joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407b70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e965
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x43d040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 0xc]
mov edi, edx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
cmp dword [edx + 0x14], 0xf
jbe 0x407bab
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x407bc9
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x407bb7
push esi
push edx
lea eax, [ebp - 0x18]
push eax
call fcn.00407ae0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x407be6
mov dword [ebx], eax
mov byte [ebx + 4], 0
jmp 0x407d49
cmp dword [0x49cfec], 0x71c71c7
je 0x407d5f
mov dword [ebp - 0x20], 0x49cfe8
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x1c], 0
call fcn.0040d087
add esp, 4
mov edi, eax
mov dword [ebp - 0x1c], edi
push dword [ebp - 0x10]
lea ecx, [edi + 8]
call fcn.00407e10
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x18]
mov dword [edi + 0x20], ecx
mov dword [ebp - 4], 1
mov ecx, dword [0x49cfec]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x43a190]
mov eax, dword [0x49d000]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x43a190]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x49cfe4]
comiss xmm1, xmm0
jbe 0x407cf6
divss xmm2, xmm0
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call fcn.0042a580
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.0042e530
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [0x49d000]
cmp eax, ecx
jae 0x407cd8
cmp eax, 0x200
jae 0x407cd6
shl eax, 3
cmp eax, ecx
jae 0x407cd8
mov eax, ecx
push eax
call fcn.004075f0
push esi
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00407ae0
mov ecx, dword [0x49cfec]
mov edx, dword [eax]
jmp 0x407cf9
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
inc ecx
mov dword [0x49cfec], ecx
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [0x49cff0]
mov dword [ebp - 0x10], eax
mov eax, dword [0x49cffc]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [0x49cfe8]
jne 0x407d2d
mov dword [ecx + eax*8], edi
jmp 0x407d3f
cmp esi, edx
jne 0x407d36
mov dword [ecx + eax*8], edi
jmp 0x407d43
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x407d43
mov dword [ecx + eax*8 + 4], edi
mov dword [ebx], edi
mov byte [ebx + 4], 1
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.0040dbff
int3
Function at 0x407f20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x43d040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 8], 0
je 0x407f7c
mov eax, dword [edi]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x49d0c8
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x24]
push 0x40
push 4
mov esi, dword [eax + 4]
push esi
call ebx
test eax, eax
je 0x408111
mov eax, dword [ebp - 8]
push 0x49d0c8
mov eax, dword [eax]
mov dword [esi], eax
push dword [0x49d0c8]
push 4
push esi
call ebx
jmp 0x408111
cmp dword [edi + 0x14], 0
je 0x407fc2
mov eax, dword [edi]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x49d0c8
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x24]
push 0x40
push 4
mov esi, dword [eax]
push esi
call ebx
test eax, eax
je 0x408111
mov eax, dword [ebp - 8]
push 0x49d0c8
mov eax, dword [eax]
mov dword [esi], eax
push dword [0x49d0c8]
push 4
push esi
call ebx
jmp 0x408111
call fcn.00402240
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call ebx
cmp dword [0x49d004], 0
mov esi, eax
jne 0x40802d
call ebx
cmp esi, eax
je 0x40802d
push 8
call fcn.0040d087
add esp, 4
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x40801d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 8
push ebx
call fcn.0040d0b7
add esp, 8
mov dword [0x49d004], esi
mov dword [0x49d010], 0
jmp 0x40802d
mov eax, dword [0x49d018]
mov dword [ebx + 4], esi
mov dword [ebx], eax
mov dword [0x49d018], ebx
mov eax, dword [edi + 4]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x49d008], eax
jne 0x40810c
cmp dword [0x49d004], 0
jne 0x40810c
cmp dword [edi], 0
jne 0x408066
mov dword [0x49d004], 6
jmp 0x408106
push 0x18
call fcn.0040d087
mov ecx, dword [edi]
add esp, 4
mov esi, eax
call fcn.00402110
mov ecx, dword [ebp - 0xc]
mov ebx, eax
call fcn.00402110
movzx ecx, byte [ebx + 0x36]
mov edx, eax
mov eax, dword [ebx + 0x40]
sub eax, ecx
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x4080e8
cmp ecx, 0x1e
ja 0x4080e8
cmp dword [ebx + 0x44], edx
jne 0x4080e8
lea edx, [ebp - 8]
mov dword [ebp - 8], 0
push edx
push 0x40
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x4080c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4080f6
mov eax, dword [ebp - 0xc]
mov dword [esi + 0xc], eax
mov dword [esi + 4], 1
mov dword [esi + 8], edi
mov dword [esi + 0x10], ebx
mov eax, dword [ebp - 8]
mov dword [esi + 0x14], eax
mov eax, dword [0x49d01c]
mov dword [esi], eax
mov dword [0x49d01c], esi
jmp 0x40810c
cmp dword [0x49ce90], 0
mov eax, 9
jne 0x4080fb
mov dword [0x49d004], eax
push 0x18
push esi
call fcn.0040d0b7
add esp, 8
mov dword [0x49d010], edi
call fcn.004022d0
mov eax, dword [edi + 0x24]
test eax, eax
je 0x408123
push 0
push eax
call fcn.0040d0b7
add esp, 8
push 0x28
push edi
call fcn.0040d0b7
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0040cbf7
mov esp, ebp
pop ebp
ret
Function at 0x408140
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, ecx
push 0x28
mov dword [ebp - 4], ebx
call fcn.0040d087
mov edi, eax
add esp, 4
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x24], 0
mov eax, dword [0x49cfd8]
mov dword [edi + 0x20], eax
mov dword [0x49cfd8], edi
mov dword [edi], esi
mov dword [edi + 4], ebx
call fcn.00402240
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call ebx
cmp dword [0x49d004], 0
mov esi, eax
jne 0x408209
call ebx
cmp esi, eax
je 0x408209
push 8
call fcn.0040d087
add esp, 4
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x4081f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 8
push ebx
call fcn.0040d0b7
add esp, 8
mov dword [0x49d004], esi
mov dword [0x49d010], 0
jmp 0x408209
mov eax, dword [0x49d018]
mov dword [ebx + 4], esi
mov dword [ebx], eax
mov dword [0x49d018], ebx
mov edx, dword [ebp - 4]
sub esp, 0xc
mov ecx, edi
call fcn.00402700
call fcn.004022d0
mov edx, dword [edi]
mov eax, edi
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx], edx
mov esp, ebp
pop ebp
ret

Function at 0x408230
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push 8
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
call fcn.0040d087
mov edi, dword [ebp + 8]
mov ebx, eax
push 0x28
mov dword [ebx], esi
mov ecx, dword [esi]
lea esi, [ecx + edi*4]
mov dword [ebx + 4], esi
call fcn.0040d087
mov ecx, dword [0x49cfd8]
mov edx, eax
xorps xmm0, xmm0
mov dword [0x49cfd8], edx
add esp, 8
movups xmmword [edx], xmm0
movups xmmword [edx + 0x10], xmm0
push 0x49d0c8
movq qword [edx + 0x20], xmm0
mov dword [edx + 0x20], ecx
mov eax, dword [esi]
mov ecx, dword [ebp - 4]
mov dword [edx + 4], ecx
mov ecx, dword [ebp - 8]
mov dword [edx + 8], ecx
mov ecx, dword [ebp - 0xc]
mov dword [edx + 0x10], edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x40
mov dword [edx], eax
mov dword [edx + 0x24], ebx
mov dword [edx + 0xc], 0
mov dword [ecx], eax
mov esi, dword [ebx + 4]
push 4
push esi
call edi
test eax, eax
je 0x4082da
mov eax, dword [ebp - 4]
push 0x49d0c8
mov dword [esi], eax
push dword [0x49d0c8]
push 4
push esi
call edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4082f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [0x49cfc4]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [ebx + 0x3c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], edi
mov esi, dword [esi + ebx + 0x80]
add esi, ebx
mov dword [ebp - 0x10], eax
cmp dword [esi + 0xc], 0
je 0x408343
mov eax, dword [esi + 0xc]
add eax, ebx
push str.nxgsm.dll
push eax
call fcn.004176ed
add esp, 8
test eax, eax
je 0x408343
add esi, 0x14
cmp dword [esi + 0xc], 0
jne 0x408323
push edi
push str.nxgsm.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [esi + 0x10]
add edi, ebx
cmp dword [edi], eax
je 0x408367
nop
add edi, 4
cmp dword [edi], eax
jne 0x408360
push 4
call fcn.0040d087
mov esi, eax
push 0x28
mov dword [esi], edi
call fcn.0040d087
mov ecx, dword [0x49cfd8]
mov edx, eax
xorps xmm0, xmm0
mov dword [ebp - 8], edx
add esp, 8
mov dword [0x49cfd8], edx
movups xmmword [edx], xmm0
movups xmmword [edx + 0x10], xmm0
push 0x49d0c8
movq qword [edx + 0x20], xmm0
mov dword [edx + 0x20], ecx
mov eax, dword [edi]
mov ecx, dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [edx + 4], ecx
mov ecx, dword [ebp - 0xc]
mov dword [edx + 0x1c], ecx
mov ecx, dword [ebp - 0x10]
push 0x40
mov dword [edx], eax
mov dword [edx + 0x24], esi
mov dword [edx + 0x14], ebx
mov dword [edx + 0x18], str.nxgsm.dll
mov dword [ecx], eax
mov esi, dword [esi]
push 4
push esi
call edi
test eax, eax
je 0x4083ee
mov eax, dword [ebp - 4]
push 0x49d0c8
mov dword [esi], eax
push dword [0x49d0c8]
push 4
push esi
call edi
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408c40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x43d040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ecx + 4], 0
mov eax, dword [ebp + 8]
je 0x408c85
lea edx, [ebp - 8]
mov dword [ebp - 8], 4
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0xc]
push edx
push 0
push eax
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x408c85
cmp dword [ebp - 0xc], 4
mov eax, dword [ebp - 0x10]
je 0x408c88
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040cbf7
mov esp, ebp
pop ebp
ret 8

Function at 0x408cd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x43d040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov byte [0x49dad0], 0
cmp byte [ecx + 4], 0
mov dword [ebp - 8], 0x200
je 0x408d31
lea edx, [ebp - 8]
push edx
push 0x49dad0
lea edx, [ebp - 0xc]
push edx
push 0
push eax
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x408d31
cmp dword [ebp - 0xc], 1
mov eax, 0x49dad0
cmovne eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040cbf7
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
xor ecx, ebp
call fcn.0040cbf7
mov esp, ebp
pop ebp
ret 8
Function at 0x40a870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
xor edi, edi
mov eax, dword [esi + 0x6af90]
mov dword [esi + 0x6af80], 2
test eax, eax
je 0x40aa7e
cmp eax, 3
jb 0x40a8e6
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
xor ecx, eax
and ecx, 0x7fff
and edx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
test ebx, ebx
je 0x40a923
mov eax, dword [esi + 0x6af84]
sub eax, ebx
cmp eax, 0x7efa
ja 0x40a923
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x40a90d
mov dword [esi + 0x6afa0], eax
mov edx, ebx
mov ecx, esi
call fcn.0040a550
mov ecx, dword [esi + 0x6af90]
mov edi, eax
cmp edi, ecx
cmova edi, ecx
mov ecx, dword [esi + 0x6af84]
cmp edi, 3
jb 0x40a9fa
sub ecx, dword [esi + 0x6af88]
lea eax, [edi - 3]
mov edx, ecx
mov ecx, esi
push eax
call fcn.00409ed0
mov ecx, dword [esi + 0x6af90]
add esp, 4
sub ecx, edi
mov dword [ebp - 4], eax
mov dword [esi + 0x6af90], ecx
cmp edi, dword [esi + 0x6af98]
ja 0x40a9c9
cmp ecx, 3
jb 0x40a9c9
dec edi
nop word [eax + eax]
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
and edx, 0x7fff
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
sub edi, 1
jne 0x40a970
jmp 0x40aa18
add dword [esi + 0x6af84], edi
xor edi, edi
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [edx + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [edx + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
mov dword [esi + 0x6af7c], eax
jmp 0x40aa24
movzx eax, byte [ecx + esi + 0x1af70]
xor edx, edx
push eax
mov ecx, esi
call fcn.00409ed0
add esp, 4
mov dword [ebp - 4], eax
dec dword [esi + 0x6af90]
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
cmp dword [ebp - 4], 0
je 0x40aa5d
mov eax, dword [esi + 0x6af74]
test eax, eax
js 0x40aa3e
lea ecx, [esi + 0x1af70]
add ecx, eax
jmp 0x40aa40
xor ecx, ecx
sub edx, eax
push 0
push edx
mov edx, ecx
mov ecx, esi
call fcn.00409b20
mov eax, dword [esi + 0x6af84]
add esp, 8
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x40aa70
mov ecx, esi
call fcn.0040a710
mov eax, dword [esi + 0x6af90]
test eax, eax
jne 0x40a895
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x40aa92
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x40aa94
xor edx, edx
mov eax, dword [esi + 0x6af84]
sub eax, ecx
mov ecx, esi
push 1
push eax
call fcn.00409b20
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b520
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x40b52b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x40b5e7
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x436ee8]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x436ee8]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x436ee8]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x436ee8]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x436ee8]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x436ee8]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x436ee8]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x436ee8]
sub edi, 1
jne 0x40b540
pop edi
test esi, esi
je 0x40b60a
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x436ee8]
sub esi, 1
jne 0x40b5f0
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x40b930
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x43d040]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push esi
mov esi, ecx
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x40b99e
push ebx
mov ebx, dword [esi + 0x1c]
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebx + edi]
cmp eax, dword [esi + 0x20]
jb 0x40b979
pop edi
pop ebx
mov dword [esi + 0xc], 0x30000
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040cbf7
mov esp, ebp
pop ebp
ret 8
push edi
push edx
add ecx, ebx
push ecx
call fcn.0040fdd0
add esp, 0xc
mov eax, edi
add dword [esi + 0x1c], edi
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040cbf7
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi]
test eax, eax
je 0x40b9c9
push 0
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040cbf7
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
mov dword [esi + 0xc], 0x1000000
xor ecx, ebp
pop esi
call fcn.0040cbf7
mov esp, ebp
pop ebp
ret 8

Function at 0x40bbd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x43d040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 0x64]
test edx, edx
je 0x40bc3d
mov ecx, dword [edi + 0x6c]
mov esi, dword [edi + 0x68]
cmp ecx, esi
jae 0x40bc8c
sub esi, ecx
lea eax, [ecx + edx]
cmp esi, dword [ebp + 0xc]
cmova esi, dword [ebp + 0xc]
push esi
push eax
push ebx
call fcn.0040fdd0
mov ecx, dword [edi + 0x58]
mov edx, ebx
add dword [edi + 0x6c], esi
add dword [edi + 0x54], esi
push esi
call fcn.0040b520
add esp, 0x10
mov dword [edi + 0x58], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040cbf7
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 0x5c]
test eax, eax
je 0x40bc85
push 0
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40bc8c
mov esi, dword [ebp - 8]
mov edx, ebx
mov ecx, dword [edi + 0x58]
add dword [edi + 0x54], esi
push esi
call fcn.0040b520
add esp, 4
mov dword [edi + 0x58], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040cbf7
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 0xc], 0x1000000
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040cbf7
mov esp, ebp
pop ebp
ret 8
Function at 0x40d8b5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40d8f4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40d8f4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40d8f4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40d8f4
cmp dword [ecx + 0x74], 0xe
jbe 0x40d8f4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x415912
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0042cb60
mov eax, dword [0x43d040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0041c8a8
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x415954
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x415ab0
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0042cab0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x49ca98]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.0041ea86
mov ecx, dword [esi*4 + 0x49ca98]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x415aa9
cmp eax, dword [ecx + edi + 0x24]
jne 0x415aa9
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x415aa9
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041ea86
add esp, 0x14
test edx, edx
jl 0x415aa9
jg 0x415a1f
test eax, eax
jb 0x415aa9
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x415aa9
jl 0x415a39
cmp dword [ebp - 0x1008], eax
ja 0x415aa9
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x415a57
test ebx, ebx
je 0x415a90
cmp ecx, edi
jae 0x415a90
mov al, byte [ecx]
cmp al, 0xd
jne 0x415a71
lea eax, [edi - 1]
cmp ecx, eax
jae 0x415a7d
cmp byte [ecx + 1], 0xa
jne 0x415a7d
inc ecx
jmp 0x415a7d
movzx eax, al
movsx eax, byte [eax + 0x43d2b0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x415a57
cmp edx, ebx
jne 0x415a57
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x415aae
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040cbf7
leave
ret

Function at 0x41bfc5
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x430a90
push 0x430a88
push str.FlsAlloc
push 0x1f
call fcn.0041be30
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41bff9
push dword [ebp + 8]
mov ecx, esi
call dword [0x42f210]
call esi
jmp 0x41bfff
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4