joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dab6
Capabilities:
Timestomp file

Disassembly:
push esi
push ebx
sub esp, 0x44
cmp dword [esp + 0x54], 0
jns 0x40daca
mov dword [esp + 0x54], 0x7fffffff
lea eax, [esp + 0x54]
mov dword [esp], eax
call sub.msvcrt.dll_gmtime
mov edx, dword [eax + 0x14]
add edx, 0x76c
mov word [esp + 0x30], dx
mov edx, dword [eax + 0x10]
inc edx
mov word [esp + 0x32], dx
mov edx, dword [eax + 0xc]
mov word [esp + 0x36], dx
mov edx, dword [eax + 8]
mov word [esp + 0x38], dx
mov edx, dword [eax + 4]
mov word [esp + 0x3a], dx
mov eax, dword [eax]
mov word [esp + 0x3c], ax
mov word [esp + 0x3e], 0
lea esi, [esp + 0x28]
mov dword [esp + 4], esi
lea eax, [esp + 0x30]
mov dword [esp], eax
call sub.KERNEL32.DLL_SystemTimeToFileTime
sub esp, 8
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x2000000
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x100
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call sub.KERNEL32.DLL_CreateFileW
sub esp, 0x1c
mov ebx, eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.KERNEL32.DLL_SetFileTime
sub esp, 0x10
mov dword [esp], ebx
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
add esp, 0x44
pop ebx
pop esi
ret

Function at 0x40de8c
Capabilities:
Create directory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov esi, dword [esp + 0x20]
mov edi, 0
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.msvcrt.dll_wcschr
mov ebx, eax
sub ebx, 2
cmp ebx, esi
jb 0x40ded6
movzx eax, word [ebx]
mov dword [esp + 4], eax
mov dword [esp], 0x436a5c
call sub.msvcrt.dll_wcschr
test eax, eax
je 0x40decf
mov edi, ebx
jmp 0x40ded6
sub ebx, 2
cmp ebx, esi
jae 0x40deb4
test edi, edi
je 0x40df09
movzx ebx, word [edi]
mov word [edi], 0
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.msvcrt.dll__waccess
test eax, eax
je 0x40df06
mov dword [esp], esi
call fcn.0040de8c
mov dword [esp], esi
call sub.msvcrt.dll__wmkdir
mov word [edi], bx
add esp, 0x10
pop ebx
pop esi
pop edi
ret
Function at 0x40ebc0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
cmp byte [0x71f9d0], 0
jne 0x40ebfb
mov dword [esp + 4], 0
mov dword [esp], str.UpdateCRC
call fcn.0040ef90
mov dword [0x71f9e0], eax
mov byte [0x71f9d0], 1
cmp dword [0x71f9e0], 0
je 0x40ec1a
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [0x71f9e0]
jmp 0x40ecf4
cmp dword [0x71b714], 0
jne 0x40ec28
call fcn.0040eb8a
cmp edi, 7
jbe 0x40eccd
xor ebx, dword [esi]
movzx edx, bl
mov eax, ebx
shr eax, 8
mov ebx, eax
xor ebx, dword [edx*4 + 0x71b710]
movzx edx, bl
mov eax, ebx
shr eax, 8
mov ebx, eax
xor ebx, dword [edx*4 + 0x71b710]
movzx edx, bl
mov eax, ebx
shr eax, 8
mov ebx, eax
xor ebx, dword [edx*4 + 0x71b710]
movzx edx, bl
mov eax, ebx
shr eax, 8
mov ebx, eax
xor ebx, dword [edx*4 + 0x71b710]
xor ebx, dword [esi + 4]
movzx edx, bl
mov eax, ebx
shr eax, 8
mov ebx, eax
xor ebx, dword [edx*4 + 0x71b710]
movzx edx, bl
mov eax, ebx
shr eax, 8
mov ebx, eax
xor ebx, dword [edx*4 + 0x71b710]
movzx edx, bl
mov eax, ebx
shr eax, 8
mov ebx, eax
xor ebx, dword [edx*4 + 0x71b710]
movzx edx, bl
mov eax, ebx
shr eax, 8
mov ebx, eax
xor ebx, dword [edx*4 + 0x71b710]
add esi, 8
sub edi, 8
cmp edi, 7
ja 0x40ec31
mov ecx, 0
cmp ecx, edi
jae 0x40ecf2
movzx eax, byte [ecx + esi]
xor al, bl
movzx edx, al
mov eax, ebx
shr eax, 8
mov ebx, eax
xor ebx, dword [edx*4 + 0x71b710]
inc ecx
cmp ecx, edi
jb 0x40ecd6
mov eax, ebx
add esp, 0x10
pop ebx
pop esi
pop edi
ret

Function at 0x429220
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x7349a0]
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
je 0x429260
mov dword [ebx + 0x30], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call fcn.0042a5f0
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x2c], eax
add esp, 0x14
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x2c], eax
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x429610
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x7349a0]
mov edi, dword [ebp + 8]
test eax, eax
je 0x4296ec
mov ecx, dword [eax + 0x2c]
test ecx, ecx
js 0x429701
mov edx, dword [eax + 0x2c]
test edx, edx
jne 0x4296c0
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
jmp 0x429658
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor ecx, ecx
test eax, eax
mov edx, 5
je 0x429668
mov ecx, dword [eax + 0x18]
xor edx, edx
cmp edx, 5
je 0x4296b3
test edx, edx
jne 0x4296a6
test ecx, ecx
je 0x429650
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp], 1
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
call ecx
cmp eax, 6
je 0x429710
cmp eax, 8
je 0x429650
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 5
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [eax + 0x30]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x429642
call fcn.00428c10
mov eax, dword [0x7349a0]
mov ecx, dword [eax + 0x2c]
test ecx, ecx
jns 0x429634
call fcn.00429280
mov eax, dword [0x7349a0]
jmp 0x429634
mov dword [edi + 0xc], 0
mov eax, dword [ebp - 0x14]
mov edx, ebx
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, edi
call fcn.00429580
cmp eax, 7
jne 0x4296ab
mov eax, dword [0x7349a0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x429763
mov edi, dword [eax + 0x2c]
test edi, edi
js 0x42978e
mov esi, dword [eax + 0x2c]
test esi, esi
jne 0x42976f
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.00428c10
mov eax, dword [0x7349a0]
jmp 0x429741
mov eax, dword [eax + 0x30]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x429752
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x429752
call fcn.00429280
mov eax, dword [0x7349a0]
jmp 0x429748
Function at 0x4299f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x7349a0]
mov edi, dword [ebp + 8]
test eax, eax
je 0x429a84
mov esi, dword [eax + 0x2c]
test esi, esi
js 0x429aa0
mov ebx, dword [eax + 0x2c]
test ebx, ebx
jne 0x429ac0
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], eax
test ecx, ecx
jne 0x429a78
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.00429580
cmp eax, 7
jne 0x429b3f
mov eax, dword [0x7349a0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x429b16
mov edx, dword [eax + 0x2c]
test edx, edx
js 0x429b30
mov edi, dword [eax + 0x2c]
test edi, edi
jne 0x429af0
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.004297a0
jmp 0x429a35
call fcn.00428c10
mov eax, dword [0x7349a0]
mov esi, dword [eax + 0x2c]
test esi, esi
jns 0x429a10
lea esi, [esi]
call fcn.00429280
mov eax, dword [0x7349a0]
mov ebx, dword [eax + 0x2c]
test ebx, ebx
je 0x429a1b
lea esi, [esi]
lea edi, [edi]
mov ebx, dword [eax + 0x30]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x429a1e
mov eax, dword [eax + 0x30]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x429a67
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x429a67
call fcn.00428c10
mov eax, dword [0x7349a0]
mov edx, dword [eax + 0x2c]
test edx, edx
jns 0x429a59
nop
lea esi, [esi]
call fcn.00429280
mov eax, dword [0x7349a0]
jmp 0x429a59
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]
Function at 0x429b50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov esi, dword [edi + 0xc]
test esi, esi
je 0x429be2
mov eax, dword [0x7349a0]
test eax, eax
je 0x429bd6
mov ebx, dword [eax + 0x2c]
test ebx, ebx
js 0x429c51
mov ecx, dword [eax + 0x2c]
test ecx, ecx
jne 0x429bf7
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, edi
call fcn.004297a0
cmp eax, 7
jne 0x429c6f
mov eax, dword [0x7349a0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x429c42
mov edx, dword [eax + 0x2c]
test edx, edx
js 0x429c60
mov edi, dword [eax + 0x2c]
test edi, edi
jne 0x429c23
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.00428c10
mov eax, dword [0x7349a0]
jmp 0x429b72
mov dword [esp], edi
call fcn.00429610
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov ebx, dword [eax + 0x30]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x429b87
mov eax, dword [eax + 0x30]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x429bc5
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x429bc5
call fcn.00428c10
mov eax, dword [0x7349a0]
jmp 0x429bb0
call fcn.00429280
mov eax, dword [0x7349a0]
jmp 0x429b7d
call fcn.00429280
mov eax, dword [0x7349a0]
jmp 0x429bbb
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]

Function at 0x429e20
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
mov edx, eax
je 0x429e50
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.0042a5f0
leave
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
leave
ret
Function at 0x404a60
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov eax, dword [ebx]
sub esp, 0xc
sub al, 0x5f
or al, 0x53
push esi
push edi
lea edx, [eax + 7]
and edx, 0xfffffff8
and eax, edx
mov eax, dword [ebp + 8]
pop edx
sbb edi, eax
jae 0x404a99
pop es
and byte [ebp - 0x3f7bcc40], al
add al, byte [eax]
add byte [edx + 0xc], ch
call dword [esi]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [eax + 0x2c]
inc esi
add al, 0x10
mov edi, dword [esi + 0x14]
sub edi, ecx
cmp edx, edi
ja 0x404ab8
add edx, ecx
pop edi
mov dword [esi + 0x10], edx
pop esi
xchg esi, eax
rcr dword [ebx - 0x75], 0xe5
pop ebp
ret 8
mov ecx, dword [esi]
mov edi, dword [ecx + 0x14]
mov edi, dword [ebx + 0x3b282b10]
xlatb
ja 0x404ada
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov dword [eax], edi
mov eax, dword [ecx]
xor eax, 0x788904c4
add al, 0xe9
jo 0x404ad9
add byte [esi - 0x75], al
js 0x404ade
inc esi
mov edi, dword [eax + 1]
lea ecx, [ebp - 0x3e27e7e9]
and dword [ebx - 0xfc1], 0x5d89da3b
dec eax
lea edx, [edi]
sbb al, bl
rol dword [ecx - 0xfc05d], 0xff
cmp ebx, edx
mov dword [ebp + 0x48], ebx
jb 0x6c4cbf
xchg ebx, edi
push ss
loop 0x404af9
add byte [ebx - 0x62], dh
insb byte es:[edi], dx
inc edi
or al, 0
push ecx
add byte [eax], al
neg dword [ebp + 0xc]
mov edx, ebx
shl dword [esp + ecx], 0x4a
cmp edx, 0xffffffff
mov dword [ebp - 4], edx
sete byte [edi + 0x3b000001]
pop ss
adc al, byte [edi + 0x9f0085]
mov eax, dword [edi + 0xc]
test eax, eax
je 0x404b30
push eax
call fcn.0040a29a
mov edx, dword [ebp - 0x69]
mov ebx, dword [edi + edx*4 + 0x14]
mov ecx, dword [edi]
sbb al, byte [edi + edx*4 + 0x14]
test ebx, ebx
jne 0x404b4d
cmp edx, ecx
dec esi
or ecx, dword [ebx - 0x3f7cfba8]
add al, 0x42
test ebx, ebx
invalid
cli
sbb byte [ebp - 0xba276a3], al
je 0x404bd5
mov ebx, dword [ebx]
test ebx, ebx
mov dword [eax], ebx
jne 0x404b73
cmp edx, ecx
jb 0x404b73
mov edx, dword [eax - 4]
into
call 0xd2c5946f
jne 0x404b71
test ecx, ecx
ja 0x404bd0
mov dword [edi], ecx
mov ebx, dword [ebp - 0xc]
mov eax, dword [edi + 8]
mov ecx, dword [ebx + 8]
add eax, ecx
xchg byte [edi + 8], al
mov ecx, eax
mov eax, dword [edi + 4]
cmp ecx, eax
jbe 0x404b8d
mov dword [edi + 8], eax
mov edi, dword [edi + 0x5f]
test dword [ebx], esi
je 0x404b9a
push edi
call 0x40e3e2
lea edx, [ebx - 0x31]
mov dword [ebx + 0x10], edx
sar byte [edx], 1
add byte [ebp - 0x35eb6f75], cl
sal byte [ecx + edi - 0x75], 0x47
fld qword [ebp + 0x500674a8]
or dl, byte [edi]
push edi
add byte [eax], al
mov ebx, dword [edi + 0x7b]
lea eax, [edi + 0x14]
test ebx, ebx
je 0x404bd5
or eax, 0x533efc4d
or bl, dh
invalid
sbb ebp, dword [edi]
fistp dword [eax + 0x272ec70f]
test edi, edi
je 0x404be2
invalid
push edi
call 0xbd412840
mov ebx, dword [ebp + 0xc]
push ebx
call dword [sym.imp.WSOCK32.dll_WSAStartup]
add esp, 4
test dword [esi + 0xc5840f], eax
add byte [eax], al
mov edx, dword [ebp - 4]
lea ecx, [eax + 0x18]
mov dword [eax + 0xb], edx
lea edx, [eax + ebx]
mov edx, ecx
insb byte es:[edi], dx
add byte [eax], al
add byte [eax], al
add byte [ecx - 0x3774ebb0], cl
jmp 0x404c47
out 0x55, al
clc
mov eax, dword [ecx + 0x10]
invalid
Function at 0x40a3c0
Capabilities:
Terminate process

Disassembly:
xor eax, eax
je 0x40a3c8
add ah, bl
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
dec eax
sal byte [ebx + esi - 0x75], 0x23
or al, 0x51
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
xor byte [esi], bl
mov cs, word [ebx + 0x40c09880]
add bh, bh
salc
lahf
jne 0x40a3fe
lcall 0x8cff, 0xcf08c25d
add eax, 0xafc94
dec dword [ebp + eax + 0xafc94]
pop esi
pop ebp
ret 0x4269
Function at 0x4102c6
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x410305
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x410305
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x410305
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x410305
cmp dword [ecx + 0x74], 0xe
jbe 0x410305
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41eecf
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x434fe0
push 0x434fd8
push str.FlsAlloc
push 0x1e
call fcn.0041ed99
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41ef03
push dword [ebp + 8]
mov ecx, esi
call dword [0x42f158]
call esi
jmp 0x41ef09
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41ef4d
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x434ff0
push 0x434fe8
push str.FlsGetValue
push 0x20
call fcn.0041ed99
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41ef84
push dword [ebp + 8]
mov ecx, esi
call dword [0x42f158]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x42062e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042049f

Function at 0x420a28
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00410720
mov eax, dword [0x43c0d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0041f502
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x420a6a
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x420bc6
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0042d7f0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x43df10]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00421a05
mov ecx, dword [esi*4 + 0x43df10]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x420bbf
cmp eax, dword [edi + ecx + 0x24]
jne 0x420bbf
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x420bbf
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00421a05
add esp, 0x14
test edx, edx
jl 0x420bbf
jg 0x420b35
test eax, eax
jb 0x420bbf
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x420bbf
jl 0x420b4f
cmp dword [ebp - 0x1008], eax
ja 0x420bbf
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x420b6d
test ebx, ebx
je 0x420ba6
cmp ecx, edi
jae 0x420ba6
mov al, byte [ecx]
cmp al, 0xd
jne 0x420b87
lea eax, [edi - 1]
cmp ecx, eax
jae 0x420b93
cmp byte [ecx + 1], 0xa
jne 0x420b93
inc ecx
jmp 0x420b93
movzx eax, al
movsx eax, byte [eax + 0x43c350]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x420b6d
cmp edx, ebx
jne 0x420b6d
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x420bc4
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040fc14
leave
ret
Function at 0x420ebd
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x43df10]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x420efd
cmp byte [ebx], 0xa
jne 0x420efd
or byte [eax + edi + 0x28], 4
jmp 0x420f02
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x421000
mov al, byte [edx]
cmp al, 0x1a
je 0x420fe2
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x420f31
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x420f56
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x420f60
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x420f13
jmp 0x421000
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x420fdd
cmp dword [ebp - 0xc], 0
je 0x420fdd
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x43df10]
test byte [eax + edi + 0x28], 0x48
je 0x420fb7
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x420fa2
mov byte [esi], dl
jmp 0x420fb3
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x43df10]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x421000
cmp byte [ebp - 1], 0xa
jne 0x420fc6
cmp esi, ebx
jne 0x420fc6
mov byte [esi], 0xa
jmp 0x420fff
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00421a23
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x421000
mov byte [esi], 0xd
jmp 0x420fff
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x43df10]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x420ffc
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x421000
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x421009
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x43df10]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x42104c
cmp word [esi], dx
jne 0x42104c
or byte [edi + eax + 0x28], 4
jmp 0x421051
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x42118a
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x42116a
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x421093
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4210c9
cmp eax, edx
jae 0x4210d5
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x42106b
jmp 0x42118a
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x421166
cmp dword [ebp - 0x14], 0
je 0x421166
mov eax, dword [ebx*4 + 0x43df10]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x42113e
mov cx, word [ebp - 4]
pop eax
cmp cx, ax
je 0x421184
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x43df10]
push 0xa
mov byte [edi + eax + 0x2a], cl
mov eax, dword [ebx*4 + 0x43df10]
shr cx, 8
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x43df10]
pop ecx
mov byte [edi + eax + 0x2c], cl
jmp 0x421187
pop ebx
cmp word [ebp - 4], bx
jne 0x42114f
cmp esi, dword [ebp + 0xc]
jne 0x42114f
mov word [esi], bx
jmp 0x421187
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00421a23
add esp, 0x10
cmp word [ebp - 4], bx
je 0x42118a
push 0xd
jmp 0x421183
mov ecx, dword [ebx*4 + 0x43df10]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x421181
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x42118a
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x425d0a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x425da7
push ebx
push esi
call fcn.00425cd3
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004239e3
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x425d54
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x425da6
push edi
push eax
call fcn.00421c02
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x425d74
call fcn.0041eabe
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x425da5
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004239e3
add esp, 0x20
test eax, eax
jne 0x425d93
push edi
call fcn.0041eabe
jmp 0x425d9b
push ebx
call fcn.0041eabe
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret