joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10036020
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10183fc8
push 0x10132540
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10189710]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], 0
test esi, esi
je 0x100361bc
test ebx, ebx
je 0x100361bc
mov byte [ebx], 0
mov byte [esi], 0
cmp dword [ebp + 8], 0
je 0x1003608e
mov ecx, str.PCManufacturer
call fcn.10034ee0
mov ecx, str.PCModel
call fcn.10034ee0
mov dword [ebp - 0x1c], 0x104
push str.PCManufacturer
lea eax, [ebp - 0x1c]
mov edi, esi
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsMwMonitor
mov edx, reloc.WS2_32.dll_bind
call fcn.10059d80
mov dword [ebp - 0x1c], 0x104
push str.PCModel
lea eax, [ebp - 0x1c]
mov edi, ebx
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsMwMonitor
mov edx, reloc.WS2_32.dll_bind
call fcn.10059d80
cmp byte [esi], 0
je 0x100360dc
cmp byte [ebx], 0
jne 0x100361bc
push 0
push 0
push 0x10035d70
call fcn.10127f7d
add esp, 0xc
cmp eax, 0xffffffff
je 0x10036164
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x20], eax
jmp 0x10036100
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x20]
cmp eax, 0xfa0
jae 0x10036164
mov dword [ebp - 0x1c], 0x104
push str.PCManufacturer
lea eax, [ebp - 0x1c]
mov edi, esi
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsMwMonitor
mov edx, reloc.WS2_32.dll_bind
call fcn.10059d80
mov dword [ebp - 0x1c], 0x104
push str.PCModel
lea eax, [ebp - 0x1c]
mov edi, ebx
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsMwMonitor
mov edx, reloc.WS2_32.dll_bind
call fcn.10059d80
cmp byte [esi], 0
je 0x1003615a
cmp byte [ebx], 0
jne 0x100361bc
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10036100
cmp byte [esi], 0
jne 0x1003618a
mov eax, dword [0x1016182c]
mov dword [esi], eax
mov ecx, dword [0x10161830]
mov dword [esi + 4], ecx
mov edx, dword [0x10161834]
mov dword [esi + 8], edx
mov al, byte [0x10161838]
mov byte [esi + 0xc], al
cmp byte [ebx], 0
jne 0x100361bc
mov ecx, dword [0x10161850]
mov dword [ebx], ecx
mov dx, word [0x10161854]
mov word [ebx + 4], dx
jmp 0x100361bc
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10036710
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10183f88
push 0x10132540
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10189710]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], 0
test esi, esi
je 0x100368db
test ebx, ebx
je 0x100368db
mov byte [esi], 0
mov byte [ebx], 0
cmp dword [ebp + 8], 0
je 0x1003677e
mov ecx, str.MBSR
call fcn.10034ee0
mov ecx, str.MBManufacturer
call fcn.10034ee0
mov dword [ebp - 0x1c], 0x104
push str.MBSR
lea eax, [ebp - 0x1c]
mov edi, esi
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsMwMonitor
mov edx, reloc.WS2_32.dll_bind
call fcn.10059d80
mov dword [ebp - 0x1c], 0x104
push str.MBManufacturer
lea eax, [ebp - 0x1c]
mov edi, ebx
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsMwMonitor
mov edx, reloc.WS2_32.dll_bind
call fcn.10059d80
cmp byte [esi], 0
je 0x100367cc
cmp byte [ebx], 0
jne 0x100368db
push 0
push 0
push 0x10036520
call fcn.10127f7d
add esp, 0xc
cmp eax, 0xffffffff
je 0x10036858
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x20], eax
jmp 0x100367f0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x20]
cmp eax, 0xfa0
jae 0x10036858
mov dword [ebp - 0x1c], 0x104
push str.MBSR
lea eax, [ebp - 0x1c]
mov edi, esi
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsMwMonitor
mov edx, reloc.WS2_32.dll_bind
call fcn.10059d80
mov dword [ebp - 0x1c], 0x104
push str.MBManufacturer
lea eax, [ebp - 0x1c]
mov edi, ebx
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsMwMonitor
mov edx, reloc.WS2_32.dll_bind
call fcn.10059d80
cmp byte [esi], 0
je 0x1003684e
cmp byte [ebx], 0
jne 0x100368db
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100367f0
push str.None
push esi
call fcn.10135887
add esp, 8
test eax, eax
jne 0x10036883
mov eax, dword [str.00000000]
mov dword [esi], eax
mov ecx, dword [0x101615c0]
mov dword [esi + 4], ecx
mov dl, byte [0x101615c4]
mov byte [esi + 8], dl
cmp byte [esi], 0
jne 0x100368a1
mov eax, dword [str.00000000]
mov dword [esi], eax
mov ecx, dword [0x101615c0]
mov dword [esi + 4], ecx
mov dl, byte [0x101615c4]
mov byte [esi + 8], dl
cmp byte [ebx], 0
jne 0x100368db
mov eax, dword [str.MBManf]
mov dword [ebx], eax
mov cx, word [0x101619a0]
mov word [ebx + 4], cx
mov dl, byte [0x101619a2]
mov byte [ebx + 6], dl
jmp 0x100368db
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100391c0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x1148
call fcn.10140530
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x1140], eax
mov eax, dword [esp + 0x1150]
push ebx
push ebp
push esi
xor ebx, ebx
push 0x103
lea ecx, [esp + 0x45]
push ebx
push ecx
mov dword [esp + 0x1c], eax
mov byte [esp + 0x4c], bl
call fcn.1012e060
push 0x7ff
lea edx, [esp + 0x159]
push ebx
push edx
mov dword [esp + 0x30], 0x104
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x160], bl
call fcn.1012e060
add esp, 0x18
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x30]
push ecx
push ebx
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x68]
push eax
push edi
mov dword [esp + 0x3c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [esp + 0x14]
cmp eax, ebx
ja 0x10039285
xor al, al
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1140]
xor ecx, esp
call fcn.10127db1
add esp, 0x1148
ret
xor ebp, ebp
cmp eax, ebx
jbe 0x10039342
nop
lea ecx, [esp + 0x2c]
push ecx
push ebx
push ebx
push ebx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x95c]
push eax
push ebp
push edi
mov dword [esp + 0x3c], 0x800
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x10039337
lea ecx, [ecx]
mov cl, byte [esp + eax + 0x948]
mov byte [esp + eax + 0x148], cl
inc eax
cmp cl, bl
jne 0x100392c0
mov edx, dword [esp + 0x1158]
lea ecx, [esp + 0xc]
push ecx
push edx
push ebx
lea eax, [esp + 0x154]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10039337
mov ecx, dword [esp + 0xc]
push ebx
push ebx
push ebx
push ebx
push str.DigitalProductId
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0xc]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], ebx
cmp esi, ebx
jne 0x10039337
cmp dword [esp + 0x10], ebx
je 0x10039337
mov ecx, dword [esp + 0x10]
push 1
push 0x2c
lea edx, [esp + 0x150]
call fcn.1006c030
inc ebp
cmp ebp, dword [esp + 0x14]
jb 0x10039290
mov eax, dword [esp + 0x10]
cmp byte [eax], bl
mov ecx, dword [esp + 0x114c]
pop esi
pop ebp
setne al
pop ebx
xor ecx, esp
call fcn.10127db1
add esp, 0x1148
ret
Function at 0x10039370
Capabilities:
Read file on windows
Terminate process
Write file on windows

Disassembly:
mov eax, 0x2810
call fcn.10140530
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x280c], eax
push ebx
mov ebx, dword [0x101a79a4]
push ebp
push esi
push edi
push 0x80
push 4
push 3
mov edi, ecx
push 0xc0000000
call fcn.1005aa40
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
add esp, 0x10
mov dword [esp + 0x10], esi
cmp esi, 0xffffffff
je 0x100393d9
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x1c]
push eax
push 2
push 0x10155f64
push esi
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 0x2800
lea ecx, [esp + 0x20]
push 0
push ecx
call fcn.1012e060
add esp, 0xc
push 0
lea edx, [esp + 0x18]
push edx
push 0x2800
lea eax, [esp + 0x28]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10039417
cmp dword [esp + 0x14], 0
jne 0x10039426
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x10039445
push 1
call edi
cmp esi, 0xffffffff
je 0x1003943f
mov edx, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
push edx
lea eax, [esp + 0x28]
push eax
push esi
call ebp
push 1
call edi
jmp 0x100393e0
lea ecx, [esp + 0x10]
push ecx
call fcn.10082e10
mov eax, dword [0x101bda9c]
test eax, eax
je 0x1003948b
lea edx, [esp + 0x10]
push edx
mov esi, 0x103
push eax
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [esp + 0x10], esi
jne 0x10039481
mov eax, dword [0x101bda9c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x101bda9c
call fcn.10082e10
mov ecx, dword [esp + 0x281c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10127db1
add esp, 0x2810
ret
Function at 0x1003fa60
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
push edi
mov edi, eax
push edi
push 0x104
mov esi, ecx
push esi
push 0x1014d5e3
push str.EncAuthPassword
push ebx
mov byte [esi], 0
call ebp
cmp byte [esi], 0
je 0x1003faec
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003fa90
sub eax, edx
add eax, 0x20
push eax
call fcn.10128320
mov edi, eax
add esp, 4
test edi, edi
je 0x1003fb00
mov edx, edi
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1003fab1
mov byte [esi], cl
push esi
push edi
mov ecx, 1
call fcn.10040d60
add esp, 8
cmp byte [esi], 0
jne 0x1003fadf
mov eax, edi
sub esi, edi
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x1003fad5
push edi
call fcn.10128243
add esp, 4
pop edi
pop esi
pop ebp
ret
push edi
push 0x104
push esi
push 0x1014d5e3
push str.AuthPassword
push ebx
call ebp
pop edi
pop esi
pop ebp
ret
Function at 0x10041320
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, dword [esp + 8]
test ebp, ebp
je 0x1004140c
cmp dword [esp + 0xc], 0
je 0x1004140c
lea ecx, [edi*4]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
lea ecx, [edx + eax + 4]
push esi
push ecx
call fcn.10128320
add esp, 4
mov esi, eax
test eax, eax
jne 0x10041365
pop esi
or eax, 0xffffffff
pop ebp
ret
xor ecx, ecx
test edi, edi
jle 0x100413ed
push ebx
movzx edx, byte [ecx + ebp]
inc ecx
shl edx, 8
cmp ecx, edi
jge 0x10041382
movzx ebx, byte [ecx + ebp]
add edx, ebx
inc ecx
shl edx, 8
cmp ecx, edi
jge 0x10041390
movzx ebx, byte [ecx + ebp]
add edx, ebx
mov ebx, edx
sar ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], bl
mov ebx, edx
sar ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 1], bl
mov ebx, edx
sar ebx, 6
and ebx, 0x3f
movzx ebx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and edx, 0x3f
inc ecx
cmp ecx, edi
mov byte [esi + 2], bl
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 3], dl
jle 0x100413da
mov byte [esi + 3], 0x3d
lea edx, [edi + 1]
cmp ecx, edx
jle 0x100413e5
mov byte [esi + 2], 0x3d
add esi, 4
cmp ecx, edi
jl 0x10041370
pop ebx
mov ecx, dword [esp + 0x10]
mov byte [esi], 0
mov dword [ecx], eax
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10041400
pop esi
sub eax, edx
pop ebp
ret
or eax, 0xffffffff
pop ebp
ret
Function at 0x10041b30
Capabilities:
Resolve dns

Disassembly:
sub esp, 0xd0
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0xcc], eax
push ebx
push ebp
push esi
push edi
push 0xc7
lea eax, [esp + 0x19]
push 0
push eax
mov esi, ecx
mov byte [esp + 0x20], 0
call fcn.1012e060
mov eax, esi
add esp, 0xc
mov dword [esp + 0x10], 1
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10041b70
sub eax, edx
xor edx, edx
test eax, eax
jle 0x10041bc6
nop
mov cl, byte [esi + edx]
cmp cl, 0x2e
je 0x10041b90
sub cl, 0x30
cmp cl, 9
ja 0x10041bbe
inc edx
cmp edx, eax
jl 0x10041b80
lea edx, [esp + 0x14]
mov eax, esi
sub edx, esi
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10041ba0
lea eax, [esp + 0x14]
mov ecx, eax
sub esi, ecx
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x10041bb2
jmp 0x10041c3a
mov dword [esp + 0x10], 0
mov edi, dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x10], 0
jne 0x10041b95
push esi
mov dword [esp + 0x14], 1
call edi
test eax, eax
jne 0x10041c02
lea ebp, [eax + 0x14]
jmp 0x10041bf0
push 0x64
call ebx
push esi
call edi
test eax, eax
jne 0x10041c02
sub ebp, 1
jne 0x10041bf0
jmp 0x10041bd2
mov eax, dword [eax + 0xc]
cmp dword [eax], 0
je 0x10041c3a
mov edx, dword [eax]
mov eax, dword [edx]
push eax
call sub.WS2_32.dll_inet_ntoa
lea edx, [esp + 0x14]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x10041c18
lea eax, [esp + 0x14]
mov ecx, eax
sub esi, ecx
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x10041c30
mov ecx, dword [esp + 0xdc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10127db1
add esp, 0xd0
ret
Function at 0x10041c60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x68
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push ebp
mov ebp, dword [esp + 0x74]
push esi
push 0x63
lea eax, [esp + 0x11]
push 0
push eax
call fcn.1012e060
add esp, 0xc
xor ebx, ebx
xor esi, esi
call fcn.1005bb40
mov byte [esp + 0xc], 0x7c
call fcn.1005be60
lea edx, [esp + 0xe]
mov byte [esp + 0xd], al
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10041ca5
lea ecx, [esp + 0xc]
movzx eax, byte [ecx]
add eax, esi
add esi, 7
inc ecx
add ebx, eax
cmp esi, 0x69
jl 0x10041cb3
movzx eax, byte [esp + 0xd]
mov byte [esp + 0x1b], bl
xor ecx, ecx
mov edi, edi
cmp ecx, 1
je 0x10041ce7
imul eax, eax, 0x7b
xor edx, edx
mov esi, 0x45c1
div esi
mov eax, edx
xor byte [esp + ecx + 0xc], al
inc ecx
cmp ecx, 0x10
jl 0x10041cd0
mov eax, 0x59af
xor ecx, ecx
imul eax, eax, 0x7b
xor edx, edx
mov esi, 0x45c1
div esi
inc ecx
mov eax, edx
xor byte [esp + ecx + 0xb], al
cmp ecx, 0x10
jl 0x10041cf4
xor esi, esi
lea ecx, [ebp + 3]
mov al, byte [esp + esi + 0xc]
add al, 0x11
mov dl, al
shr al, 4
and dl, 0xf
add al, 0x40
add dl, 0x40
cmp al, 0x40
jne 0x10041d2a
mov al, 0x50
cmp dl, 0x40
jne 0x10041d33
mov dl, 0x50
dec al
cmp al, 0x40
jne 0x10041d39
mov al, 0x50
mov byte [ecx - 3], al
mov al, byte [esp + esi + 0xd]
add al, 0x11
mov byte [ecx - 2], dl
mov dl, al
shr al, 4
and dl, 0xf
add al, 0x40
add dl, 0x40
cmp al, 0x40
jne 0x10041d58
mov al, 0x50
cmp dl, 0x40
jne 0x10041d61
mov dl, 0x50
dec al
cmp al, 0x40
jne 0x10041d67
mov al, 0x50
mov byte [ecx - 1], al
mov al, byte [esp + esi + 0xe]
add al, 0x11
mov byte [ecx], dl
mov dl, al
shr al, 4
and dl, 0xf
add al, 0x40
add dl, 0x40
cmp al, 0x40
jne 0x10041d85
mov al, 0x50
cmp dl, 0x40
jne 0x10041d8e
mov dl, 0x50
dec al
cmp al, 0x40
jne 0x10041d94
mov al, 0x50
mov byte [ecx + 1], al
mov al, byte [esp + esi + 0xf]
add al, 0x11
mov byte [ecx + 2], dl
mov dl, al
shr al, 4
and dl, 0xf
add al, 0x40
add dl, 0x40
cmp al, 0x40
jne 0x10041db3
mov al, 0x50
cmp dl, 0x40
jne 0x10041dbc
mov dl, 0x50
dec al
cmp al, 0x40
jne 0x10041dc2
mov al, 0x50
mov byte [ecx + 4], dl
mov byte [ecx + 3], al
add esi, 4
add ecx, 8
cmp esi, 0x10
jl 0x10041d11
mov ecx, dword [esp + 0x70]
mov byte [ebp + esi*2], 0
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10127db1
add esp, 0x68
ret
Function at 0x10041e90
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
test ebp, ebp
jne 0x10041e9d
xor eax, eax
pop ebp
ret
mov eax, 0xaaaaaaab
mul ebp
shr edx, 1
lea eax, [edx + edx*2]
cmp eax, ebp
je 0x10041eae
inc edx
lea eax, [edx*4]
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 0x10], eax
mov byte [eax + ecx], 0
test edx, edx
je 0x10041f60
push ebx
push edi
xor edi, edi
mov edi, edi
movzx eax, byte [esi]
sar al, 2
and al, 0x3f
movzx eax, al
movzx eax, byte [eax + 0x101b55c0]
mov byte [ecx], al
mov bl, byte [esi]
and bl, 3
inc edi
dec edx
inc ecx
shl bl, 4
inc esi
cmp edi, ebp
jae 0x10041efd
mov al, byte [esi]
sar al, 4
and al, 0xf
or bl, al
movzx eax, bl
mov al, byte [eax + 0x101b55c0]
mov byte [ecx], al
inc ecx
cmp edi, ebp
jae 0x10041f32
mov bl, byte [esi]
and bl, 0xf
add bl, bl
inc edi
add bl, bl
inc esi
cmp edi, ebp
jae 0x10041f25
mov al, byte [esi]
sar al, 6
and al, 3
or bl, al
movzx eax, bl
mov al, byte [eax + 0x101b55c0]
mov byte [ecx], al
jmp 0x10041f35
mov byte [ecx], 0x3d
inc ecx
cmp edi, ebp
jae 0x10041f4e
mov bl, byte [esi]
and bl, 0x3f
movzx eax, bl
mov al, byte [eax + 0x101b55c0]
inc esi
inc edi
mov byte [ecx], al
jmp 0x10041f51
mov byte [ecx], 0x3d
inc ecx
test edx, edx
jne 0x10041ed0
mov eax, dword [esp + 0x18]
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x10041f70
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x4b8
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x4b4], eax
mov eax, dword [esp + 0x4bc]
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x3b
mov esi, ecx
lea ecx, [esp + 0x21]
mov edi, edx
push ebx
push ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], edi
mov byte [esp + 0x28], bl
call fcn.1012e060
add esp, 0xc
push 0x63
lea edx, [esp + 0x5d]
push ebx
push edx
mov byte [esp + 0x64], bl
call fcn.1012e060
mov ax, word [0x10163160]
mov cl, byte [0x10163162]
add esp, 0xc
push 0x20
lea edx, [esp + 0x14]
push edx
push esi
mov word [esp + 0x1c], ax
mov byte [esp + 0x1e], cl
call fcn.10129766
mov ebp, eax
add esp, 0xc
cmp ebp, ebx
jne 0x10042007
push edi
xor edi, edi
mov ebx, str.eb64:_Cant_open_input_file___s___n
call fcn.10042440
add esp, 4
xor eax, eax
jmp 0x100420c9
push ebp
push 0x39
lea eax, [esp + 0x24]
push 1
push eax
call fcn.1012a83e
mov edi, eax
add esp, 0x10
cmp edi, ebx
je 0x100420bb
push 0x3ff
lea ecx, [esp + 0xc5]
push ebx
push ecx
mov byte [esp + 0xcc], bl
call fcn.1012e060
add esp, 0xc
lea edx, [esp + 0x1c]
push edi
push edx
lea ecx, [esp + 0x60]
call fcn.10041e90
mov byte [esp + eax + 0x60], bl
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0xcc]
push str._s_r_n
push ecx
call fcn.10127dc0
lea eax, [esp + 0xd4]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10042077
mov esi, dword [esp + 0x14]
sub eax, edx
push ebx
push eax
mov eax, dword [esp + 0x20]
lea edx, [esp + 0xc8]
push edx
push eax
call fcn.10042b00
add esp, 0x10
push ebp
test eax, eax
je 0x100420e2
push 0x39
lea ecx, [esp + 0x24]
push 1
push ecx
call fcn.1012a83e
mov edi, eax
add esp, 0x10
cmp edi, ebx
jne 0x10042023
push ebp
call fcn.10129ad3
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x4c4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10127db1
add esp, 0x4b8
ret
call fcn.10129ad3
add esp, 4
xor eax, eax
jmp 0x100420c9
Function at 0x100428f0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x8120
call fcn.10140530
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x811c], eax
mov eax, dword [esp + 0x8124]
push ebx
push ebp
mov ebp, dword [esp + 0x8130]
push esi
push edi
xor ebx, ebx
push 0x7fff
lea ecx, [esp + 0x12d]
push ebx
push ecx
mov dword [esp + 0x28], eax
mov byte [esp + 0x134], bl
call fcn.1012e060
mov eax, dword [ebp + 0x30d4]
add esp, 0xc
cmp eax, ebx
jne 0x1004294e
xor eax, eax
jmp 0x10042a79
push eax
call fcn.10129ad3
add esp, 4
lea edi, [ebp + 0x2fd0]
push 0x10163160
push edi
mov dword [ebp + 0x30d4], ebx
mov dword [esp + 0x1c], edi
call fcn.1012982a
add esp, 8
mov dword [ebp + 0x30d4], eax
cmp eax, ebx
je 0x10042947
push eax
push 0x8000
lea edx, [esp + 0x130]
push 1
push edx
call fcn.1012a83e
mov esi, eax
add esp, 0x10
cmp esi, ebx
mov dword [esp + 0x18], 1
jle 0x10042a57
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 0x103
lea eax, [esp + 0x25]
push ebx
push eax
mov byte [esp + 0x2c], bl
call fcn.1012e060
add esp, 0xc
cmp dword [esp + 0x813c], ebx
je 0x100429ef
mov edx, dword [ebp + 0x484]
lea ecx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
lea edx, [esp + 0x130]
call fcn.1011daf0
add esp, 8
jmp 0x10042a09
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x10042a3b
mov edx, dword [eax + 0x6c]
push esi
lea ecx, [esp + 0x12c]
push ecx
push eax
call edx
add esp, 0xc
cmp eax, ebx
je 0x10042a3b
push 0x14
call edi
mov eax, dword [ebp + 0x30d4]
push eax
push 0x8000
lea ecx, [esp + 0x130]
push 1
push ecx
call fcn.1012a83e
mov esi, eax
add esp, 0x10
cmp esi, ebx
jg 0x100429b0
jmp 0x10042a53
mov dword [esp + 0x18], ebx
push ebp
xor edi, edi
xor esi, esi
mov ebx, str.Error_writing_to_port__n
call fcn.10042440
add esp, 4
xor ebx, ebx
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + 0x30d4]
push edx
call fcn.10129ad3
add esp, 4
mov eax, edi
mov dword [ebp + 0x30d4], ebx
call fcn.1005ad10
mov eax, dword [esp + 0x18]
mov byte [edi], bl
mov ecx, dword [esp + 0x812c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10127db1
add esp, 0x8120
ret

Function at 0x10042aa0
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
mov edi, eax
lea eax, [edi + 0x58c]
push 0x1016317c
push eax
call fcn.1012982a
mov esi, eax
add esp, 8
test esi, esi
jne 0x10042ad5
push edi
xor edi, edi
mov ebx, str.MSG_Spooler_File_Open_Error__n
call fcn.10042440
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push esi
push ecx
push 1
push edx
call fcn.1012ad69
push esi
call fcn.10129ad3
add esp, 0x14
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x10042b00
Capabilities:
Get common file path
Write file on windows

Disassembly:
sub esp, 0x118
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x114], eax
cmp dword [esi + 0x470], 1
mov eax, dword [esp + 0x11c]
push ebx
push ebp
mov ebp, dword [esp + 0x128]
push edi
mov dword [esp + 0x10], eax
jne 0x10042b5d
mov ecx, dword [esp + 0x130]
push ecx
push ebp
mov eax, esi
call fcn.10042aa0
add esp, 8
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.10127db1
add esp, 0x118
ret
cmp byte [esi + 0x2fd0], 0
lea edi, [esi + 0x2fd0]
jne 0x10042bad
lea ebx, [esi + 0x2ecc]
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push edi
push 0
push 0x101631a0
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x10042b93
mov byte [edi], al
push 0x101631a4
push edi
call fcn.1012982a
add esp, 8
mov dword [esi + 0x30d4], eax
test eax, eax
jne 0x10042bad
mov byte [edi], al
cmp byte [edi], 0
mov ebx, 1
je 0x10042bd2
mov edx, dword [esi + 0x30d4]
mov eax, dword [esp + 0x130]
push edx
push eax
push ebx
push ebp
call fcn.1012ad69
add esp, 0x10
jmp 0x10042c34
push 0x103
lea ecx, [esp + 0x19]
push 0
push ecx
mov byte [esp + 0x20], 0
call fcn.1012e060
add esp, 0xc
cmp dword [esp + 0x134], 0
jne 0x10042c15
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x10042c01
xor ebx, ebx
jmp 0x10042c34
mov edx, dword [esp + 0x130]
push edx
push ebp
push eax
mov eax, dword [eax + 0x6c]
call eax
add esp, 0xc
jmp 0x10042c32
mov edx, dword [esi + 0x484]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x134]
push edx
mov edx, ebp
call fcn.1011daf0
add esp, 8
mov ebx, eax
mov ecx, dword [esp + 0x120]
pop edi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.10127db1
add esp, 0x118
ret