joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443960
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x443977
add esp, 0xfffffff0
call fcn.00403130
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00414618
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x40dcf8]
call fcn.00402e00
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x40dcf8]
call fcn.00402e00
mov dword [ebx + 0x98], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x4c], 0x80000018
mov dword [ebx + 0x68], 0x1f4
mov byte [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x64], 0x9c4
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x8d], 1
mov dl, 1
mov eax, dword [0x416470]
call fcn.0041d5bc
mov esi, eax
mov dword [ebx + 0x88], esi
push 0x443aec
mov eax, dword [0x459ea8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0041d98c
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4454e8
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x459ea8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040b828
test eax, eax
je 0x443a6a
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004081e4
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040b850
test eax, eax
je 0x443a7e
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x7c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403ce8
mov eax, dword [0x459d88]
cmp byte [eax], 0
jne 0x443aaf
mov eax, ebx
call fcn.00443bd8
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x4a], 1
mov byte [ebx + 0x4b], 1
mov byte [ebx + 0x8e], 1
xor eax, eax
mov dword [ebx + 0x90], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x443ae1
call fcn.00403188
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x443e48
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x45b7d0]
cmp dword [eax + 0x24], 0
je 0x443eeb
cmp dword [ebx + 0x84], 0
jne 0x443ee5
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x443dd8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x443ee5
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x443eae
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x443ee5
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x80]
call fcn.0040f538
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x443ebd
inc dword [ebx + 0x84]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x4448f8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x44492d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403ba0
jmp 0x444937
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.00403b0c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44585c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x445894
mov eax, esi
call fcn.0042d050
test al, al
je 0x445894
mov eax, dword [ebx + 0x74]
call fcn.0042cd54
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x445894
push 0
mov eax, dword [ebx + 0x74]
call fcn.0042cd54
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x448adc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x448bb4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x45b83c], 0
jne 0x448b98
lea eax, [ebp - 4]
mov edx, 0x448bcc
call fcn.00403b50
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00403efc
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x448b98
mov eax, ebx
call fcn.004026fc
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x448b91
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x448b7b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x448bdc
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x448b7b
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x45b83c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448b98
mov eax, dword [ebp - 0xc]
call fcn.00402714
ret
mov ebx, dword [0x45b83c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448bbb
lea eax, [ebp - 4]
call fcn.00403ab8
ret
Function at 0x453ba0
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, 0x30
mov ecx, 0x459aa4
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x44]
xor ebx, ebx
mov bl, byte [ecx]
mov edi, dword [ebp - 4]
mov bl, byte [edi + ebx - 1]
xor bl, byte [edx]
mov byte [eax], bl
inc eax
inc edx
inc ecx
dec esi
jne 0x453bc2
mov esi, 1
mov edx, 0x459b34
mov ecx, esi
dec ecx
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
shl ecx, 2
xor ebx, ebx
mov bl, byte [ebp + eax - 0x44]
add ebx, ebx
movzx edi, byte [ebp + eax - 0x3f]
add ebx, edi
mov dword [ebp - 0x10], ebx
xor ebx, ebx
mov bl, byte [ebp + eax - 0x43]
shl ebx, 3
movzx edi, byte [ebp + eax - 0x42]
shl edi, 2
add ebx, edi
movzx edi, byte [ebp + eax - 0x41]
add edi, edi
add ebx, edi
movzx eax, byte [ebp + eax - 0x40]
add ebx, eax
mov dword [ebp - 0x14], ebx
mov eax, 1
mov ebx, eax
dec ebx
je 0x453c3e
dec ebx
je 0x453c62
dec ebx
je 0x453c86
dec ebx
je 0x453ca9
jmp 0x453cc2
mov ebx, dword [ebp - 0x10]
add ebx, ebx
lea ebx, [edx + ebx*8]
mov edi, dword [ebp - 0x14]
mov bl, byte [ebx + edi - 0x40]
and bl, 8
and ebx, 0xff
shr ebx, 3
lea edi, [eax + ecx]
mov byte [ebp + edi - 0x65], bl
jmp 0x453cc2
mov ebx, dword [ebp - 0x10]
add ebx, ebx
lea ebx, [edx + ebx*8]
mov edi, dword [ebp - 0x14]
mov bl, byte [ebx + edi - 0x40]
and bl, 4
and ebx, 0xff
shr ebx, 2
lea edi, [eax + ecx]
mov byte [ebp + edi - 0x65], bl
jmp 0x453cc2
mov ebx, dword [ebp - 0x10]
add ebx, ebx
lea ebx, [edx + ebx*8]
mov edi, dword [ebp - 0x14]
mov bl, byte [ebx + edi - 0x40]
and bl, 2
and ebx, 0xff
shr ebx, 1
lea edi, [eax + ecx]
mov byte [ebp + edi - 0x65], bl
jmp 0x453cc2
mov ebx, dword [ebp - 0x10]
add ebx, ebx
lea ebx, [edx + ebx*8]
mov edi, dword [ebp - 0x14]
mov bl, byte [ebx + edi - 0x40]
and bl, 1
lea edi, [eax + ecx]
mov byte [ebp + edi - 0x65], bl
inc eax
cmp eax, 5
jne 0x453c2b
inc esi
add edx, 0x40
cmp esi, 9
jne 0x453be1
mov esi, 0x20
mov eax, 0x459ad4
mov edx, dword [ebp - 0xc]
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [ebp + ecx - 0x65]
mov byte [edx], cl
inc edx
inc eax
dec esi
jne 0x453ce6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x453d90
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
push esi
push edi
mov dword [ebp - 0x3c], ecx
mov edi, edx
mov bl, 1
lea esi, [ebp - 0x88]
mov eax, edi
mov edx, ebx
call fcn.00453b30
mov byte [esi], al
inc ebx
inc esi
cmp bl, 0x41
jne 0x453da9
mov bl, 0x1c
mov esi, 0x459cf4
lea edi, [ebp - 0x1c]
lea eax, [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov dl, byte [esi]
mov eax, dword [ebp + 8]
call fcn.00453b30
mov byte [edi], al
mov dl, byte [esi + 0x1c]
mov eax, dword [ebp + 8]
call fcn.00453b30
mov edx, dword [ebp - 0x44]
mov byte [edx], al
inc dword [ebp - 0x44]
inc edi
inc esi
dec bl
jne 0x453dcb
mov bl, 1
lea esi, [ebp - 0x3c8]
push ebp
mov edx, esi
mov eax, ebx
call fcn.00453d20
pop ecx
inc ebx
add esi, 0x30
cmp bl, 0x11
jne 0x453df8
mov bl, 1
mov eax, 0x459a24
lea edx, [ebp - 0x3e8]
lea esi, [ebp - 0x428]
cmp bl, 0x20
ja 0x453e33
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [ebp + ecx - 0x89]
mov byte [edx], cl
jmp 0x453e40
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [ebp + ecx - 0x89]
mov byte [esi], cl
inc ebx
inc esi
inc edx
inc eax
cmp bl, 0x41
jne 0x453e1f
mov byte [ebp - 0x3d], 0x10
lea eax, [ebp - 0x3c8]
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x428]
mov eax, dword [ebp - 0x48]
mov edx, eax
lea eax, [ebp - 0x408]
call fcn.00453ba0
mov bl, 0x20
lea eax, [ebp - 0x3e8]
lea edx, [ebp - 0x428]
mov cl, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec bl
jne 0x453e7a
lea esi, [ebp - 0x408]
lea edi, [ebp - 0x3e8]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x428]
lea edi, [ebp - 0x408]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
add dword [ebp - 0x48], 0x30
dec byte [ebp - 0x3d]
jne 0x453e56
mov bl, 0x40
mov esi, 0x459a64
lea eax, [ebp - 0xc8]
mov dl, byte [esi]
cmp dl, 0x20
ja 0x453ed8
and edx, 0xff
mov dl, byte [ebp + edx - 0x409]
mov byte [eax], dl
jmp 0x453ee7
and edx, 0xff
mov dl, byte [ebp + edx - 0x409]
mov byte [eax], dl
inc eax
inc esi
dec bl
jne 0x453ec0
mov bl, 1
lea esi, [ebp - 0xc8]
mov cl, byte [esi]
mov eax, dword [ebp - 0x3c]
mov edx, ebx
call fcn.00453b58
inc ebx
inc esi
cmp bl, 0x41
jne 0x453ef5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x7fee0f
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.007fee8e
jae 0x7fee1b
xor ecx, ecx
call fcn.007fee8e
jae 0x7fee45
xor eax, eax
call fcn.007fee8e
jae 0x7fee56
mov al, 0x10
call fcn.007fee8e
adc al, al
jae 0x7fee37
jne 0x7fee83
stosb byte es:[edi], al
jmp 0x7fee1c
call fcn.007fee9a
dec ecx
loop 0x7fee62
mov eax, ebp
call fcn.007fee98
jmp 0x7fee84
lodsb al, byte [esi]
shr eax, 1
je 0x7feeaa
adc ecx, 2
mov ebp, eax
jmp 0x7fee84
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.007fee98
cmp eax, 0x7d00
jae 0x7fee82
cmp eax, 0x500
jae 0x7fee83
cmp eax, 0x7f
ja 0x7fee84
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7fee1c
pop ebp
ret 8
Function at 0x402f10
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x438010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], 0x6b
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
lea esi, [ebp - 4]
mov dword [ebp - 0xc], 0x6b
sub esi, edi
mov dword [ebp - 8], 0x6b
mov eax, esi
mov dword [ebp - 0x18], esi
sar eax, 2
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x402fc8
cmp eax, 0x3fffffff
ja 0x403073
lea esi, [eax*4]
cmp esi, 0x1000
jb 0x402f99
lea eax, [esi + 0x23]
cmp eax, esi
jbe 0x403078
push eax
call fcn.0040b4b3
add esp, 4
test eax, eax
je 0x40307d
lea ebx, [eax + 0x23]
and ebx, 0xffffffe0
mov dword [ebx - 4], eax
jmp 0x402fac
test esi, esi
je 0x402faa
push esi
call fcn.0040b4b3
add esp, 4
mov ebx, eax
jmp 0x402fac
xor ebx, ebx
push dword [ebp - 0x18]
lea eax, [esi + ebx]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
push ebx
call fcn.0040c510
mov eax, dword [ebp - 0x1c]
add esp, 0xc
lea edi, [ebx + eax*4]
mov esi, ebx
cmp ebx, edi
je 0x402fde
nop
push dword [esi]
call fcn.00403090
add esi, 4
cmp esi, edi
jne 0x402fd0
mov eax, 0x21
cmp eax, 0x1c5
jl 0x402fec
call 0x7444a516
add ch, al
pop esp
jne 0x402ff2
je 0x402ff2
call 0x3dcb9451
xor byte [eax], al
add byte [eax], al
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x4418d4], eax
add eax, 0x13
jne 0x403012
call 0xf29a185e
invalid
call 0x402270
mov eax, 0x13
cmp eax, 0x1a5
jl 0x403025
jmp 0x7444a624
jne 0x40302b
je 0x40302b
call 0xfb7118ec
invalid
call 0x402b60
test ebx, ebx
je 0x403060
mov ecx, dword [ebp - 0x14]
sub ecx, ebx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x403056
mov edx, dword [ebx - 4]
add ecx, 0x23
sub ebx, edx
lea eax, [ebx - 4]
cmp eax, 0x1f
ja 0x40307d
mov ebx, edx
push ecx
push ebx
call fcn.0040b4e3
add esp, 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b4a0
mov esp, ebp
pop ebp
ret
call fcn.00407e20
call fcn.004012f0
call fcn.004127bd
int3
Function at 0x409188
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x4091a9
jl 0x4091a0
test edi, edi
jne 0x4091a9
xor eax, eax
xor edx, edx
jmp 0x40926a
cmp dword [ebx + 0x38], 0
je 0x4091be
push eax
push edi
push dword [ebp + 8]
call fcn.00409270
jmp 0x40926a
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x409205
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x409205
cmp eax, edi
jb 0x4091df
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.0040c510
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x40920b
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x40925f
mov ecx, ebx
call fcn.004089f0
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x40924a
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.00413399
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x40925f
jmp 0x40921d
test edx, edx
je 0x40925f
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00413399
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x40bc9a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40bcd9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40bcd9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40bcd9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40bcd9
cmp dword [ecx + 0x74], 0xe
jbe 0x40bcd9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x419030
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42dc18
push 0x42dc10
push str.FlsAlloc
push 0x1e
call fcn.00418e9a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x419064
push dword [ebp + 8]
mov ecx, esi
call dword [0x42a130]
call esi
jmp 0x41906a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4190ae
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42dc28
push 0x42dc20
push str.FlsGetValue
push 0x20
call fcn.00418e9a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4190e5
push dword [ebp + 8]
mov ecx, esi
call dword [0x42a130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x41cb8b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041c82d

Function at 0x41cb96
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041c9bc

Function at 0x41cf90
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040c010
mov eax, dword [0x438010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0041a5c5
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41cfd2
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41d12e
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00428a60
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x4415a8]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0041e160
mov ecx, dword [esi*4 + 0x4415a8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x41d127
cmp eax, dword [edi + ecx + 0x24]
jne 0x41d127
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41d127
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041e160
add esp, 0x14
test edx, edx
jl 0x41d127
jg 0x41d09d
test eax, eax
jb 0x41d127
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41d127
jl 0x41d0b7
cmp dword [ebp - 0x1008], eax
ja 0x41d127
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41d0d5
test ebx, ebx
je 0x41d10e
cmp ecx, edi
jae 0x41d10e
mov al, byte [ecx]
cmp al, 0xd
jne 0x41d0ef
lea eax, [edi - 1]
cmp ecx, eax
jae 0x41d0fb
cmp byte [ecx + 1], 0xa
jne 0x41d0fb
inc ecx
jmp 0x41d0fb
movzx eax, al
movsx eax, byte [eax + 0x4382a0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41d0d5
cmp edx, ebx
jne 0x41d0d5
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x41d12c
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040b4a0
leave
ret
Function at 0x41d5fe
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4415a8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41d63e
cmp byte [ebx], 0xa
jne 0x41d63e
or byte [eax + edi + 0x28], 4
jmp 0x41d643
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x41d741
mov al, byte [edx]
cmp al, 0x1a
je 0x41d723
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x41d672
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x41d697
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x41d6a1
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x41d654
jmp 0x41d741
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41d71e
cmp dword [ebp - 0xc], 0
je 0x41d71e
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x4415a8]
test byte [eax + edi + 0x28], 0x48
je 0x41d6f8
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x41d6e3
mov byte [esi], dl
jmp 0x41d6f4
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4415a8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x41d741
cmp byte [ebp - 1], 0xa
jne 0x41d707
cmp esi, ebx
jne 0x41d707
mov byte [esi], 0xa
jmp 0x41d740
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041e17e
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x41d741
mov byte [esi], 0xd
jmp 0x41d740
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x4415a8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41d73d
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41d741
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41d74a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x4415a8]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41d78d
cmp word [esi], dx
jne 0x41d78d
or byte [edi + eax + 0x28], 4
jmp 0x41d792
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x41d8e5
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x41d8c5
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x41d7d4
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41d80a
cmp eax, edx
jae 0x41d816
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x41d7ac
jmp 0x41d8e5
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41d8c1
cmp dword [ebp - 0x14], 0
je 0x41d8c1
mov eax, dword [ebx*4 + 0x4415a8]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x41d899
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x41d862
mov word [esi], cx
jmp 0x41d895
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x4415a8]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x4415a8]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x4415a8]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x41d8e5
pop ebx
cmp word [ebp - 4], bx
jne 0x41d8aa
cmp esi, dword [ebp + 0xc]
jne 0x41d8aa
mov word [esi], bx
jmp 0x41d8e2
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041e17e
add esp, 0x10
cmp word [ebp - 4], bx
je 0x41d8e5
push 0xd
jmp 0x41d8de
mov ecx, dword [ebx*4 + 0x4415a8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41d8dc
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41d8e5
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret