joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401e10
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x4042d8
call fcn.00401f7c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x405478
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x401bd1
cmp eax, esi
jne 0x401bc4
xor esi, esi
inc esi
mov ebx, esi
jmp 0x401bd4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401bab
xor esi, esi
inc esi
mov eax, dword [0x405474]
cmp eax, esi
jne 0x401be7
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x401c16
mov eax, dword [0x405474]
test eax, eax
jne 0x401c10
mov dword [0x405474], esi
push 0x4030e4
push 0x4030d8
call fcn.00401b1a
pop ecx
pop ecx
test eax, eax
je 0x401c16
jmp 0x401d3e
mov dword [0x40513c], esi
mov eax, dword [0x405474]
cmp eax, esi
jne 0x401c3a
push 0x4030d4
push 0x4030cc
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x405474], 2
test ebx, ebx
jne 0x401c46
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x40547c], 0
je 0x401c6a
push 0x40547c
call fcn.00401f04
pop ecx
test eax, eax
je 0x401c6a
push 0
push 2
push 0
call dword [0x40547c]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x401cc6
test al, al
je 0x401c84
cmp dword [ebp - 0x1c], 0
jne 0x401cc6
mov al, byte [esi]
test al, al
je 0x401c94
cmp al, 0x20
ja 0x401c94
inc esi
mov dword [ebp - 0x20], esi
jmp 0x401c84
test byte [ebp - 0x3c], 1
je 0x401ca0
movzx eax, word [ebp - 0x38]
jmp 0x401ca3
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x405138], eax
cmp dword [0x40512c], 0
jne 0x401d1a
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x401cd5
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x401ce8
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x401c71
cmp dword [0x40513c], 0
jne 0x401d29
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x405138]
jmp 0x401d4a
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00401fc1
ret
call fcn.004020ab
jmp 0x401b71

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401000
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x4370e0], 0x24e1
mov eax, dword [0x4370e0]
sub eax, 0x24e1
mov dword [0x4370e0], eax
mov ecx, 1
test ecx, ecx
je 0x4010ab
mov edx, dword [0x4370e0]
cmp edx, dword [ebp + 0xc]
jb 0x401037
jmp 0x4010ab
cmp dword [0x4370e0], 0
jne 0x401055
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x401055
xor eax, eax
jmp 0x4010ab
mov eax, dword [ebp + 8]
add eax, dword [0x4370e0]
mov ecx, dword [eax]
add ecx, dword [0x4370e0]
mov edx, dword [ebp + 8]
add edx, dword [0x4370e0]
mov dword [edx], ecx
mov dword [ebp - 4], 0x263fa
mov eax, dword [0x4370e0]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x4370e0]
push eax
call fcn.00401270
add esp, 8
mov ecx, dword [0x4370e0]
add ecx, 4
mov dword [0x4370e0], ecx
jmp 0x40101d
mov esp, ebp
pop ebp
ret
Function at 0x401980
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x114], str._ffffffffffffffff
mov eax, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x11c], eax
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [ebp - 0x114]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [ebp - 0x11c]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x4019fa
cmp dword [ebp - 0x118], 0
je 0x4019fa
jmp 0x401a5c
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
je 0x401a5c
mov dword [ebp - 0x120], 0x7dc35
mov eax, dword [ebp + 8]
add eax, 8
mov dword [0x4370d4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [0x4370f0], edx
mov dword [ebp - 0x120], 0x7dc35
mov dword [ebp - 0x120], 0x7dc35
call fcn.00401260
mov eax, dword [ebp + 8]
mov dword [0x4370ec], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
call fcn.00401b40
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x4019fa
mov esp, ebp
pop ebp
ret
Function at 0x41dc60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x42b044]
xor eax, ebp
mov dword [ebp - 4], eax
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.004012f0
add esp, 0xc
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x214], 0xffffffff
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx edx, word [ebp - 0x210]
sub edx, 0x41
mov dword [ebp - 0x218], edx
lea eax, [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0x218]
push ecx
call fcn.0041a010
add esp, 8
mov edx, dword [ebp - 0x21c]
push edx
call fcn.0041a130
add esp, 4
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
jne 0x41dd0a
xor eax, eax
jmp 0x41dd1d
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x214]
push ecx
call fcn.0041dae0
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004012de
mov esp, ebp
pop ebp
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x402793
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x4027a2
pop dword [ebp - 0x20]
mov eax, 0xfcc87441
add eax, 0x377b361
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x3c01a
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x610c282b
add ecx, 0x9ef42890
xor ebx, ebx
add ebx, eax
mov edx, 0x851a7c8d
sub edx, 0x84d940c9
add edx, dword [ebp - 0x20]
mov edi, 0x7507a889
mov esi, dword [edx]
xor dword [ebp - 0x10], esi
add esi, edi
sub dword [ebp - 4], 0x6d6ca68
mov dword [ebx], esi
sub dword [ebp - 0x14], edx
add ebx, 0x37892371
sub ebx, 0x3789236d
add edx, 0x634eba93
add edx, 0x9cb14571
loop 0x4027f8
add eax, 0x80ef3a10
sub eax, 0x80ee0451
mov ebx, eax
add eax, 5
mov ecx, 0x1a87d8c0
add ecx, 0xe5b82740
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40c302
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40c311
pop dword [ebp - 0x2c]
mov eax, 0x21e2e2a8
add eax, 0xde5de069
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x35a6e
push 0
mov eax, 0xc6e37dbb
sub eax, 0xc6a29ce3
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x3866
mov edi, eax
mov ebx, 0x413bc4
add ebx, dword [ebp - 0x2c]
mov esi, 0x87690c8f
add esi, 0xb26099fe
xor dword [ebp - 0x24], ecx
mov edx, dword [ebx]
xor edx, esi
mov dword [ebp - 8], 0x20577afd
mov dword [edi], edx
add dword [ebp - 0x20], 0x528b4964
add edi, 0xfc330c79
sub edi, 0xfc330c75
add ebx, 0x5a857248
add ebx, 0xa57a8dbc
loop 0x40c364
add eax, 0xce1e4b14
sub eax, 0xce1d76a9
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x40894f
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edi, 0x4085d8
call fcn.0040896c
mov ecx, edx
xor dword [ebx], edi
sub edx, edx
inc ebx
add ecx, ecx
or ecx, edx
cmp ebx, esi
jne fcn.0040894f
ret

Function at 0x40ffe7
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x410015
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x410033
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0040ff4d
jmp 0x410033
mov eax, dword [esi + 0x14]
test eax, eax
je 0x410033
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0040ff4d
test edi, edi
mov eax, edi
jne 0x41001d
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x405660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40566f
pop dword [ebp - 0x14]
mov eax, 0x40566f
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3ef7e
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0xcf82841f
add ecx, 0x307ddae8
xor edi, edi
add edi, eax
mov ebx, 0x53612f61
sub ebx, 0x531ff39d
add ebx, dword [ebp - 0x14]
mov esi, 0xbf379607
add dword [ebp - 0xc], 0x1d91c4f8
mov edx, dword [ebx]
sub dword [ebp - 0xc], esi
xor edx, esi
add dword [ebp - 8], ebx
mov dword [edi], edx
add dword [ebp - 0x10], edx
add edi, 4
add ebx, 4
loop 0x4056c0
add eax, 0x48f4913a
sub eax, 0x48f3224b
mov ebx, eax
add eax, 5
mov ecx, 0x26933092
sub ecx, 0x26533092
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x409607
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404f19
and dword [ebp - 4], 0
cmp dword [0x412990], 0
mov ebx, eax
jne 0x4096b8
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409769
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409769
push eax
call fcn.00405660
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x412990], eax
call esi
push eax
call fcn.00405660
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x412994], eax
call esi
push eax
call fcn.00405660
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x412998], eax
call esi
push eax
call fcn.00405660
pop ecx
mov dword [0x4129a0], eax
test eax, eax
je 0x4096b8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405660
pop ecx
mov dword [0x41299c], eax
mov eax, dword [0x41299c]
cmp eax, ebx
je 0x409710
cmp dword [0x4129a0], ebx
je 0x409710
push eax
call fcn.00405660
push dword [0x4129a0]
mov esi, eax
call fcn.00405660
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409710
test edi, edi
je 0x409710
call esi
test eax, eax
je 0x409707
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409707
test byte [ebp - 0xc], 1
jne 0x409710
or dword [ebp + 0x10], 0x200000
jmp 0x409749
mov eax, dword [0x412994]
cmp eax, ebx
je 0x409749
push eax
call fcn.00405660
pop ecx
test eax, eax
je 0x409749
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409749
mov eax, dword [0x412998]
cmp eax, ebx
je 0x409749
push eax
call fcn.00405660
pop ecx
test eax, eax
je 0x409749
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x412990]
call fcn.00405660
pop ecx
test eax, eax
je 0x409769
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40976b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401c95
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x224
mov eax, 0x4245ef
call fcn.00407337
xor ecx, ecx
mov ebx, pe_nt_image_headers32
mov byte [ebp + ecx - 0x118], cl
mov eax, ecx
and eax, 0xf
mov al, byte [eax + 0x4306d0]
mov byte [ebp + ecx - 0x230], al
inc ecx
cmp ecx, ebx
jl 0x401cab
xor esi, esi
xor edi, edi
mov dl, byte [ebp + esi - 0x118]
movzx eax, byte [ebp + esi - 0x230]
movzx ecx, dl
add edi, eax
add edi, ecx
and edi, 0x800000ff
jns 0x401cf3
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + edi - 0x118]
mov byte [ebp + esi - 0x118], al
mov byte [ebp + edi - 0x118], dl
inc esi
cmp esi, ebx
jl 0x401ccd
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x128], ebx
xor esi, esi
mov dword [ebp - 0x12c], esi
cmp esi, 0x9d400
jae 0x401df9
inc edi
and edi, 0x800000ff
jns 0x401d3c
dec edi
or edi, 0xffffff00
inc edi
mov dword [ebp - 0x130], edi
and dword [ebp - 4], 0
mov cl, byte [ebp + edi - 0x118]
movzx edx, cl
add ebx, edx
and ebx, 0x800000ff
jns 0x401d62
dec ebx
or ebx, 0xffffff00
inc ebx
mov dword [ebp - 0x128], ebx
mov al, byte [ebp + ebx - 0x118]
mov byte [ebp + edi - 0x118], al
mov byte [ebp + ebx - 0x118], cl
movzx eax, byte [ebp + edi - 0x118]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x118]
xor al, byte [esi + 0x433a60]
mov byte [esi + 0x433a60], al
or dword [ebp - 4], 0xffffffff
jmp 0x401df3
inc esi
jmp 0x401d19
call fcn.00407289
ret

Function at 0x401e04
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2c
mov eax, dword [0x433010]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
mov ebx, edx
push edi
mov dword [esp + 0x10], ebx
mov edi, ecx
call fcn.00403dd5
mov edx, ebx
mov ecx, eax
call fcn.00403b7c
push eax
call fcn.00403f9a
mov eax, dword [edi + 0x3c]
xor esi, esi
pop ecx
mov ebp, dword [eax + edi + 0x78]
add ebp, edi
mov ebx, dword [ebp + 0x20]
mov eax, dword [ebp + 0x18]
add ebx, edi
mov dword [esp + 0x18], eax
test eax, eax
je 0x401ead
mov eax, dword [ebx]
lea ecx, [esp + 0x1c]
add eax, edi
push eax
call fcn.004025dc
mov edx, dword [esp + 0x10]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [esp + 0x14], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401e69
sub ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
cmp dword [esp + 0x30], 0x10
cmovae eax, dword [esp + 0x1c]
cmp dword [esp + 0x2c], ecx
jne 0x401e9a
push dword [esp + 0x2c]
push edx
push eax
call fcn.00408900
add esp, 0xc
test eax, eax
je 0x401ec4
lea ecx, [esp + 0x1c]
add ebx, 4
call fcn.00402ea8
inc esi
cmp esi, dword [esp + 0x18]
jb 0x401e4e
xor esi, esi
mov ecx, dword [esp + 0x34]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00406d55
add esp, 0x2c
ret
mov eax, dword [ebp + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edi]
mov eax, dword [ebp + 0x1c]
lea eax, [eax + ecx*4]
mov esi, dword [eax + edi]
lea ecx, [esp + 0x1c]
call fcn.00402ea8
jmp 0x401eaf
Function at 0x4079df
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x407a1e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x407a1e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x407a1e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x407a1e
cmp dword [ecx + 0x74], 0xe
jbe 0x407a1e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4146fd
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x428a58
push 0x428a50
push str.FlsAlloc
push 0x1e
call fcn.0041456a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x414731
push dword [ebp + 8]
mov ecx, esi
call dword [0x425140]
call esi
jmp 0x414737
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41477b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x428a68
push 0x428a60
push str.FlsGetValue
push 0x20
call fcn.0041456a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4147b2
push dword [ebp + 8]
mov ecx, esi
call dword [0x425140]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x417846
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004174e8

Function at 0x417851
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00417677
Function at 0x418ebc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00407b50
mov eax, dword [0x433010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00415c92
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x418efe
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41905a
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004240a0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x4d1e40]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.004192e2
mov ecx, dword [esi*4 + 0x4d1e40]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x419053
cmp eax, dword [edi + ecx + 0x24]
jne 0x419053
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x419053
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004192e2
add esp, 0x14
test edx, edx
jl 0x419053
jg 0x418fc9
test eax, eax
jb 0x419053
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x419053
jl 0x418fe3
cmp dword [ebp - 0x1008], eax
ja 0x419053
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x419001
test ebx, ebx
je 0x41903a
cmp ecx, edi
jae 0x41903a
mov al, byte [ecx]
cmp al, 0xd
jne 0x41901b
lea eax, [edi - 1]
cmp ecx, eax
jae 0x419027
cmp byte [ecx + 1], 0xa
jne 0x419027
inc ecx
jmp 0x419027
movzx eax, al
movsx eax, byte [eax + 0x433950]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x419001
cmp edx, ebx
jne 0x419001
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x419058
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00406d55
leave
ret
Function at 0x41c583
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41c620
push ebx
push esi
call fcn.0041c54c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041b1d1
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41c5cd
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41c61f
push edi
push eax
call fcn.00414d30
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41c5ed
call fcn.0041428f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41c61e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041b1d1
add esp, 0x20
test eax, eax
jne 0x41c60c
push edi
call fcn.0041428f
jmp 0x41c614
push ebx
call fcn.0041428f
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4210db
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4d1e40]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x42111b
cmp byte [ebx], 0xa
jne 0x42111b
or byte [eax + edi + 0x28], 4
jmp 0x421120
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x42121e
mov al, byte [edx]
cmp al, 0x1a
je 0x421200
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x42114f
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x421174
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x42117e
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x421131
jmp 0x42121e
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4211fb
cmp dword [ebp - 0xc], 0
je 0x4211fb
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x4d1e40]
test byte [eax + edi + 0x28], 0x48
je 0x4211d5
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4211c0
mov byte [esi], dl
jmp 0x4211d1
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4d1e40]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x42121e
cmp byte [ebp - 1], 0xa
jne 0x4211e4
cmp esi, ebx
jne 0x4211e4
mov byte [esi], 0xa
jmp 0x42121d
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00419300
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x42121e
mov byte [esi], 0xd
jmp 0x42121d
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x4d1e40]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x42121a
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x42121e
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret