joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4095ad
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40964a
push ebx
push esi
call fcn.00409576
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040950a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4095f7
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x409649
push edi
push eax
call fcn.00407ef7
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x409617
call fcn.00408052
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x409648
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040950a
add esp, 0x20
test eax, eax
jne 0x409636
push edi
call fcn.00408052
jmp 0x40963e
push ebx
call fcn.00408052
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4098b7
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x411ac0
push 0x411ab8
push str.FlsAlloc
push 0x1f
call fcn.004097d3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4098eb
push dword [ebp + 8]
mov ecx, esi
call dword [0x410178]
call esi
jmp 0x4098f1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x409935
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x411ad0
push 0x411ac8
push str.FlsGetValue
push 0x21
call fcn.004097d3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40996c
push dword [ebp + 8]
mov ecx, esi
call dword [0x410178]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x409974
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x411ad8
push 0x411ad0
push str.FlsSetValue
push 0x22
call fcn.004097d3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4099ae
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x410178]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40f320
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40f34d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40f34d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x403b2f
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push dword [ebp + 8]
call fcn.00403d35
push 0x5b
push eax
mov dword [ebp - 8], eax
call fcn.00407830
mov edi, eax
xor ebx, ebx
add esp, 0xc
cmp edi, ebx
je 0x403bf0
push esi
inc edi
push 0x5d
push edi
call fcn.00407830
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x403bef
mov byte [esi], bl
inc esi
push 0x3d
push esi
call fcn.00407830
pop ecx
pop ecx
cmp eax, ebx
je 0x403bef
mov byte [eax], bl
lea eax, [ebp - 4]
push eax
push 0x20006
push ebx
push edi
push dword [section..data]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403bb4
push ebx
push str.Could_not_open_key
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x403be6
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
je 0x403bdd
cmp eax, 2
je 0x403bdd
push ebx
push str.Could_not_delete_value
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call fcn.00403d35
pop ecx
pop esi
pop edi
pop ebx
leave
ret

Function at 0x403d35
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x403d44
pop dword [ebp - 0x14]
mov eax, 0xe34cf3a
add eax, 0xf20b6e0a
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xed56574b
add dword [ebp - 0x24], 0x60fbee00
mov dword [ebp - 0x20], 0x526dc01
sub dword [ebp - 0x20], 0xd2f38fbc
mov dword [ebp - 0x1c], 0x91322a1d
sub dword [ebp - 0x1c], 0x44e5e5ef
mov dword [ebp - 0x18], 0x5fa7741d
add dword [ebp - 0x18], 0xa0588be3
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xa84e4623
sub dword [ebp - 0x24], 0x33dbdccd
mov dword [ebp - 0x20], 0xe52f0a30
add dword [ebp - 0x20], 0x5c3d5745
mov dword [ebp - 0x1c], 0x53078b95
add dword [ebp - 0x1c], 0x1067e0d7
mov dword [ebp - 0x18], 0x455307d9
add dword [ebp - 0x18], 0xbaacf827
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3eba3
push 0
call eax
mov ecx, 0x38e77a
add ecx, 0xffc763ed
xor edi, edi
add edi, eax
mov ebx, 0x434400
add ebx, dword [ebp - 0x14]
mov edx, 0x533ba74e
xor dword [ebp - 8], 0x41617f91
mov esi, dword [ebx]
xor esi, edx
add dword [ebp - 4], ecx
mov dword [edi], esi
xor dword [ebp - 0x10], 0xd352c63c
add edi, 4
add ebx, 0xa61e6952
add ebx, 0x59e196b2
loop 0x403e52
add eax, 0x1206f
mov ebx, eax
add eax, 5
mov ecx, 0xfc00c9b5
add ecx, 0x43f364b
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x4012f0
Capabilities:
Create thread
Terminate thread

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
call fcn.00402040
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x1c], ebx
je 0x40147d
call fcn.00402040
test eax, eax
mov dword [esp + 0x10], eax
je 0x40147d
mov ebp, dword [esp + 0x50]
mov esi, dword [sym.imp.MSVCRT.dll_printf]
push ebp
push str.___Listening_port__d_......_r_n
call esi
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x20
push eax
call dword [sym.imp.MSVCRT.dll_fflush]
push ebp
push ebx
call fcn.00402070
add esp, 0x14
test eax, eax
jne 0x401359
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
push str.___Listen_OK__r_n
call esi
mov edi, dword [esp + 0x58]
push edi
push str.___Listening_port__d_......_r_n
call esi
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
add ecx, 0x20
push ecx
call dword [sym.imp.MSVCRT.dll_fflush]
mov edx, dword [esp + 0x20]
push edi
push edx
call fcn.00402070
add esp, 0x18
test eax, eax
jne 0x4013a1
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
push str.___Listen_OK__r_n
call esi
mov eax, 0x10
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push ebp
push str.___Waiting_for_Client_on_port:_d_......_r_n
call esi
add esp, 8
lea ecx, [esp + 0x14]
lea edx, [esp + 0x2c]
push ecx
push edx
push ebx
call dword [sym.imp.WS2_32.dll_accept]
mov ebx, eax
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push ebp
push str.___Accept_a_Client_on_port__d_from__s_......_r_n
call esi
push edi
push str.___Waiting_another_Client_on_port:_d...._r_n
call esi
mov eax, dword [esp + 0x24]
add esp, 0x14
lea ecx, [esp + 0x18]
lea edx, [esp + 0x3c]
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_accept]
mov ecx, dword [esp + 0x40]
mov ebp, eax
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push edi
push str.___Accept_a_Client_on_port__d_from__s_r_n
call esi
push str.___Accept_Connect_OK__r_n
call esi
add esp, 0x10
lea edx, [esp + 0x20]
lea eax, [esp + 0x24]
mov dword [esp + 0x24], ebx
push edx
push 0
push eax
push 0x4018b0
push 0
push 0
mov dword [esp + 0x40], ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x401473
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.___CreateThread_OK__r_n_n
call esi
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x54]
add esp, 4
jmp 0x4013b8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
Function at 0x401490
Capabilities:
Create thread
Send data
Send data on socket
Terminate thread

Disassembly:
sub esp, 0x424
push esi
mov esi, dword [esp + 0x42c]
cmp esi, 0xffff
push edi
jg 0x401689
cmp esi, 1
jl 0x401689
mov eax, dword [esp + 0x438]
cmp eax, 0xffff
jg 0x401672
cmp eax, 1
jl 0x401672
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
call fcn.00402040
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 8], edi
je 0x401697
push esi
push edi
call fcn.00402070
add esp, 8
test eax, eax
jne 0x40150e
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
add esp, 0x424
ret
push ebx
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_printf]
mov dword [esp + 0x14], 0x10
push str.___Waiting_for_Client_......_r_n
call ebp
add esp, 4
lea eax, [esp + 0x14]
lea ecx, [esp + 0x24]
push eax
push ecx
push edi
call dword [sym.imp.WS2_32.dll_accept]
mov edx, dword [esp + 0x26]
mov ebx, eax
push edx
call dword [sym.imp.WS2_32.dll_ntohs]
and eax, 0xffff
push eax
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push str.___Accept_a_Client_from__s:_d_......_r_n
call ebp
add esp, 0xc
call fcn.00402040
mov esi, eax
test esi, esi
jne 0x401576
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x40151e
mov ecx, dword [esp + 0x440]
mov edi, dword [esp + 0x43c]
push ecx
push edi
push str.___Make_a_Connection_to__s:_d_......_r_n
call ebp
mov edx, dword [sym.imp.MSVCRT.dll__iob]
add edx, 0x20
push edx
call dword [sym.imp.MSVCRT.dll_fflush]
mov eax, dword [esp + 0x450]
push eax
push edi
push esi
call fcn.00402120
add esp, 0x1c
test eax, eax
jne 0x40160e
mov ecx, dword [esp + 0x440]
lea edx, [esp + 0x34]
push ecx
push edi
push str._SERVER_connection_to__s:_d_error_r_n
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edi, [esp + 0x44]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0
lea eax, [esp + 0x38]
push ecx
push eax
push ebx
call dword [sym.imp.WS2_32.dll_send]
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x34]
push ebx
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
call edi
push esi
call edi
mov edi, dword [esp + 0x10]
jmp 0x40151e
push str.___Connect_OK__r_n
call ebp
add esp, 4
lea ecx, [esp + 0x20]
lea edx, [esp + 0x18]
mov dword [esp + 0x18], ebx
push ecx
push 0
push edx
push 0x4018b0
push 0
push 0
mov dword [esp + 0x34], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40165d
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.___CreateThread_OK__r_n_n
call ebp
mov edi, dword [esp + 0x14]
add esp, 4
jmp 0x40151e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x424
ret
push str.____TransmitPort_invalid._r_n
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 4
pop edi
pop esi
add esp, 0x424
ret
push str.____ConnectPort_invalid._r_n
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 4
pop edi
pop esi
add esp, 0x424
ret
Function at 0x4016a0
Capabilities:
Create thread
Receive data
Receive data on socket
Send data
Send data on socket
Terminate thread

Disassembly:
mov eax, 0x5114
call fcn.00402220
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_printf]
push ebp
push esi
push edi
call fcn.00402040
mov esi, eax
test esi, esi
je 0x401899
call fcn.00402040
mov ebp, eax
test ebp, ebp
je 0x401899
mov edi, dword [esp + 0x512c]
mov eax, dword [esp + 0x5128]
push edi
push eax
push str.___Make_a_Connection_to__s:_d...._r_n
call ebx
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
add ecx, 0x20
push ecx
call dword [sym.imp.MSVCRT.dll_fflush]
mov edx, dword [esp + 0x5138]
push edi
push edx
push esi
call fcn.00402120
add esp, 0x1c
test eax, eax
jne 0x40171d
push esi
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
call esi
push ebp
call esi
jmp 0x4016b4
mov ecx, 0x1400
xor eax, eax
lea edi, [esp + 0x124]
rep stosd dword es:[edi], eax
lea edi, [esi + 1]
push str.select
push str.ws2_32.dll
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
lea ecx, [esp + 0x28]
push 0
push ecx
push edi
call eax
cmp eax, 0xffffffff
jne 0x401775
call sub.MSVCRT.dll__errno
cmp dword [eax], 0x2714
jne 0x4017ac
jmp 0x401730
lea edx, [esp + 0x20]
push edx
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x40178e
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401730
push 0
lea eax, [esp + 0x128]
push 0x5000
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
mov dword [esp + 0x10], eax
jg 0x4017bb
push str.____There_is_a_error...Create_a_new_connection._r_n
call ebx
add esp, 4
jmp 0x4016b4
push str.___Connect_OK__r_n
call ebx
mov edi, dword [esp + 0x5138]
mov ecx, dword [esp + 0x5134]
push edi
push ecx
push str.___Make_a_Connection_to__s:_d...._r_n
call ebx
mov edx, dword [sym.imp.MSVCRT.dll__iob]
add edx, 0x20
push edx
call dword [sym.imp.MSVCRT.dll_fflush]
mov eax, dword [esp + 0x5144]
push edi
push eax
push ebp
call fcn.00402120
add esp, 0x20
test eax, eax
jne 0x40180d
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
push esi
call edi
push ebp
call edi
jmp 0x4017bb
mov ecx, dword [esp + 0x10]
push 0
lea edx, [esp + 0x128]
push ecx
push edx
push ebp
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x401834
push str.____Send_failed._r_n
call ebx
add esp, 4
jmp 0x4017bb
mov ecx, 0x1400
xor eax, eax
lea edi, [esp + 0x124]
push str.___All_Connect_OK__r_n
rep stosd dword es:[edi], eax
call ebx
add esp, 4
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], esi
push eax
push 0
push ecx
push 0x4018b0
push 0
push 0
mov dword [esp + 0x30], ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40188f
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.___CreateThread_OK__r_n_n
call ebx
add esp, 4
jmp 0x4016b4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5114
ret
Function at 0x402040
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
test eax, eax
jge 0x402060
push str.____Create_socket_error._r_n
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 4
xor eax, eax
ret

Function at 0x402070
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x14
mov ecx, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 4], eax
push esi
mov dword [esp + 0xc], eax
push ecx
mov dword [esp + 0x14], eax
mov dword [esp + 8], 1
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_htons]
push 0
mov word [esp + 0xe], ax
mov word [esp + 0xc], 2
call dword [sym.imp.WS2_32.dll_htonl]
mov esi, dword [esp + 0x1c]
lea edx, [esp + 4]
push 4
push edx
push 4
push 0xffff
push esi
mov dword [esp + 0x20], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [esp + 8]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jge 0x4020f1
push str.____Socket_bind_error._r_n
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 4
xor eax, eax
pop esi
add esp, 0x14
ret
push 5
push esi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
jge 0x402113
push str.____Socket_Listen_error._r_n
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 4
xor eax, eax
pop esi
add esp, 0x14
ret
mov eax, 1
pop esi
add esp, 0x14
ret

Function at 0x402120
Capabilities:
Connect socket

Disassembly:
sub esp, 0x10
push esi
push edi
push str.gethostbyname
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [esp + 0x20]
push edi
call eax
mov esi, eax
test esi, esi
jne 0x40216f
call sub.MSVCRT.dll__errno
mov eax, dword [eax]
push eax
call dword [sym.imp.MSVCRT.dll_strerror]
push eax
push edi
push str.____Gethostbyname__s__error:_s_n
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 0x10
xor eax, eax
pop edi
pop esi
add esp, 0x10
ret
mov edx, dword [esp + 0x24]
xor ecx, ecx
mov dword [esp + 8], ecx
push edx
mov dword [esp + 0x10], ecx
mov word [esp + 0xc], 2
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0xa], ax
mov eax, dword [esi + 0xc]
push 0x10
mov ecx, dword [eax]
lea eax, [esp + 0xc]
push eax
mov edx, dword [ecx]
mov ecx, dword [esp + 0x24]
push ecx
mov dword [esp + 0x18], edx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jge 0x4021cf
push str.____Connect_error._r_n
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 4
xor eax, eax
pop edi
pop esi
add esp, 0x10
ret
pop edi
mov eax, 1
pop esi
add esp, 0x10
ret
Function at 0x40224f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4030e0
push 0x402390
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x404658], 0xffffffff
or dword [0x40465c], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x404654]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x404650]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x404660], eax
call fcn.00402381
cmp dword [0x404630], 0
jne 0x4022d2
push 0x40237e
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.0040236c
push 0x40400c
push 0x404008
call sub.MSVCRT.dll__initterm
mov eax, dword [0x40464c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x404648]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x404004
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call section..text
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x401f40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x110], 0
cmp dword [ebp + 8], 0
jne 0x401f6d
mov eax, 8
jmp 0x4020d2
push 0x104
push 0
lea eax, [ebp - 0x104]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
push 0x104
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.ntdll.dll_strncpy]
add esp, 0xc
push 0x4bbc88
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jne 0x401fc7
mov eax, 6
jmp 0x4020d2
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401bd0
add esp, 4
mov dword [ebp - 0x108], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x108]
mov dword [edx], eax
mov ecx, dword [ebp - 0x108]
add ecx, 1
push ecx
call fcn.004017e0
add esp, 4
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
jne 0x402030
cmp dword [ebp - 0x110], 0
je 0x40201c
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [ebp - 0x110], 0
mov eax, 9
jmp 0x4020d2
mov edx, dword [ebp - 0x110]
push edx
mov eax, dword [ebp - 0x108]
push eax
push 1
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x108]
je 0x4020ad
mov ecx, dword [ebp + 0xc]
cmp dword [ecx], 0
je 0x40207a
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0
cmp dword [ebp - 0x110], 0
je 0x40209c
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [ebp - 0x110], 0
mov eax, 6
jmp 0x4020d2
cmp dword [ebp - 0x110], 0
je 0x4020c6
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [ebp - 0x110], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x402495
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402bc0
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
jmp 0x4024c5
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 8]
jae 0x4025eb
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402cd0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x402528
cmp dword [ebp - 0xc], 0
jne 0x402528
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
call fcn.0041bbc2
test eax, eax
je 0x40250a
mov dword [ebp - 0x1c], 0x4bbb68
jmp 0x402511
mov dword [ebp - 0x1c], 0x4bbb74
mov ecx, dword [ebp - 0x1c]
push ecx
push 2
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402be0
jmp 0x4024bc
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402c10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4025e6
cmp dword [ebp - 0x10], 0
je 0x4025e6
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
push 1
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
call dword [eax + 0xc]
test eax, eax
je 0x4025d0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
call dword [edx + 8]
cmp eax, 1
jne 0x402590
push 0x4bbb80
push 2
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402be0
jmp 0x4025ce
call fcn.0041baf8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4025b8
push 0x4bbb8c
push 2
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402be0
jmp 0x4025ce
push 0x4bbbac
push 2
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402be0
jmp 0x4025e6
push 0x4bbbd0
push 2
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402be0
jmp 0x4024bc
cmp dword [ebp - 4], 0
jne 0x402608
push 0
push 0x5425d0
push 0x4bbbdc
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.00402b70
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10