joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405250
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4392fe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
lea ebp, [esi + 0x1174]
mov ecx, ebp
mov dword [esp + 0xc], esi
mov dword [esi], 0x442054
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], 6
mov dword [esi + 0x24], 0x16
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
call fcn.00404da0
mov dword [ebp + 4], eax
mov byte [eax + 0xe], 1
mov eax, dword [ebp + 4]
mov dword [eax + 4], eax
mov eax, dword [ebp + 4]
mov dword [eax], eax
mov eax, dword [ebp + 4]
mov dword [eax + 8], eax
mov dword [ebp + 8], edi
lea ebp, [esi + 0x1198]
mov ecx, ebp
mov dword [esp + 0x18], edi
call fcn.00404da0
mov dword [ebp + 4], eax
mov ecx, dword [esp + 0x10]
mov byte [eax + 0xe], 1
mov eax, dword [ebp + 4]
mov dword [eax + 4], eax
mov eax, dword [ebp + 4]
mov dword [eax], eax
mov eax, dword [ebp + 4]
mov dword [eax + 8], eax
mov dword [ebp + 8], edi
mov dword [esi + 0x11c8], edi
mov dword [esi + 0x11cc], edi
mov dword [esi + 0x11d0], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4133e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43ac69
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push edi
push 0xdbac98
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [esp + 0x34]
mov edx, dword [esi + 0x44]
mov eax, dword [esp + 0x38]
mov edi, dword [esi + 0x48]
inc edx
push eax
lea ecx, [esp + 0xc]
mov dword [esi + 0x44], edx
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea ecx, [esp + 8]
push ecx
mov ecx, 0xdbade0
mov dword [esp + 0x30], 0
call fcn.004130a0
lea ecx, [esp + 8]
mov dword [eax], esi
mov dword [esp + 0x2c], 0xffffffff
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
push 0xdbac98
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x24]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x413900
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43acc9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
push edi
xor edi, edi
mov ecx, esi
mov dword [esp + 8], edi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetManager]
push eax
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_3]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x24]
push edi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::StringLength]
add esp, 4
push eax
push edi
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetLength]
push eax
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::Concatenate]
mov esi, dword [esp + 0x30]
add esp, 0x14
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_2]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x415970
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x48
cmp eax, 1
push ebx
push ebp
mov ebx, ecx
push esi
push edi
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x80], 0
jne 0x415af2
mov edi, dword [esp + 0x5c]
test edi, edi
jne 0x4159aa
pop edi
pop esi
pop ebp
mov eax, 0x80070057
pop ebx
add esp, 0x48
ret 0xc
mov eax, dword [ebx]
test eax, eax
je 0x4159bf
push eax
call sub.MFC71.DLL_operator_delete
add esp, 4
mov dword [ebx], 0
mov esi, dword [sym.imp.WINMM.dll_mmioOpenA]
push 0
push 0
push edi
call esi
test eax, eax
mov dword [ebx + 4], eax
je 0x415b0b
push 0
push eax
call dword [sym.imp.WINMM.dll_mmioClose]
push 0x10000
push 0
push edi
call esi
test eax, eax
mov dword [ebx + 4], eax
jne 0x415ab2
mov ebp, dword [sym.imp.KERNEL32.dll_FindResourceA]
push str.WAVE
push edi
push eax
call ebp
mov esi, eax
test esi, esi
jne 0x415a1d
push 0x448a5c
push edi
push eax
call ebp
mov esi, eax
test esi, esi
je 0x415b0b
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x415b0b
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
test ebp, ebp
je 0x415b0b
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x415b0b
push ebp
call sub.MFC71.DLL_operator_new
mov dword [ebx + 0x90], eax
mov edi, eax
mov ecx, ebp
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
add esp, 4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x10]
mov ecx, 0x48
mov edi, edi
mov byte [eax], 0
inc eax
dec ecx
jne 0x415a80
mov ecx, dword [ebx + 0x90]
push 0x10000
lea edx, [esp + 0x14]
push edx
push 0
mov dword [esp + 0x20], 0x204d454d
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ecx
call dword [sym.imp.WINMM.dll_mmioOpenA]
mov dword [ebx + 4], eax
mov ecx, ebx
call fcn.00415150
mov esi, eax
test esi, esi
jge 0x415ad7
mov eax, dword [ebx + 4]
push 0
push eax
call dword [sym.imp.WINMM.dll_mmioClose]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret 0xc
mov ecx, ebx
call fcn.004152d0
test eax, eax
jl 0x415b4b
mov ecx, dword [ebx + 0xc]
pop edi
pop esi
pop ebp
mov dword [ebx + 0x30], ecx
pop ebx
add esp, 0x48
ret 0xc
mov edx, dword [esp + 0x5c]
push 0x11002
push 0
push edx
call dword [sym.imp.WINMM.dll_mmioOpenA]
test eax, eax
mov dword [ebx + 4], eax
jne 0x415b1a
pop edi
pop esi
pop ebp
mov eax, 0x80004005
pop ebx
add esp, 0x48
ret 0xc
mov eax, dword [esp + 0x60]
push eax
mov ecx, ebx
call fcn.00415600
mov esi, eax
test esi, esi
jge 0x415b44
mov ecx, dword [ebx + 4]
push 0
push ecx
call dword [sym.imp.WINMM.dll_mmioClose]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret 0xc
mov ecx, ebx
call fcn.004152d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret 0xc
Function at 0x4183b0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.MSVCR71.dll_fseek]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 2
push 0
push esi
mov edi, ecx
call ebx
push esi
call dword [sym.imp.MSVCR71.dll_ftell]
push 0
push 0
push esi
mov ebp, eax
call ebx
mov ebx, dword [sym.imp.MSVCR71.dll_fread]
xor eax, eax
push esi
push 1
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x34]
push 4
push eax
call ebx
push esi
push 1
lea ecx, [esp + 0x4c]
push 4
push ecx
call ebx
mov edx, dword [esp + 0x58]
push esi
push 1
push 4
push edx
call ebx
mov eax, dword [esp + 0x5c]
add esp, 0x4c
cmp eax, 0x100
jne 0x418474
mov eax, dword [esp + 0x18]
lea ecx, [eax + 0xc]
cmp ebp, ecx
jne 0x418474
push eax
mov dword [edi + 4], eax
call sub.MFC71.DLL_operator_new
mov edx, dword [esp + 0x1c]
push esi
push edx
push 1
push eax
mov dword [edi], eax
call ebx
mov ecx, dword [esp + 0x2c]
add esp, 0x14
xor eax, eax
test ecx, ecx
jle 0x41846a
mov ecx, dword [edi]
mov dl, byte [ecx + eax]
add ecx, eax
add dl, 9
mov byte [ecx], dl
mov edx, dword [edi]
mov bl, byte [edx + eax]
lea ecx, [edx + eax]
xor bl, 0x26
mov byte [ecx], bl
mov ecx, dword [esp + 0x18]
inc eax
cmp eax, ecx
jl 0x418448
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8
Function at 0x4353fd
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x4613f0
call fcn.00435b00
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x43543d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43543d
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x435455
cmp eax, 0x20b
je 0x435442
mov dword [ebp - 0x1c], ebx
jmp 0x435469
cmp dword [ecx + 0x84], 0xe
jbe 0x43543d
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x435463
cmp dword [ecx + 0x74], 0xe
jbe 0x43543d
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x1f3b10c], 0xffffffff
or dword [0x1f3b110], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x1f3acc0]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x1f3acbc]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1f3b108], eax
call fcn.00435bf2
call fcn.00435c92
cmp dword [0x4965a0], ebx
jne 0x4354c9
push fcn.00435c92
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.00435c80
push 0x467518
push 0x467514
call sub.MSVCR71.dll__initterm
push 0x435c36
call fcn.00435356
mov eax, dword [0x1f3acb8]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x1f3acb4]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x43551d
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x467510
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x43559b
cmp al, bl
je 0x435547
cmp dword [ebp - 0x20], ebx
jne 0x43559b
mov al, byte [esi]
cmp al, bl
je 0x435557
cmp al, 0x20
ja 0x435557
inc esi
mov dword [ebp - 0x24], esi
jmp 0x435547
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
je 0x435573
movzx eax, word [ebp - 0x54]
jmp 0x435576
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.00438ab1
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x435593
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x4355f0
cmp al, 0x22
jne 0x4355aa
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR71.dll__ismbblead]
pop ecx
test eax, eax
je 0x4355bd
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x435535
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00435b3b
ret
Function at 0x402400
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x402458
cmp byte [esi + ebx - 1], 0xa
je 0x40242c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x404100], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x4032c0
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
nop
nop

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x406688
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00406b30
mov byte [esp], al
cmp byte [esp], 0
jne 0x406811
test edi, edi
je 0x406811
mov byte [esp + 1], 0
test ebp, ebp
jle 0x406751
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x40672c
cmp edi, 0xffffffff
je 0x4066ed
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4066ed
mov byte [esp], 0
jmp 0x406811
cmp dword [esi], 1
jg 0x40672c
cmp dword [esi], 0
jne 0x40671e
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x40671e
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x406811
lea eax, [esp + 0xc]
call fcn.00406368
dec ebp
test ebp, ebp
jg 0x4066d2
cmp edi, 0xffffffff
je 0x406751
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x40674f
mov byte [esp], 0
jmp 0x406811
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x406696
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x406751
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.0040688c
mov edx, eax
mov ebx, dword [0x4bb8f8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x4067b5
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x4067b3
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x4067b5
xor edi, edi
cmp byte [esp], 0
je 0x4067db
mov ebx, dword [esi]
test bl, 1
jne 0x4067f1
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4067bb
mov byte [esp + 1], 1
jmp 0x4067f1
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4067db
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x406768
cmp byte [esp], 0
je 0x406811
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4076b8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4bb058], 0
je 0x40771f
cmp word [0x4bb344], 0xd7b2
jne 0x4076e1
cmp dword [0x4bb34c], 0
jbe 0x4076e1
mov eax, 0x4bb340
call dword [0x4bb35c]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x40774c
call fcn.00408240
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
cmp byte [0x4b7032], 0
jne 0x40773b
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x100071ef
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push dword [ebp - 4]
mov dword [esp], eax
push edx
sub dword [esp], edx
mov dword [esp], ecx
and dword [ebp - 4], 0
push dword [ebp - 4]
or dword [esp], edx
push eax
sub dword [esp], eax
add dword [esp], edi
push edi
and dword [esp], 0
xor dword [esp], esi
cmp dword [ebx + 0x442bf9], 1
jne 0x1000725c
sub esi, esi
mov esi, dword [esp]
add esp, 4
and edi, 0
pop dword [ebp - 4]
add edi, dword [ebp - 4]
and edx, 0
add edx, dword [esp]
sub esp, 0xfffffffc
and ecx, 0
or ecx, dword [esp]
add esp, 4
xor eax, eax
mov eax, dword [esp]
add esp, 4
leave
ret 4
push dword [ebx + 0x443060]
pop dword [ebp - 4]
push dword [ebp - 4]
pop edi
push ebp
sub ebp, dword [esp]
or ebp, dword [edi + 0x3c]
and eax, 0
xor eax, ebp
pop ebp
mov edi, dword [eax + edi + 0x28]
push 0
add dword [esp], eax
push edi
pop eax
add eax, dword [ebx + 0x4431a1]
mov edi, eax
pop eax
mov dword [ebp - 8], ecx
sub ecx, ecx
xor ecx, edi
mov edx, ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
and ecx, 0
or ecx, dword [ebx + 0x4431a1]
and edi, 0
xor edi, ecx
mov ecx, dword [ebp - 4]
mov dword [ebp - 4], esi
xor esi, esi
xor esi, dword [edi + 0x3c]
mov eax, esi
mov esi, dword [ebp - 4]
mov edi, dword [eax + edi + 0x28]
push edx
mov edx, dword [ebx + 0x4431a1]
push edi
pop dword [ebp - 8]
add dword [ebp - 8], edx
push dword [ebp - 8]
pop edi
pop edx
mov dword [ebp - 8], ecx
and ecx, 0
xor ecx, edi
and eax, 0
xor eax, ecx
mov ecx, dword [ebp - 8]
push dword fs:[0x30]
pop dword [ebp - 8]
push dword [ebp - 8]
pop esi
mov esi, dword [esi + 0xc]
mov dword [ebp - 4], edx
sub edx, dword [ebp - 4]
xor edx, dword [esi + 0xc]
and ecx, 0
or ecx, edx
mov edx, dword [ebp - 4]
push ebx
xor ebx, dword [esp]
xor ebx, dword [ecx + 0x1c]
and edi, 0
or edi, ebx
pop ebx
cmp eax, edi
jne 0x1000735b
push ebx
sub ebx, dword [esp]
or ebx, edx
and dword [ecx + 0x1c], 0
xor dword [ecx + 0x1c], ebx
pop ebx
and esi, 0
or esi, dword [esp]
add esp, 4
sub edi, edi
pop dword [ebp - 4]
add edi, dword [ebp - 4]
and edx, 0
or edx, dword [esp]
sub esp, 0xfffffffc
and ecx, 0
pop dword [ebp - 4]
or ecx, dword [ebp - 4]
and eax, 0
or eax, dword [esp]
add esp, 4
leave
ret 4
cmp edx, edi
jne 0x10007395
and esi, 0
pop dword [ebp - 8]
xor esi, dword [ebp - 8]
pop dword [ebp - 4]
mov edi, dword [ebp - 4]
and edx, 0
add edx, dword [esp]
add esp, 4
and ecx, 0
or ecx, dword [esp]
sub esp, 0xfffffffc
xor eax, eax
or eax, dword [esp]
add esp, 4
leave
ret 4
mov ecx, dword [ecx + 4]
jne 0x10007300
mov dword [ebx + 0x442bf9], 1
xor esi, esi
pop dword [ebp - 8]
add esi, dword [ebp - 8]
sub edi, edi
or edi, dword [esp]
add esp, 4
pop dword [ebp - 8]
mov edx, dword [ebp - 8]
and ecx, 0
xor ecx, dword [esp]
sub esp, 0xfffffffc
and eax, 0
pop dword [ebp - 8]
add eax, dword [ebp - 8]
leave
ret 4
Function at 0x405c07
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov dword [ebp - 4], 0
mov dword [ebp - 0x21c], 0xffffffff
cmp dword [ebp + 8], 0
je 0x405c4c
mov eax, dword [ebp + 8]
push eax
call fcn.0040a9f0
add esp, 4
test eax, eax
jbe 0x405c4c
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x218]
push edx
call fcn.0040a8f0
add esp, 8
jmp 0x405c67
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x405c67
jmp 0x405d8b
lea ecx, [ebp - 0x10c]
push ecx
push 0
push 0x411fc8
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405c8b
jmp 0x405d89
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x405cb6
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 0x220], edx
mov eax, dword [ebp - 0x220]
push eax
call fcn.0040aa6b
add esp, 4
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0
lea edx, [ebp - 0x10c]
push edx
call fcn.0040a9f0
add esp, 4
add eax, 1
push eax
call fcn.0040a9e0
add esp, 4
mov dword [ebp - 0x224], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x224]
mov dword [eax], ecx
lea edx, [ebp - 0x10c]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call fcn.0040a8f0
add esp, 8
push 0
push 0x80
push 5
push 0
push 1
push 0x40000000
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0xffffffff
jne 0x405d26
jmp 0x405d87
push 0
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.0040a9f0
add esp, 4
push eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp + 0x10]
push edx
call fcn.0040a9f0
add esp, 4
cmp dword [ebp - 0x110], eax
je 0x405d63
jmp 0x405d85
mov dword [ebp - 4], 1
cmp dword [ebp - 0x21c], 0xffffffff
je 0x405d80
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
jmp 0x405d8d
jmp 0x405d6a
jmp 0x405d6a
jmp 0x405d6a
jmp 0x405d6a
mov esp, ebp
pop ebp
ret

Function at 0x405d91
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x405dc5
jmp 0x405e05
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0x10]
je 0x405de7
jmp 0x405e03
mov dword [ebp - 4], 1
cmp dword [ebp - 0xc], 0xffffffff
je 0x405dfe
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
jmp 0x405e07
jmp 0x405dee
jmp 0x405dee
mov esp, ebp
pop ebp
ret