joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416d30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x44e004]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push esi
push edi
push 0x118
lea eax, [esp + 0x14]
mov esi, edx
push 0
push eax
mov ebx, ecx
call fcn.0042a720
push dword [ebp + 8]
mov edx, esi
mov dword [ebx + 4], 0
lea ecx, [esp + 0x20]
lea edi, [ebx + 8]
call fcn.00415dc0
mov edx, eax
add esp, 0x10
mov dword [esp + 0xc], edx
test edx, edx
jne 0x416f23
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [ebx], edx
lea ecx, [ecx + edx*4]
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
sub ecx, 0x10
mov dword [edi + 0xc], eax
add edi, 0x10
mov esi, dword [ebx]
dec esi
test esi, esi
jle 0x416f09
nop word [eax + eax]
movzx eax, byte [ecx + 3]
dec esi
movzx edx, byte [eax + 0x44fc00]
movzx eax, byte [ecx + 2]
mov edx, dword [edx*4 + 0x44fd00]
movzx eax, byte [eax + 0x44fc00]
xor edx, dword [eax*4 + 0x451a00]
movzx eax, byte [ecx + 1]
movzx eax, byte [eax + 0x44fc00]
xor edx, dword [eax*4 + 0x450a00]
movzx eax, byte [ecx]
movzx eax, byte [eax + 0x44fc00]
xor edx, dword [eax*4 + 0x450e00]
movzx eax, byte [ecx + 7]
mov dword [edi], edx
movzx edx, byte [eax + 0x44fc00]
movzx eax, byte [ecx + 6]
mov edx, dword [edx*4 + 0x44fd00]
movzx eax, byte [eax + 0x44fc00]
xor edx, dword [eax*4 + 0x451a00]
movzx eax, byte [ecx + 5]
movzx eax, byte [eax + 0x44fc00]
xor edx, dword [eax*4 + 0x450a00]
movzx eax, byte [ecx + 4]
movzx eax, byte [eax + 0x44fc00]
xor edx, dword [eax*4 + 0x450e00]
movzx eax, byte [ecx + 0xb]
mov dword [edi + 4], edx
movzx edx, byte [eax + 0x44fc00]
movzx eax, byte [ecx + 0xa]
mov edx, dword [edx*4 + 0x44fd00]
movzx eax, byte [eax + 0x44fc00]
xor edx, dword [eax*4 + 0x451a00]
movzx eax, byte [ecx + 9]
movzx eax, byte [eax + 0x44fc00]
xor edx, dword [eax*4 + 0x450a00]
movzx eax, byte [ecx + 8]
movzx eax, byte [eax + 0x44fc00]
xor edx, dword [eax*4 + 0x450e00]
movzx eax, byte [ecx + 0xf]
mov dword [edi + 8], edx
movzx edx, byte [eax + 0x44fc00]
movzx eax, byte [ecx + 0xe]
mov edx, dword [edx*4 + 0x44fd00]
movzx eax, byte [eax + 0x44fc00]
xor edx, dword [eax*4 + 0x451a00]
movzx eax, byte [ecx + 0xd]
movzx eax, byte [eax + 0x44fc00]
xor edx, dword [eax*4 + 0x450a00]
movzx eax, byte [ecx + 0xc]
sub ecx, 0x10
movzx eax, byte [eax + 0x44fc00]
xor edx, dword [eax*4 + 0x450e00]
mov dword [edi + 0xc], edx
add edi, 0x10
test esi, esi
jg 0x416dd0
mov eax, dword [ecx]
mov edx, dword [esp + 0xc]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [edi + 0xc], eax
mov ecx, 0x118
lea eax, [esp + 0x10]
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x416f30
mov ecx, dword [esp + 0x12c]
mov eax, edx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00429577
mov esp, ebp
pop ebp
ret
Function at 0x41b020
Capabilities:
Hash data using sha224

Disassembly:
mov dword [ecx], 0
xor eax, eax
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0xc1059ed8
mov dword [ecx + 0x14], 0xcbbb9d5d
mov dword [ecx + 0x18], 0x367cd507
mov dword [ecx + 0x1c], 0x629a292a
mov dword [ecx + 0x20], 0x3070dd17
mov dword [ecx + 0x24], 0x9159015a
mov dword [ecx + 0x28], 0xf70e5939
mov dword [ecx + 0x2c], 0x152fecd8
mov dword [ecx + 0x30], 0xffc00b31
mov dword [ecx + 0x34], 0x67332667
mov dword [ecx + 0x38], 0x68581511
mov dword [ecx + 0x3c], 0x8eb44a87
mov dword [ecx + 0x40], 0x64f98fa7
mov dword [ecx + 0x44], 0xdb0c2e0d
mov dword [ecx + 0x48], 0xbefa4fa4
mov dword [ecx + 0x4c], 0x47b5481d
mov dword [ecx + 0xd0], 1
ret
Function at 0x421550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, edx
mov esi, ecx
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], esi
cmp esi, edi
jne 0x42156e
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x44f640]
movzx eax, byte [ebp + 8]
movzx edx, word [edi + 6]
xor ecx, eax
push ebx
mov ebx, ecx
neg ecx
shr ebx, 1
neg ebx
or ebx, ecx
mov ecx, esi
shr ebx, 0x1f
neg ebx
call fcn.004216c0
test eax, eax
jne 0x421667
movzx edx, word [esi + 6]
mov ecx, edi
call fcn.004216c0
mov dword [ebp - 8], eax
test eax, eax
jne 0x421667
mov edx, dword [0x44f640]
mov eax, dword [ebp - 0xc]
xor edx, ebx
movzx edi, word [esi + 4]
not edx
movzx esi, bx
mov cx, word [eax + 4]
mov eax, dword [ebp - 4]
inc cx
and cx, si
movzx eax, word [eax + 4]
inc ax
and ax, dx
mov edx, dword [0x44f640]
or cx, ax
xor edx, ebx
mov eax, dword [ebp - 4]
dec cx
not edx
mov word [eax + 4], cx
lea ecx, [edi + 1]
and ecx, esi
mov esi, dword [ebp - 0xc]
movzx eax, word [esi + 4]
inc ax
and ax, dx
or cx, ax
mov eax, dword [ebp - 4]
dec cx
mov word [esi + 4], cx
mov esi, dword [esi]
mov ecx, dword [eax]
cmp ecx, esi
je 0x421664
movzx edi, word [eax + 6]
test edi, edi
je 0x421664
sub ecx, esi
mov dword [ebp - 0xc], ecx
mov edx, dword [ecx + esi]
lea esi, [esi + 4]
mov eax, dword [0x44f640]
and edx, ebx
mov ecx, dword [ecx + esi - 4]
xor eax, ebx
not eax
and ecx, eax
mov eax, dword [esi - 4]
and eax, ebx
or ecx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + esi - 4], ecx
mov eax, dword [0x44f640]
mov ecx, dword [esi - 4]
xor eax, ebx
not eax
and ecx, eax
or ecx, edx
mov dword [esi - 4], ecx
mov ecx, dword [ebp - 0xc]
sub edi, 1
jne 0x421624
mov eax, dword [ebp - 8]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x421a30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov ebx, 1
push edi
mov edi, edx
mov dword [ebp - 4], edi
movzx eax, word [esi + 6]
mov ecx, eax
cmp eax, ebx
jae 0x421ab1
push 4
push ebx
call fcn.0042c694
mov edi, eax
add esp, 8
test edi, edi
jne 0x421a68
pop edi
pop esi
lea eax, [ebx - 0x11]
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi]
test ecx, ecx
je 0x421aa6
movzx eax, word [esi + 6]
shl eax, 2
push eax
push ecx
push edi
call fcn.0042b1a0
mov edx, dword [esi]
add esp, 0xc
test edx, edx
je 0x421a9d
movzx ecx, word [esi + 6]
shl ecx, 2
test ecx, ecx
je 0x421a9d
mov eax, edx
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, ebx
jne 0x421a93
push edx
call fcn.0042f371
add esp, 4
mov dword [esi], edi
mov ecx, ebx
mov edi, dword [ebp - 4]
mov word [esi + 6], bx
movzx eax, cx
shl eax, 2
push eax
push 0
push dword [esi]
call fcn.0042a720
mov ecx, dword [esi]
mov eax, edi
cdq
add esp, 0xc
shr edi, 0x1f
xor eax, edx
add edi, edi
sub eax, edx
sub ebx, edi
mov dword [ecx], eax
mov word [esi + 4], bx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x424180
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x18], ecx
mov edx, 4
sub ecx, eax
sub ebx, eax
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, eax
sub edx, eax
mov eax, dword [ebx + esi]
lea esi, [esi + 4]
xor eax, dword [esi - 4]
add edi, 4
mov dword [ecx + esi - 4], eax
lea eax, [edx + esi]
cmp eax, 0x10
jbe 0x4241a6
mov edx, 0x10
mov esi, edx
sub esi, edi
cmp edi, edx
jae 0x4242c5
cmp esi, 0x40
jb 0x4242a9
mov eax, dword [ebp - 0x18]
lea ecx, [edi + eax]
mov dword [ebp - 8], ecx
lea ecx, [eax + 0xf]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
lea ecx, [edi + eax]
add eax, 0xf
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 8], eax
ja 0x424203
mov eax, ecx
cmp dword [ebp - 0x10], eax
jae 0x4242a9
mov eax, dword [ebp - 0xc]
lea ecx, [edi + eax]
add eax, 0xf
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 8], eax
ja 0x42421f
mov eax, ecx
cmp dword [ebp - 0x10], eax
jae 0x4242a9
mov ecx, dword [ebp - 0xc]
and esi, 0x3f
mov eax, edx
mov edx, dword [ebp - 0xc]
sub eax, esi
mov esi, dword [ebp - 8]
mov dword [ebp - 0x10], eax
add esi, 0x20
mov eax, dword [ebp - 0x14]
add eax, 0x10
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 4]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x40]
movups xmm1, xmmword [edi + edx]
lea esi, [esi + 0x40]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x40]
movups xmmword [esi - 0x60], xmm1
movups xmm1, xmmword [eax + ebx - 0x40]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x30]
movups xmmword [eax + ecx - 0x40], xmm1
mov ecx, dword [ebp - 0x1c]
movups xmm1, xmmword [ecx + esi - 0x40]
mov ecx, dword [ebp - 4]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x20]
movups xmmword [esi - 0x40], xmm1
movups xmm1, xmmword [edi + edx + 0x30]
add edi, 0x40
pxor xmm1, xmm0
movups xmmword [esi - 0x30], xmm1
cmp edi, dword [ebp - 0x10]
jb 0x424244
mov dword [ebp - 0x1c], edi
mov edx, 0x10
cmp edi, 0x10
jae 0x4242c5
mov eax, dword [ebp + 8]
mov esi, dword [ebp - 4]
add eax, edi
sub edx, edi
mov cl, byte [ebx + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
mov byte [esi + eax - 1], cl
sub edx, 1
jne 0x4242b3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4245f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
cmp ebx, 0x80
je 0x424613
cmp ebx, 0xc0
je 0x424613
cmp ebx, 0x100
jne 0x424667
mov esi, dword [0x44bd74]
test esi, esi
je 0x424667
mov ecx, 0x44bd74
mov edx, dword [esi + 4]
mov eax, edx
shr eax, 0x1a
and eax, 0x1f
mov eax, dword [eax*4 + 0x44bd60]
cmp dword [eax], 2
jne 0x42465d
test esi, esi
jne 0x424641
xor eax, eax
jmp 0x42464b
mov eax, edx
shr eax, 2
and eax, 0x3c0
cmp eax, ebx
jne 0x42465d
mov eax, edx
and eax, 0xf000
cmp eax, 0x1000
je 0x424671
mov esi, dword [ecx + 8]
add ecx, 8
test esi, esi
jne 0x424622
mov eax, 0xffffffec
pop edi
pop esi
pop ebx
pop ebp
ret
test esi, esi
je 0x424667
and edx, 0x1f
cmp edx, 0x10
jne 0x424667
test edi, edi
je 0x4246bb
mov ecx, dword [edi + 0x34]
test ecx, ecx
je 0x4246a3
mov eax, dword [edi]
push ecx
mov eax, dword [eax + 4]
shr eax, 0x1a
and eax, 0x1f
mov eax, dword [eax*4 + 0x44bd60]
mov eax, dword [eax + 0x14]
call eax
add esp, 4
mov ecx, 0x38
mov eax, edi
nop word [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4246b0
push 0x38
push 0
push edi
call fcn.0042a720
mov eax, dword [esi + 4]
add esp, 0xc
shr eax, 0x1a
and eax, 0x1f
mov eax, dword [eax*4 + 0x44bd60]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x4246f2
call eax
mov dword [edi + 0x34], eax
test eax, eax
jne 0x4246f2
pop edi
pop esi
mov eax, 0xffff9e80
pop ebx
pop ebp
ret
mov edx, dword [ebp + 8]
mov ecx, edi
push 1
push ebx
mov dword [edi], esi
call fcn.00415400
add esp, 8
test eax, eax
jne 0x42466c
mov ecx, edi
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.004242d0
Function at 0x425490
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [0x44f640]
mov eax, dword [0x44f640]
mov eax, dword [0x44f640]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
test edi, edi
je 0x4255ad
lea eax, [edi - 1]
sub ecx, edx
lea eax, [edx + eax*4]
mov dword [ebp - 8], ecx
mov dword [ebp + 8], eax
push esi
nop word [eax + eax]
mov esi, dword [0x44f640]
xor esi, dword [eax]
mov edx, dword [0x44f640]
xor edx, dword [ecx + eax]
mov eax, edx
xor eax, esi
sub esi, edx
shr eax, 0x1f
xor eax, dword [0x44f640]
mov ecx, eax
neg eax
shr ecx, 1
neg ecx
or ecx, eax
mov eax, dword [0x44f640]
shr ecx, 0x1f
neg ecx
xor eax, ecx
and ecx, edx
not eax
and esi, eax
mov eax, dword [0x44f640]
or esi, ecx
shr esi, 0x1f
xor eax, esi
mov esi, dword [0x44f640]
mov edx, dword [0x44f640]
mov ecx, eax
shr ecx, 1
neg eax
neg ecx
or ecx, eax
mov eax, dword [ebp - 8]
shr ecx, 0x1f
neg ecx
or dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
xor esi, dword [eax + ecx]
xor edx, dword [ecx]
mov eax, edx
xor eax, esi
sub esi, edx
shr eax, 0x1f
xor eax, dword [0x44f640]
mov ecx, eax
neg eax
shr ecx, 1
neg ecx
or ecx, eax
mov eax, dword [0x44f640]
shr ecx, 0x1f
neg ecx
xor eax, ecx
and ecx, edx
not eax
and esi, eax
mov eax, dword [0x44f640]
or esi, ecx
shr esi, 0x1f
xor eax, esi
mov edx, eax
neg eax
shr edx, 1
neg edx
or edx, eax
mov eax, dword [ebp - 4]
shr edx, 0x1f
mov ecx, eax
neg edx
not ecx
or eax, edx
and ecx, edx
mov dword [ebp - 4], eax
or ebx, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
sub eax, 4
mov dword [ebp + 8], eax
sub edi, 1
jne 0x4254d0
pop esi
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4255c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
cmp ecx, edi
je 0x425602
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x425601
push ebx
mov ebx, dword [ebp + 0xc]
sub edi, ecx
nop dword [eax + eax]
mov edx, dword [0x44f640]
lea ecx, [ecx + 4]
mov eax, dword [edi + ecx - 4]
xor edx, ebx
not edx
and eax, ebx
and edx, dword [ecx - 4]
or eax, edx
mov dword [ecx - 4], eax
sub esi, 1
jne 0x4255e0
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x425a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x44f640]
mov eax, dword [0x44f640]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], edx
mov edi, ecx
lea eax, [ebx - 1]
test eax, eax
js 0x425a35
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + eax*4]
test esi, esi
jne 0x425af6
sub eax, 1
jns 0x425a25
xor eax, eax
lea edx, [eax + 7]
mov dword [ebp - 8], eax
shr edx, 3
mov eax, 4
cmp eax, edx
mov dword [ebp - 4], edx
mov ecx, 0
sbb eax, eax
and eax, 0xffffff24
add eax, 0xfa
test dl, 3
mov dword [ebp - 0xc], eax
mov eax, edx
setne cl
shr eax, 2
add ecx, eax
mov dword [ebp - 0x10], ecx
lea esi, [ecx*4]
mov eax, esi
mov dword [ebp - 0x18], esi
sub eax, edx
mov dword [ebp - 0x14], eax
nop
cmp ebx, ecx
jb 0x425c12
push eax
push 0
push edi
call fcn.0042a720
lea ecx, [esi + edi]
mov eax, ebx
mov esi, dword [ebp - 0x10]
sub eax, esi
shl eax, 2
push eax
push 0
push ecx
call fcn.0042a720
push dword [ebp - 4]
mov eax, dword [ebp - 0x14]
add eax, edi
push eax
push dword [ebp + 0x14]
call dword [ebp + 0x10]
mov ecx, eax
add esp, 0x24
mov dword [ebp + 0xc], ecx
test ecx, ecx
jne 0x425c09
test esi, esi
je 0x425b17
mov eax, dword [ebp - 0x18]
mov esi, edi
add eax, 0xfffffffc
add eax, edi
cmp edi, eax
ja 0x425b17
mov ecx, dword [eax]
mov edx, dword [esi]
bswap ecx
bswap edx
mov dword [esi], ecx
add esi, 4
mov dword [eax], edx
sub eax, 4
cmp esi, eax
jbe 0x425ad8
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
jmp 0x425b1f
mov edx, closesocket
xor ecx, ecx
nop dword [eax]
test edx, esi
jne 0x425b0c
inc ecx
shr edx, 1
cmp ecx, 0x20
jb 0x425b00
inc eax
shl eax, 5
sub eax, ecx
jmp 0x425a37
test ecx, ecx
jne 0x425c09
mov eax, dword [ebp - 4]
mov edx, ebx
shl eax, 3
mov ecx, edi
sub eax, dword [ebp - 8]
push eax
call fcn.00425610
add esp, 4
sub dword [ebp - 0xc], 1
je 0x425bfd
mov esi, dword [0x44f640]
mov edx, dword [0x44f640]
xor esi, dword [edi]
xor edx, dword [ebp - 0x1c]
mov eax, edx
xor eax, esi
sub esi, edx
shr eax, 0x1f
xor eax, dword [0x44f640]
mov ecx, eax
neg eax
shr ecx, 1
neg ecx
or ecx, eax
mov eax, dword [0x44f640]
shr ecx, 0x1f
neg ecx
xor eax, ecx
and ecx, edx
not eax
mov edx, 1
and esi, eax
mov eax, dword [0x44f640]
or esi, ecx
shr esi, 0x1f
xor eax, esi
mov esi, dword [0x44f640]
mov ecx, eax
neg eax
shr ecx, 1
neg ecx
or ecx, eax
shr ecx, 0x1f
dec ecx
mov dword [ebp - 0x20], ecx
cmp ebx, edx
jbe 0x425bc8
mov eax, dword [0x44f640]
xor eax, dword [edi + edx*4]
inc edx
mov ecx, eax
neg eax
shr ecx, 1
neg ecx
or ecx, eax
shr ecx, 0x1f
neg ecx
or esi, ecx
cmp edx, ebx
jb 0x425ba7
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp + 8]
or esi, ecx
push ebx
mov ecx, edi
call fcn.00425490
mov ecx, dword [ebp - 0x10]
and eax, esi
add esp, 4
cmp eax, dword [0x44f640]
mov eax, dword [ebp - 0x14]
lea esi, [ecx*4]
je 0x425a80
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xfffffff2
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0xfffffffc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433eb1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x44f190]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x433ef1
cmp byte [ebx], 0xa
jne 0x433ef1
or byte [eax + edi + 0x28], 4
jmp 0x433ef6
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x433ff4
mov al, byte [edx]
cmp al, 0x1a
je 0x433fd6
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x433f25
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x433f4a
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x433f54
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x433f07
jmp 0x433ff4
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x433fd1
cmp dword [ebp - 0xc], 0
je 0x433fd1
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x44f190]
test byte [eax + edi + 0x28], 0x48
je 0x433fab
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x433f96
mov byte [esi], dl
jmp 0x433fa7
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x44f190]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x433ff4
cmp byte [ebp - 1], 0xa
jne 0x433fba
cmp esi, ebx
jne 0x433fba
mov byte [esi], 0xa
jmp 0x433ff3
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00439674
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x433ff4
mov byte [esi], 0xd
jmp 0x433ff3
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x44f190]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x433ff0
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x433ff4
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x433ffd
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x44f190]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x434040
cmp word [esi], dx
jne 0x434040
or byte [edi + eax + 0x28], 4
jmp 0x434045
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x434198
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x434178
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x434087
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4340bd
cmp eax, edx
jae 0x4340c9
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x43405f
jmp 0x434198
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x434174
cmp dword [ebp - 0x14], 0
je 0x434174
mov eax, dword [ebx*4 + 0x44f190]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x43414c
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x434115
mov word [esi], cx
jmp 0x434148
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x44f190]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x44f190]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x44f190]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x434198
pop ebx
cmp word [ebp - 4], bx
jne 0x43415d
cmp esi, dword [ebp + 0xc]
jne 0x43415d
mov word [esi], bx
jmp 0x434195
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00439674
add esp, 0x10
cmp word [ebp - 4], bx
je 0x434198
push 0xd
jmp 0x434191
mov ecx, dword [ebx*4 + 0x44f190]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x43418f
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x434198
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4360d9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44505c
push 0x445054
push str.FlsAlloc
push 0x1e
call fcn.00435f9a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43610d
push dword [ebp + 8]
mov ecx, esi
call dword [0x4431f4]
call esi
jmp 0x436113
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x436157
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44506c
push 0x445064
push str.FlsGetValue
push 0x20
call fcn.00435f9a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43618e
push dword [ebp + 8]
mov ecx, esi
call dword [0x4431f4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x43aa68
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x43ab05
push ebx
push esi
call fcn.0043aa31
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0043a97a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x43aab2
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x43ab04
push edi
push eax
call fcn.00436934
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x43aad2
call fcn.00435e2d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x43ab03
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0043a97a
add esp, 0x20
test eax, eax
jne 0x43aaf1
push edi
call fcn.00435e2d
jmp 0x43aaf9
push ebx
call fcn.00435e2d
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x43ab08
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x43ab19
pop esi
ret
push ebx
push edi
push esi
call fcn.0043aa31
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00436934
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x43ab41
push ebx
push esi
push edi
call fcn.0042b1a0
add esp, 0xc
push 0
call fcn.00435e2d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x43b28d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043adb4