [ebp - 0x28], eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call edx
test eax, eax
js 0x4173a1
cmp eax, 1
jle 0x417374
cmp eax, 3
jne 0x4173a1
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.0040bab0
add esp, 8
test al, al
movzx eax, di
jne 0x4173a6
jmp 0x4173a1
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub ebx, eax
je 0x417391
push dword [esi + 0x4c]
push ebx
push 1
push eax
call fcn.00447809
add esp, 0x10
cmp ebx, eax
jne 0x4173a1
lea eax, [ebp - 0x28]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x30], eax
jne 0x4172ad
mov eax, 0xffff
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.004290a8
mov esp, ebp
pop ebp
ret 4
Function at 0x417d40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x417e28
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x417e17
jg 0x417d80
test edx, edx
je 0x417e17
nop dword [eax]
call fcn.00407320
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x417dd4
jg 0x417d97
test esi, esi
je 0x417dd4
cmp ebx, eax
jg 0x417da7
jl 0x417da1
cmp edi, esi
jae 0x417da7
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.00440140
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x417dfb
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x417e11
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x417d80
jl 0x417e11
test edi, edi
jne 0x417d80
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x417e4a
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x417e4c
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x417eca
jg 0x417e5f
test esi, esi
je 0x417eca
test eax, eax
jl 0x417ea4
jg 0x417e69
test ebx, ebx
je 0x417ea4
cmp edi, eax
jg 0x417e79
jl 0x417e73
cmp esi, ebx
jae 0x417e79
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.00440140
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov eax, dword [ecx + 0x30]
sbb edi, dword [esp + 0x14]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
jmp 0x417ea7
mov edx, dword [ebp + 8]
test edi, edi
jl 0x417eca
jg 0x417eb1
test esi, esi
je 0x417eca
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x417eca
push eax
push esi
push 1
push edx
call fcn.00447809
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x417ee0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x417fcb
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x417fba
jg 0x417f20
test edx, edx
je 0x417fba
nop dword [eax]
call fcn.00419020
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x417f77
jg 0x417f37
test esi, esi
je 0x417f77
cmp ebx, eax
jg 0x417f47
jl 0x417f41
cmp edi, esi
jae 0x417f47
mov esi, edi
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0xc]
push esi
mov eax, dword [eax + 0x1c]
push dword [eax]
push dword [esp + 0x18]
call fcn.00440140
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x10]
jmp 0x417f9c
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x417fb4
mov eax, dword [esp + 0x10]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
mov byte [eax], cl
mov ecx, dword [esp + 0xc]
add eax, esi
mov dword [esp + 0x10], eax
test ebx, ebx
jg 0x417f20
jl 0x417fb4
test edi, edi
jne 0x417f20
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x1c]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x417fed
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax]
jmp 0x417fef
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x4180a5
jg 0x41800a
test esi, esi
je 0x4180a5
test eax, eax
jl 0x418053
jg 0x418014
test ebx, ebx
je 0x418053
cmp edi, eax
jg 0x418024
jl 0x41801e
cmp esi, ebx
jae 0x418024
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [esp + 0x14]
push dword [ebp + 8]
call fcn.00440140
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov dword [esp + 0x10], edx
mov eax, dword [ecx + 0x2c]
sbb edi, dword [esp + 0x14]
sub dword [eax], ebx
mov eax, dword [ecx + 0x1c]
add dword [eax], ebx
jmp 0x41805a
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test edi, edi
jl 0x4180a5
jg 0x418064
test esi, esi
je 0x4180a5
mov edx, dword [ecx + 0x4c]
test edx, edx
je 0x4180a5
mov ebx, dword [ecx + 0xc]
lea eax, [ecx + 0x3c]
cmp dword [ebx], eax
jne 0x418090
mov edx, dword [ecx + 0x54]
mov ecx, dword [ecx + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov edx, dword [ebx + 0x4c]
push edx
push esi
push 1
push dword [esp + 0x1c]
call fcn.00447be8
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc