joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55364d
Capabilities:
Encode data using xor

Disassembly:
sub byte [ebx + 0x174ea419], cl
mov ecx, 0xce508171
push edi
mov dword [0x55da3432], eax
unpcklps xmm2, xmmword [edi]
fdiv st(3), st(0)
dec ebx
ja 0x5536d8
test eax, 0xa6dffe2b
mov ebp, 0x2b1ac6c0
sal ah, 0x74
sbb al, 0x8e
imul eax, dword [edi + 0x4d], 0x2000b836
mov ebx, 0xec2c057d
mov ecx, 0xf7689c13
inc esi
stc
mov bh, 0x1f
cmpsb byte [esi], byte es:[edi]
setbe dh
sub al, 0xf8
add byte [edi], 0x68
xor al, 0x79
xor al, 0xe
xor eax, 0xc66722eb
mov bh, 0x5f
mov eax, 0x940fb9f7
and byte [ecx - 0x5762bc], al
rol byte [edi + edx*4 - 0x58f87caa], 0x9e
mov bl, 0xe1
pop es
pop ecx
lds ebx, [esp + ebp*2 - 0x23]
pop es
mov dword [edi], eax
dec ecx
ret
ja 0x55372d
inc edi
enter 0xffffffffffffe357, 0xffffffffffffffc8
test al, 0xd9
mov word [0x358f6f80], es
invalid
adc al, 0xcb
mov ah, 0x54
push esp
xchg al, dl
xor ecx, dword [edx]
imul ebp, dword [edx + eax*8], 0x2c1277fb
adc al, 0x7b
out dx, eax
js 0x553730
test al, 0xa8
dec esp
test byte [eax - 0x1b1d62cc], bh
xor byte [eax + ecx*2 - 0xc], bl
sti
fsub dword [esp + eax + 0x4925cd62]
leave
mov edi, dword [esi + 0x15]
add al, 0x99
wait
pop edi
xchg ebx, eax
pop esp
pop edx
imul esi, dword [esi - 0x1b], 0x3d67f71e
jg 0x5537a3
invalid
test al, 0xf9
pushfd
mov dword [ebx], edi
mov eax, 0x3e496ceb
ja 0x553752
call 0x346f00b7
bound eax, qword [ebp + 0x270b4364]
mov ch, 0xf5
dec edx
xchg esi, eax
adc esp, esi
xchg edx, eax
fstpnce st(1), st(0)
cmpsb byte [esi], byte es:[edi]
mov ecx, 0x37866697
in eax, 0xb2
push es
push ecx
lcall 0x1ed9, 0x753651b4
push 0x55
xchg edi, eax
pop eax
test byte [esi + 0x66], 0x46
inc esi
add eax, 0xacd58d91
xchg esi, eax
and al, al
sbb al, 0x87
xor ecx, dword [ecx]
cmp dword es:[ecx + 0x55], ebp
clc
salc
fldenv [edx]
inc edx
les ecx, [edi + 0x351409de]
cmpsb byte [esi], byte es:[edi]
call 0xc8b99b7b
xchg esi, eax
invalid
Function at 0x572f4d
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a643d
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x573070
push ecx
lea ecx, [esi + 0x18]
call 0x59276d
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x573087
push ecx
lea ecx, [esi + 0x24]
call fcn.0059267d
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x59cc5d
Capabilities:
Encode data using xor

Disassembly:
push edx
stc
in eax, dx
lcall 0x1e98, 0x7336bf5a
mov dword [esi + eax + 0x64e11ac0], ecx
and esi, ebx
adc byte [esi + 0x47408320], bh
xlatb
outsb dx, byte [esi]
js 0x59cc7f
inc edi
scasb al, byte es:[edi]
mov ss, word [ebx - 0x29]
adc cl, ch
mov bl, 0x84
movsb byte es:[edi], byte [esi]
mov ah, 6
push eax
push eax
sbb al, 0xeb
sar byte [eax], 0x97
and byte [eax + 0x2b], al
adc byte [eax + 0x54], dh
insb byte es:[edi], dx
inc esi
invalid
Function at 0x5a616d
Capabilities:
Encode data using xor

Disassembly:
xor dword [eax + edx*8 + 0x35], 0x41
mov cl, byte [eax - 0x50]
mov ch, 0x33
pushal
cmp bh, byte [edi]
xor esp, dword [eax + 0x3a]
aas
and dword [edx - 0x7fddfd14], edx
adc ecx, 0xffffffdf
jnp 0x5a613b
and cl, 0xc7
std
add dword [edi + 0xc0b00c6], 0x6c
and dword [ebx - 0x1cb08400], esp
pop esi
push ds
mov cl, 0x60
lcall 0x46c8, 0xb303c0f2
xchg byte [edx], dl
invalid
mov dl, 0xa2
or bh, byte [eax + 0x26]
jo 0x5a6132
imul edx, edi, 0xf
adc cl, byte [edx + edx*2]
xchg esp, eax
jns 0x5a61af
cmp dword [ecx + 0x63], esi
xor dword [edi - 0x734eb37a], ebp
jno 0x5a61e2
mov ebx, 0x5cf105fd
out 0x76, eax
cmc
dec esi
xor edx, dword [esi - 0x68]
loope 0x5a61fb
xchg dword gs:[edi + edx*2 + 0x5e], eax
dec esp
jge 0x5a61fb
xchg byte [ebx + 0x2b14d5ab], ah
adc dword [ebp + esi*4 + 0x66], ebx
cmp edi, eax
sal dword [ecx - 0x3d], cl
jnp 0x5a61b9
ret
sub byte [ecx + 0x27], dh
cmp eax, 0xa259b980
test byte [bp + 0x57], al
mov byte [0x57468467], al
inc ebx
mul dword [esi]
les ecx, [ebp + 0x39facba0]
inc esi
mov byte [0xf366b4d6], al
pop ebp
xor edx, dword [edx]
mov bl, 0xe1
loope 0x5a617b
pushal
push dword [eax - 0x7aa8bbeb]
mov bh, byte [esi]
xchg ebx, eax
je 0x5a61ff
test al, 0x9e
sahf
mov dl, 0xa7
xchg esp, eax
cmpsd dword [esi], dword es:[edi]
xchg edi, eax
mov cl, 0x95
adc ebx, edi
adc ebp, dword [edi + 0x1f0c4e0]
out dx, eax
cmp dword [ebp + 0x15], esi
shl dword [edi + 0x2c], 0x10
add eax, 0xa2964f6c
insb byte es:[edi], dx
dec edi
xchg esi, eax
mov byte [0xc0d1f360], al
pushal
rol eax, 1
movsd dword es:[edi], dword [esi]
sub eax, 0x640742e2
or byte [ecx - 0x19f9cc7], bh
shl byte [ecx + edx], 1
add esp, dword [esi + 0x3a]
cmp byte [ecx], al
leave
xchg ebp, eax
pop edi
push ebp
mov fs, word [eax + 0x2c]
arpl word [eax + 0x7f050edc], ax
or eax, 0xf3ddd316
adc edi, edx
pop edi
mov dword [0x41b2c1e4], eax
add eax, 0x2fa23f2c
verw word [ecx - 0x5e]
jae 0x5a6239
imul esp, dword [edx + 0x40b5fc73], 0x52043b05
not dword [edx - 0x38ba59a6]
xchg ebx, eax
rcl byte [ecx], cl
test eax, 0x261ff398
cmp byte [ebx], dl
ja 0x5a62a6
mov ch, 0x40
add eax, 0xf752043b
xchg edx, eax
pop edx
cmpsb byte [esi], byte es:[edi]
inc ebp
invalid
xor bh, byte [ebx + esi*8 - 0x18d646bd]
mov eax, dword ss:[0x7b33e86]
push esp
invalid
int3
Function at 0x5bc8ad
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005efd9d
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5bc9d0
push ecx
lea ecx, [esi + 0x18]
call fcn.005dc0cd
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5bc9e7
push ecx
lea ecx, [esi + 0x24]
call fcn.005dbfdd
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x64d15d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x654338
cmp edx, dword [eax]
je 0x64d17f
add eax, 8
inc ecx
cmp eax, 0x6543c8
jl 0x64d170
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x654338]
jne 0x64d2ad
mov eax, dword [0xa57c90]
cmp eax, 1
je 0x64d287
test eax, eax
jne 0x64d1b0
cmp dword [0x654264], 1
je 0x64d287
cmp edx, 0xfc
je 0x64d2ad
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64d1e7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064db40
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
lea eax, [ebp + 8]
lea esi, [esi + 0x65433c]
push 0
push eax
push dword [esi]
call fcn.0064dfd0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
Function at 0x4010e8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42c004]
jne 0x4010f2
repz ret
jmp fcn.004019e1

Function at 0x40611b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42c004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402f8e
and dword [ebp - 0x14], 0
cmp dword [0x42ec84], 0
mov dword [ebp - 0x18], eax
jne 0x4061ce
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406276
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406276
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42ec84], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42ec88], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42ec8c], eax
call edi
push eax
call esi
mov dword [0x42ec94], eax
test eax, eax
je 0x4061ce
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42ec90], eax
mov eax, dword [0x42ec90]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x406227
cmp dword [0x42ec94], ecx
je 0x406227
push eax
call esi
push dword [0x42ec94]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x406227
test ebx, ebx
je 0x406227
call edi
test eax, eax
je 0x40621e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40621e
test byte [ebp - 8], 1
jne 0x406227
or dword [ebp + 0x10], 0x200000
jmp 0x40625a
mov eax, dword [0x42ec88]
cmp eax, dword [ebp - 0x18]
je 0x40625a
push eax
call esi
test eax, eax
je 0x40625a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40625a
mov eax, dword [0x42ec8c]
cmp eax, dword [ebp - 0x18]
je 0x40625a
push eax
call esi
test eax, eax
je 0x40625a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42ec84]
call esi
test eax, eax
je 0x406276
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406278
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004010e8
leave
ret
Function at 0x427b80
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
test ebx, ebx
jle 0x427b94
call fcn.00427b00
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jl 0x427b87
pop esi
cmp ebx, 0x2d
jne 0x427bae
mov dword [0x2bd46e8], 0xa62e7790
mov dword [0x2bd46ec], 0xffffffff
ret

Function at 0x427bb0
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x42c004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x42d210]
push ebx
mov ebx, dword [0x2bd46dc]
push edi
mov edi, dword [0x2bd225c]
call fcn.00427b50
cmp dword [0x2bd46dc], 0x2f
jne 0x427c1d
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.00427b80
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.004010e8
add esp, 0x24
ret
Function at 0x430002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x40ab47
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x40ab68
jl 0x40ab5f
test edi, edi
jne 0x40ab68
xor eax, eax
xor edx, edx
jmp 0x40ac29
cmp dword [ebx + 0x38], 0
je 0x40ab7d
push eax
push edi
push dword [ebp + 8]
call fcn.0040ac2f
jmp 0x40ac29
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40abc4
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x40abc4
cmp eax, edi
jb 0x40ab9e
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.0040c760
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x40abca
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x40ac1e
mov ecx, ebx
call fcn.0040a3de
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x40ac09
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.00417826
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x40ac1e
jmp 0x40abdc
test edx, edx
je 0x40ac1e
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00417826
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x40c10c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40c14b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40c14b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40c14b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40c14b
cmp dword [ecx + 0x74], 0xe
jbe 0x40c14b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41e592
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x433de0
push 0x433dd8
push str.FlsAlloc
push 0x1e
call fcn.0041e3ff
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41e5c6
push dword [ebp + 8]
mov ecx, esi
call dword [0x42c130]
call esi
jmp 0x41e5cc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41e610
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x433df0
push 0x433de8
push str.FlsGetValue
push 0x20
call fcn.0041e3ff
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41e647
push dword [ebp + 8]
mov ecx, esi
call dword [0x42c130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x42062c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042049d

Function at 0x420a26
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040c270
mov eax, dword [0x43a040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0041d945
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x420a68
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x420bc4
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0042b6b0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x43ba98]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00421a03
mov ecx, dword [esi*4 + 0x43ba98]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x420bbd
cmp eax, dword [edi + ecx + 0x24]
jne 0x420bbd
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x420bbd
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00421a03
add esp, 0x14
test edx, edx
jl 0x420bbd
jg 0x420b33
test eax, eax
jb 0x420bbd
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x420bbd
jl 0x420b4d
cmp dword [ebp - 0x1008], eax
ja 0x420bbd
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x420b6b
test ebx, ebx
je 0x420ba4
cmp ecx, edi
jae 0x420ba4
mov al, byte [ecx]
cmp al, 0xd
jne 0x420b85
lea eax, [edi - 1]
cmp ecx, eax
jae 0x420b91
cmp byte [ecx + 1], 0xa
jne 0x420b91
inc ecx
jmp 0x420b91
movzx eax, al
movsx eax, byte [eax + 0x43a308]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x420b6b
cmp edx, ebx
jne 0x420b6b
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x420bc2
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040b480
leave
ret
Function at 0x420ebb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x43ba98]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x420efb
cmp byte [ebx], 0xa
jne 0x420efb
or byte [eax + edi + 0x28], 4
jmp 0x420f00
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x420ffe
mov al, byte [edx]
cmp al, 0x1a
je 0x420fe0
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x420f2f
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x420f54
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x420f5e
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x420f11
jmp 0x420ffe
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x420fdb
cmp dword [ebp - 0xc], 0
je 0x420fdb
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x43ba98]
test byte [eax + edi + 0x28], 0x48
je 0x420fb5
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x420fa0
mov byte [esi], dl
jmp 0x420fb1
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x43ba98]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x420ffe
cmp byte [ebp - 1], 0xa
jne 0x420fc4
cmp esi, ebx
jne 0x420fc4
mov byte [esi], 0xa
jmp 0x420ffd
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00421a21
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x420ffe
mov byte [esi], 0xd
jmp 0x420ffd
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x43ba98]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x420ffa
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x420ffe
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x421007
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x43ba98]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x42104a
cmp word [esi], dx
jne 0x42104a
or byte [edi + eax + 0x28], 4
jmp 0x42104f
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x421188
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x421168
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x421091
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4210c7
cmp eax, edx
jae 0x4210d3
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x421069
jmp 0x421188
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x421164
cmp dword [ebp - 0x14], 0
je 0x421164
mov eax, dword [ebx*4 + 0x43ba98]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x42113c
mov cx, word [ebp - 4]
pop eax
cmp cx, ax
je 0x421182
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x43ba98]
push 0xa
mov byte [edi + eax + 0x2a], cl
mov eax, dword [ebx*4 + 0x43ba98]
shr cx, 8
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x43ba98]
pop ecx
mov byte [edi + eax + 0x2c], cl
jmp 0x421185
pop ebx
cmp word [ebp - 4], bx
jne 0x42114d
cmp esi, dword [ebp + 0xc]
jne 0x42114d
mov word [esi], bx
jmp 0x421185
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00421a21
add esp, 0x10
cmp word [ebp - 4], bx
je 0x421188
push 0xd
jmp 0x421181
mov ecx, dword [ebx*4 + 0x43ba98]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x42117f
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x421188
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret