joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100283a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x428
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x10028b30
mov edi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x30], 2
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x24], 0
cmp edi, 0x201
jae 0x10028430
jmp 0x1002841e
jbe 0x100284af
cmp edi, 0x201
jae 0x10028430
mov dword [ebp - 0x34], 0x200
lea ebx, [ebp - 0x434]
mov esi, edi
jmp 0x10028461
mov esi, dword [ebp - 0x20]
sub edi, esi
je 0x10028455
mov dword [ebp - 0x10], 0
push edi
push esi
lea eax, [ebp - 0x2c]
push eax
call fcn.1004d2a0
add esp, 0xc
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x30]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x20], esi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
test eax, eax
jne 0x10028481
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100284f1
cmp edi, esi
jne 0x10028410
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1002855a
lea edi, [esi + esi]
test esi, esi
mov eax, 0xffffffff
cmovs edi, eax
cmp edi, 0x201
jb 0x1002841e
jmp 0x10028430
mov eax, dword [ebp - 0x34]
cmp edi, eax
ja 0x10028577
test edi, edi
je 0x10028510
lea ecx, [edi + edi]
cmp edi, 0x3fffffff
mov dword [ebp - 0x20], ecx
ja 0x1002858f
movzx eax, byte [0x100ef049]
push 2
push ecx
call fcn.1000be60
add esp, 8
test eax, eax
je 0x10028593
mov esi, eax
mov eax, dword [ebp - 0x20]
jmp 0x10028517
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp + 8]
mov byte [ebx + 4], 0
mov dword [ebx + 8], eax
mov dword [ebx], bind
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x10028534
jmp 0x10028544
mov esi, 2
xor eax, eax
push eax
push ebx
push esi
call fcn.1003e760
add esp, 0xc
mov ebx, dword [ebp + 8]
mov dword [ebx], edi
mov dword [ebx + 4], esi
mov dword [ebx + 8], edi
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x10028544
add eax, eax
push 2
push eax
push dword [ebp - 0x28]
call fcn.1000be70
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x428
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
push 0x100cd710
push 0x28
push 0x100cd6e8
call fcn.1004d870
add esp, 0xc
jmp 0x100285ab
mov dword [ebp - 0x10], 0
push 0x100cd6d8
push eax
push edi
call fcn.1004db30
add esp, 0xc
jmp 0x100285ab
xor eax, eax
jmp 0x10028598
mov eax, 2
mov dword [ebp - 0x10], 0
push dword [ebp - 0x20]
push eax
call fcn.1004d660
add esp, 8
ud2
Function at 0x10028870
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x438
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x10028b50
mov esi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x2c], 2
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x20], 0
cmp esi, 0x201
jae 0x10028900
jmp 0x100288ee
jbe 0x10028986
cmp esi, 0x201
jae 0x10028900
mov dword [ebp - 0x30], 0x200
lea ebx, [ebp - 0x444]
mov edi, esi
jmp 0x10028931
mov edi, dword [ebp - 0x34]
sub esi, edi
je 0x10028925
mov dword [ebp - 0x10], 0
push esi
push edi
lea eax, [ebp - 0x28]
push eax
call fcn.1004d2a0
add esp, 0xc
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x10028955
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100289e9
cmp esi, edi
jne 0x100288e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10028a08
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x100288ee
jmp 0x10028900
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], 0
cmp esi, eax
ja 0x10028a25
lea eax, [ebp - 0x44]
push esi
push ebx
push eax
call fcn.10017670
add esp, 0xc
movsd xmm0, qword [ebp - 0x44]
mov esi, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x3c]
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x100289d3
add eax, eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.1000be70
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x438
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 8]
mov byte [esi + 4], 0
mov dword [esi + 8], eax
mov dword [esi], bind
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x100289c3
jmp 0x100289d3
mov dword [ebp - 0x10], 0
push 0x100cd710
push 0x28
push 0x100cd6e8
call fcn.1004d870
add esp, 0xc
jmp 0x10028a34
push 0x100cd6d8
push eax
push esi
call fcn.1004db30
add esp, 0xc
ud2
Function at 0x1002c360
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x1002e9f0
mov esi, ecx
lea eax, [ebp - 0x18]
mov edi, edx
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x100ef049]
push 4
push 0x1ec
call fcn.1000be60
add esp, 8
test eax, eax
je 0x1002c506
mov ebx, dword [edi]
mov dword [ebp - 0x3c], esi
mov esi, dword [edi + 8]
mov dword [eax + 0xb0], 0
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x28], eax
movzx ecx, word [ebx + 0x1ea]
mov edi, esi
not edi
add edi, ecx
mov dword [ebp - 0x20], ecx
lea ecx, [esi + esi*8]
lea ecx, [ecx + ecx*2]
mov word [eax + 0x1ea], di
add ecx, esi
mov edx, dword [ebx + ecx + 0xcc]
mov dword [ebp - 0x40], edx
movsd xmm0, qword [ebx + ecx + 0xc4]
movsd qword [ebp - 0x48], xmm0
movsd xmm0, qword [ebx + ecx + 0xb4]
movsd xmm1, qword [ebx + ecx + 0xbc]
mov ecx, esi
shl ecx, 4
cmp edi, 0xb
movsd qword [ebp - 0x50], xmm1
movsd qword [ebp - 0x58], xmm0
mov eax, dword [ebx + ecx]
mov edx, dword [ebx + ecx + 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], edx
ja 0x1002c512
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], esi
inc esi
sub eax, esi
cmp eax, edi
jne 0x1002c52b
mov edx, dword [ebx + ecx + 0xc]
mov ecx, dword [ebx + ecx + 8]
lea eax, [ebx + 0xb4]
add eax, esi
mov dword [ebp - 0x30], edx
lea edx, [esi + esi*8]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x28]
lea edx, [edx + edx*2]
add eax, edx
lea edx, [edi + edi*8]
lea edx, [edx + edx*2]
add edx, edi
add ecx, 0xb4
push edx
push eax
push ecx
call fcn.1003e760
add esp, 0xc
shl esi, 4
shl edi, 4
add esi, ebx
push edi
push esi
mov esi, dword [ebp - 0x28]
push esi
call fcn.1003e760
add esp, 0xc
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x24]
mov edx, dword [ebp - 0x2c]
mov word [ebx + 0x1ea], ax
mov eax, dword [ebp - 0x40]
movsd xmm0, qword [ebp - 0x58]
movsd xmm1, qword [ebp - 0x50]
mov dword [ecx + 0x18], eax
mov eax, dword [ebp - 0x38]
movsd qword [ecx], xmm0
movsd xmm0, qword [ebp - 0x48]
movsd qword [ecx + 8], xmm1
mov eax, dword [eax + 4]
movsd qword [ecx + 0x10], xmm0
mov dword [ecx + 0x2c], ebx
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x1c], edi
mov dword [ecx + 0x20], edx
mov edi, dword [ebp - 0x30]
mov edx, dword [ebp - 0x20]
mov dword [ecx + 0x28], edi
mov dword [ecx + 0x24], edx
mov dword [ecx + 0x34], esi
mov dword [ecx + 0x38], 0
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1ec
push 4
call fcn.1004d680
mov dword [ebp - 0x10], 0
push 0x100cdffc
push 0xb
push edi
call fcn.1004db30
add esp, 0xc
jmp 0x1002c546
mov dword [ebp - 0x10], 0
push 0x100cdfec
push 0x28
push str.assertion_failed:_src.len____dst.len__t
call fcn.1004d870
add esp, 0xc
ud2
Function at 0x1002e7b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x7c
mov edi, dword [esp + 0x94]
mov esi, dword [esp + 0x90]
mov eax, dword [esp + 0x98]
mov edx, dword [edi + 4]
mov ecx, dword [edi]
mov edi, dword [edi + 8]
test edx, edx
je 0x1002e89f
nop dword [eax]
mov ecx, dword [ecx + edi*4 + 0x1ec]
dec edx
je 0x1002e7fb
movzx edi, word [ecx + 0x1ea]
mov ecx, dword [ecx + edi*4 + 0x1ec]
dec edx
jne 0x1002e7ea
movzx edx, word [ecx + 0x1ea]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], 0
mov ecx, esp
dec edx
mov dword [esp + 0x4c], edx
lea edx, [esp + 0x44]
push eax
call fcn.1002dfc0
add esp, 4
movsd xmm2, qword [esp + 0x18]
movsd xmm1, qword [esp + 0x10]
mov eax, dword [esp + 0x28]
movsd xmm0, qword [esp + 0x20]
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
movsd qword [esp + 0x68], xmm2
movsd qword [esp + 0x60], xmm1
movsd xmm2, qword [esp]
movsd xmm1, qword [esp + 8]
mov dword [esp + 0x78], eax
movsd qword [esp + 0x70], xmm0
movsd qword [esp + 0x58], xmm1
movsd qword [esp + 0x50], xmm2
movzx eax, word [edi + 0x1ea]
cmp ecx, eax
jae 0x1002e880
mov eax, edi
jmp 0x1002e8c9
mov eax, dword [edi + 0xb0]
test eax, eax
je 0x1002e8c3
movzx ecx, word [edi + 0x1e8]
inc edx
mov edi, eax
cmp cx, word [eax + 0x1ea]
jae 0x1002e880
jmp 0x1002e8c9
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], edi
lea edx, [esp + 0x38]
mov ecx, esi
push eax
call fcn.1002dfc0
add esp, 4
jmp 0x1002e9e5
mov ecx, edx
xor eax, eax
mov edx, edi
lea edi, [ecx + ecx*8]
lea ebx, [edi + edi*2]
mov edi, ecx
add ebx, ecx
shl edi, 4
test edx, edx
mov ebp, dword [eax + ebx + 0xcc]
mov dword [esp + 0x18], ebp
mov ebp, dword [esp + 0x68]
movsd xmm0, qword [eax + ebx + 0xc4]
movsd qword [esp + 0x10], xmm0
movsd xmm0, qword [eax + ebx + 0xb4]
movsd xmm1, qword [eax + ebx + 0xbc]
movsd qword [esp + 8], xmm1
movsd qword [esp], xmm0
mov dword [eax + ebx + 0xcc], ebp
movsd xmm0, qword [esp + 0x60]
movsd qword [eax + ebx + 0xc4], xmm0
movsd xmm0, qword [esp + 0x50]
movsd xmm1, qword [esp + 0x58]
movsd qword [eax + ebx + 0xbc], xmm1
movsd qword [eax + ebx + 0xb4], xmm0
movsd xmm0, qword [eax + edi]
movsd xmm1, qword [eax + edi + 8]
movsd xmm2, qword [esp + 0x74]
movsd qword [esp + 0x1c], xmm0
movsd xmm0, qword [esp + 0x6c]
movsd qword [esp + 0x24], xmm1
movsd qword [eax + edi + 8], xmm2
movsd qword [eax + edi], xmm0
je 0x1002e99b
mov eax, dword [eax + ecx*4 + 0x1f0]
xor ecx, ecx
dec edx
je 0x1002e99c
nop word cs:[eax + eax]
nop dword [eax]
mov eax, dword [eax + 0x1ec]
dec edx
jne 0x1002e990
jmp 0x1002e99c
inc ecx
movsd xmm2, qword [esp + 0x18]
movsd xmm1, qword [esp + 0x10]
mov edx, dword [esp + 0x28]
movsd xmm0, qword [esp + 0x20]
movsd qword [esi + 0x18], xmm2
movsd qword [esi + 0x10], xmm1
movsd xmm2, qword [esp]
movsd xmm1, qword [esp + 8]
mov dword [esi + 0x28], edx
movsd qword [esi + 0x20], xmm0
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm2
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], ecx
mov eax, esi
add esp, 0x7c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1003a7a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1003a7f8
mov esi, dword [esp + 0x18]
lea edi, [edx + eax*2]
xor ebx, ebx
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea ebp, [ebx + eax]
jne 0x1003a7f0
cmp ebx, ebp
ja 0x1003a865
cmp ebp, dword [esp + 0x1c]
ja 0x1003a871
add ebx, esi
nop word [eax + eax]
test eax, eax
je 0x1003a7f2
dec eax
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x1003a7e0
jmp 0x1003a84e
ja 0x1003a7f8
cmp edx, edi
mov ebx, ebp
jne 0x1003a7b5
mov eax, dword [esp + 0x24]
test eax, eax
je 0x1003a852
mov esi, dword [esp + 0x20]
cmp eax, 1
movzx ecx, cx
mov ebx, esi
lea edi, [esi + eax]
mov al, 1
sbb ebx, 0xffffffff
nop word cs:[eax + eax]
nop
movzx edx, byte [esi]
test dl, dl
jns 0x1003a837
cmp ebx, edi
je 0x1003a85b
movzx esi, byte [ebx]
and edx, 0x7f
inc ebx
shl edx, 8
or edx, esi
mov esi, ebx
sub ecx, edx
js 0x1003a854
xor al, 1
xor ebx, ebx
cmp esi, edi
setne bl
add ebx, esi
cmp esi, edi
jne 0x1003a820
jmp 0x1003a854
xor eax, eax
jmp 0x1003a854
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x100d01b8
call fcn.1004d760
push 0x100d01c8
push ebp
push ebx
call fcn.1004db50
push 0x100d01c8
push dword [esp + 0x20]
push ebp
call fcn.1004db30
Function at 0x10042a02
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10042a41
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10042a41
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10042a41
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10042a41
cmp dword [ecx + 0x74], 0xe
jbe 0x10042a41
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10043aaf
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100d1dc0
push 0x100d1db8
push str.FlsAlloc
push 0x1f
call fcn.100439cb
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10043ae3
push dword [ebp + 8]
mov ecx, esi
call dword [0x1004e22c]
call esi
jmp 0x10043ae9
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10043b2d
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100d1dd0
push 0x100d1dc8
push str.FlsGetValue
push 0x21
call fcn.100439cb
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10043b64
push dword [ebp + 8]
mov ecx, esi
call dword [0x1004e22c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10043b6c
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100d1dd8
push 0x100d1dd0
push str.FlsSetValue
push 0x22
call fcn.100439cb
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10043ba6
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1004e22c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1004635e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100463fb
push ebx
push esi
call fcn.10046327
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100462bb
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100463a8
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100463fa
push edi
push eax
call fcn.1004441f
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100463c8
call fcn.10043878
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100463f9
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100462bb
add esp, 0x20
test eax, eax
jne 0x100463e7
push edi
call fcn.10043878
jmp 0x100463ef
push ebx
call fcn.10043878
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x10047971
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x100ef790]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100479b1
cmp byte [ebx], 0xa
jne 0x100479b1
or byte [edi + eax + 0x28], 4
jmp 0x100479b6
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x10047ab5
mov dl, byte [eax]
cmp dl, 0x1a
je 0x10047a98
inc eax
cmp dl, 0xd
je 0x100479e2
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x10047a08
cmp eax, ecx
jae 0x10047a16
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x100479ca
jmp 0x10047ab5
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10047a93
cmp dword [ebp - 0x10], 0
je 0x10047a93
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x100ef790]
test byte [eax + edi + 0x28], 0x48
je 0x10047a6d
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x10047a58
mov byte [esi], dl
jmp 0x10047a69
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x100ef790]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10047ab5
cmp byte [ebp - 1], 0xa
jne 0x10047a7c
cmp esi, ebx
jne 0x10047a7c
mov byte [esi], 0xa
jmp 0x10047ab4
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.100498b8
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10047ab5
mov byte [esi], 0xd
jmp 0x10047ab4
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x100ef790]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10047ab2
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10047ab5
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10047abe
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x100ef790]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10047b04
cmp word [ebx], dx
jne 0x10047b04
or byte [eax + edi + 0x28], 4
jmp 0x10047b09
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x10047c6c
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x10047c4c
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x10047b4a
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x10047b80
cmp eax, edx
jae 0x10047b8e
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x10047b25
jmp 0x10047c6c
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10047c47
cmp dword [ebp - 0x18], 0
je 0x10047c47
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x100ef790]
test byte [eax + edi + 0x28], 0x48
je 0x10047c1d
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x10047be1
mov word [esi], cx
jmp 0x10047c18
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x100ef790]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x100ef790]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x100ef790]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x10047c6c
pop eax
cmp word [ebp - 4], ax
jne 0x10047c2d
cmp esi, ebx
jne 0x10047c2d
mov word [esi], ax
jmp 0x10047c69
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.100498b8
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x10047c6c
push 0xd
pop eax
jmp 0x10047c28
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x100ef790]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x10047c66
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x10047c6c
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x1004ba20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1004ba4d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1004ba4d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1004d980
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
sub esp, 0x68
movzx eax, byte [esp + 0x78]
mov esi, dword [esp + 0x84]
mov ebx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x88]
mov edi, dword [esp + 0x80]
test eax, eax
mov dword [esp + 8], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edx
je 0x1004d9d1
cmp eax, 1
jne 0x1004da4e
mov dword [esp], 0x100cf934
jmp 0x1004d9d8
mov dword [esp], 0x100cf932
mov edx, 2
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
jne 0x1004da6a
mov ecx, esp
lea edx, [esp + 8]
lea esi, [esp + 0x10]
mov dword [esp + 0x38], 0x100cf970
mov dword [esp + 0x3c], 3
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 0x100371c0
mov dword [esp + 0x20], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x24], 0x100371a0
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0x100371a0
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 3
lea ecx, [esp + 0x38]
push eax
push ecx
call fcn.1004d790
mov edx, 7
mov dword [esp], 0x100cf936
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
je 0x1004d9ed
movsd xmm0, qword [ecx + 0x10]
movsd xmm2, qword [ecx]
movsd xmm1, qword [ecx + 8]
mov edx, esp
lea esi, [esp + 0x50]
mov dword [esp + 0x38], 0x100cf9a4
mov dword [esp + 0x3c], 4
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], edx
lea edx, [esp + 8]
mov dword [esp + 0x1c], 0x100371c0
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 0x100361d0
lea esi, [esp + 0x10]
mov dword [esp + 0x28], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x2c], 0x100371a0
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 0x100371a0
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 4
movsd qword [esp + 0x60], xmm0
movsd qword [esp + 0x58], xmm1
movsd qword [esp + 0x50], xmm2
lea ecx, [esp + 0x38]
push eax
push ecx
call fcn.1004d790
int3