joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100287a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x428
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x10028f30
mov edi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x30], 2
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x24], 0
cmp edi, 0x201
jae 0x10028830
jmp 0x1002881e
jbe 0x100288af
cmp edi, 0x201
jae 0x10028830
mov dword [ebp - 0x34], 0x200
lea ebx, [ebp - 0x434]
mov esi, edi
jmp 0x10028861
mov esi, dword [ebp - 0x20]
sub edi, esi
je 0x10028855
mov dword [ebp - 0x10], 0
push edi
push esi
lea eax, [ebp - 0x2c]
push eax
call fcn.1004d670
add esp, 0xc
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x30]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x20], esi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
test eax, eax
jne 0x10028881
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100288f1
cmp edi, esi
jne 0x10028810
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1002895a
lea edi, [esi + esi]
test esi, esi
mov eax, 0xffffffff
cmovs edi, eax
cmp edi, 0x201
jb 0x1002881e
jmp 0x10028830
mov eax, dword [ebp - 0x34]
cmp edi, eax
ja 0x10028977
test edi, edi
je 0x10028910
lea ecx, [edi + edi]
cmp edi, 0x3fffffff
mov dword [ebp - 0x20], ecx
ja 0x1002898f
movzx eax, byte [0x100da049]
push 2
push ecx
call fcn.1000c280
add esp, 8
test eax, eax
je 0x10028993
mov esi, eax
mov eax, dword [ebp - 0x20]
jmp 0x10028917
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp + 8]
mov byte [ebx + 4], 0
mov dword [ebx + 8], eax
mov dword [ebx], bind
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x10028934
jmp 0x10028944
mov esi, 2
xor eax, eax
push eax
push ebx
push esi
call fcn.1003eb30
add esp, 0xc
mov ebx, dword [ebp + 8]
mov dword [ebx], edi
mov dword [ebx + 4], esi
mov dword [ebx + 8], edi
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x10028944
add eax, eax
push 2
push eax
push dword [ebp - 0x28]
call fcn.1000c290
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x428
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
push 0x100b9060
push 0x28
push str.internal_error:_entered_unreachable_codes
call fcn.1004dc40
add esp, 0xc
jmp 0x100289ab
mov dword [ebp - 0x10], 0
push 0x100b9028
push eax
push edi
call fcn.1004df00
add esp, 0xc
jmp 0x100289ab
xor eax, eax
jmp 0x10028998
mov eax, 2
mov dword [ebp - 0x10], 0
push dword [ebp - 0x20]
push eax
call fcn.1004da30
add esp, 8
ud2
Function at 0x10028c70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x438
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x10028f50
mov esi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x2c], 2
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x20], 0
cmp esi, 0x201
jae 0x10028d00
jmp 0x10028cee
jbe 0x10028d86
cmp esi, 0x201
jae 0x10028d00
mov dword [ebp - 0x30], 0x200
lea ebx, [ebp - 0x444]
mov edi, esi
jmp 0x10028d31
mov edi, dword [ebp - 0x34]
sub esi, edi
je 0x10028d25
mov dword [ebp - 0x10], 0
push esi
push edi
lea eax, [ebp - 0x28]
push eax
call fcn.1004d670
add esp, 0xc
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x10028d55
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10028de9
cmp esi, edi
jne 0x10028ce0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10028e08
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x10028cee
jmp 0x10028d00
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], 0
cmp esi, eax
ja 0x10028e25
lea eax, [ebp - 0x44]
push esi
push ebx
push eax
call fcn.10017a40
add esp, 0xc
movsd xmm0, qword [ebp - 0x44]
mov esi, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x3c]
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x10028dd3
add eax, eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.1000c290
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x438
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 8]
mov byte [esi + 4], 0
mov dword [esi + 8], eax
mov dword [esi], bind
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x10028dc3
jmp 0x10028dd3
mov dword [ebp - 0x10], 0
push 0x100b9060
push 0x28
push str.internal_error:_entered_unreachable_codes
call fcn.1004dc40
add esp, 0xc
jmp 0x10028e34
push 0x100b9028
push eax
push esi
call fcn.1004df00
add esp, 0xc
ud2
Function at 0x1002c760
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x1002edf0
mov esi, ecx
lea eax, [ebp - 0x18]
mov edi, edx
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x100da049]
push 4
push 0x1ec
call fcn.1000c280
add esp, 8
test eax, eax
je 0x1002c906
mov ebx, dword [edi]
mov dword [ebp - 0x3c], esi
mov esi, dword [edi + 8]
mov dword [eax + 0xb0], 0
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x28], eax
movzx ecx, word [ebx + 0x1ea]
mov edi, esi
not edi
add edi, ecx
mov dword [ebp - 0x20], ecx
lea ecx, [esi + esi*8]
lea ecx, [ecx + ecx*2]
mov word [eax + 0x1ea], di
add ecx, esi
mov edx, dword [ebx + ecx + 0xcc]
mov dword [ebp - 0x40], edx
movsd xmm0, qword [ebx + ecx + 0xc4]
movsd qword [ebp - 0x48], xmm0
movsd xmm0, qword [ebx + ecx + 0xb4]
movsd xmm1, qword [ebx + ecx + 0xbc]
mov ecx, esi
shl ecx, 4
cmp edi, 0xb
movsd qword [ebp - 0x50], xmm1
movsd qword [ebp - 0x58], xmm0
mov eax, dword [ebx + ecx]
mov edx, dword [ebx + ecx + 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], edx
ja 0x1002c912
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], esi
inc esi
sub eax, esi
cmp eax, edi
jne 0x1002c92b
mov edx, dword [ebx + ecx + 0xc]
mov ecx, dword [ebx + ecx + 8]
lea eax, [ebx + 0xb4]
add eax, esi
mov dword [ebp - 0x30], edx
lea edx, [esi + esi*8]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x28]
lea edx, [edx + edx*2]
add eax, edx
lea edx, [edi + edi*8]
lea edx, [edx + edx*2]
add edx, edi
add ecx, 0xb4
push edx
push eax
push ecx
call fcn.1003eb30
add esp, 0xc
shl esi, 4
shl edi, 4
add esi, ebx
push edi
push esi
mov esi, dword [ebp - 0x28]
push esi
call fcn.1003eb30
add esp, 0xc
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x24]
mov edx, dword [ebp - 0x2c]
mov word [ebx + 0x1ea], ax
mov eax, dword [ebp - 0x40]
movsd xmm0, qword [ebp - 0x58]
movsd xmm1, qword [ebp - 0x50]
mov dword [ecx + 0x18], eax
mov eax, dword [ebp - 0x38]
movsd qword [ecx], xmm0
movsd xmm0, qword [ebp - 0x48]
movsd qword [ecx + 8], xmm1
mov eax, dword [eax + 4]
movsd qword [ecx + 0x10], xmm0
mov dword [ecx + 0x2c], ebx
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x1c], edi
mov dword [ecx + 0x20], edx
mov edi, dword [ebp - 0x30]
mov edx, dword [ebp - 0x20]
mov dword [ecx + 0x28], edi
mov dword [ecx + 0x24], edx
mov dword [ecx + 0x34], esi
mov dword [ecx + 0x38], 0
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1ec
push 4
call fcn.1004da50
mov dword [ebp - 0x10], 0
push 0x100b994c
push 0xb
push edi
call fcn.1004df00
add esp, 0xc
jmp 0x1002c946
mov dword [ebp - 0x10], 0
push 0x100b993c
push 0x28
push str.assertion_failed:_src.len____dst.len___v
call fcn.1004dc40
add esp, 0xc
ud2
Function at 0x1002ebb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x7c
mov edi, dword [esp + 0x94]
mov esi, dword [esp + 0x90]
mov eax, dword [esp + 0x98]
mov edx, dword [edi + 4]
mov ecx, dword [edi]
mov edi, dword [edi + 8]
test edx, edx
je 0x1002ec9f
nop dword [eax]
mov ecx, dword [ecx + edi*4 + 0x1ec]
dec edx
je 0x1002ebfb
movzx edi, word [ecx + 0x1ea]
mov ecx, dword [ecx + edi*4 + 0x1ec]
dec edx
jne 0x1002ebea
movzx edx, word [ecx + 0x1ea]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], 0
mov ecx, esp
dec edx
mov dword [esp + 0x4c], edx
lea edx, [esp + 0x44]
push eax
call fcn.1002e3c0
add esp, 4
movsd xmm2, qword [esp + 0x18]
movsd xmm1, qword [esp + 0x10]
mov eax, dword [esp + 0x28]
movsd xmm0, qword [esp + 0x20]
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
movsd qword [esp + 0x68], xmm2
movsd qword [esp + 0x60], xmm1
movsd xmm2, qword [esp]
movsd xmm1, qword [esp + 8]
mov dword [esp + 0x78], eax
movsd qword [esp + 0x70], xmm0
movsd qword [esp + 0x58], xmm1
movsd qword [esp + 0x50], xmm2
movzx eax, word [edi + 0x1ea]
cmp ecx, eax
jae 0x1002ec80
mov eax, edi
jmp 0x1002ecc9
mov eax, dword [edi + 0xb0]
test eax, eax
je 0x1002ecc3
movzx ecx, word [edi + 0x1e8]
inc edx
mov edi, eax
cmp cx, word [eax + 0x1ea]
jae 0x1002ec80
jmp 0x1002ecc9
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], edi
lea edx, [esp + 0x38]
mov ecx, esi
push eax
call fcn.1002e3c0
add esp, 4
jmp 0x1002ede5
mov ecx, edx
xor eax, eax
mov edx, edi
lea edi, [ecx + ecx*8]
lea ebx, [edi + edi*2]
mov edi, ecx
add ebx, ecx
shl edi, 4
test edx, edx
mov ebp, dword [eax + ebx + 0xcc]
mov dword [esp + 0x18], ebp
mov ebp, dword [esp + 0x68]
movsd xmm0, qword [eax + ebx + 0xc4]
movsd qword [esp + 0x10], xmm0
movsd xmm0, qword [eax + ebx + 0xb4]
movsd xmm1, qword [eax + ebx + 0xbc]
movsd qword [esp + 8], xmm1
movsd qword [esp], xmm0
mov dword [eax + ebx + 0xcc], ebp
movsd xmm0, qword [esp + 0x60]
movsd qword [eax + ebx + 0xc4], xmm0
movsd xmm0, qword [esp + 0x50]
movsd xmm1, qword [esp + 0x58]
movsd qword [eax + ebx + 0xbc], xmm1
movsd qword [eax + ebx + 0xb4], xmm0
movsd xmm0, qword [eax + edi]
movsd xmm1, qword [eax + edi + 8]
movsd xmm2, qword [esp + 0x74]
movsd qword [esp + 0x1c], xmm0
movsd xmm0, qword [esp + 0x6c]
movsd qword [esp + 0x24], xmm1
movsd qword [eax + edi + 8], xmm2
movsd qword [eax + edi], xmm0
je 0x1002ed9b
mov eax, dword [eax + ecx*4 + 0x1f0]
xor ecx, ecx
dec edx
je 0x1002ed9c
nop word cs:[eax + eax]
nop dword [eax]
mov eax, dword [eax + 0x1ec]
dec edx
jne 0x1002ed90
jmp 0x1002ed9c
inc ecx
movsd xmm2, qword [esp + 0x18]
movsd xmm1, qword [esp + 0x10]
mov edx, dword [esp + 0x28]
movsd xmm0, qword [esp + 0x20]
movsd qword [esi + 0x18], xmm2
movsd qword [esi + 0x10], xmm1
movsd xmm2, qword [esp]
movsd xmm1, qword [esp + 8]
mov dword [esi + 0x28], edx
movsd qword [esi + 0x20], xmm0
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm2
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], ecx
mov eax, esi
add esp, 0x7c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1003ab70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1003abc8
mov esi, dword [esp + 0x18]
lea edi, [edx + eax*2]
xor ebx, ebx
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea ebp, [ebx + eax]
jne 0x1003abc0
cmp ebx, ebp
ja 0x1003ac35
cmp ebp, dword [esp + 0x1c]
ja 0x1003ac41
add ebx, esi
nop word [eax + eax]
test eax, eax
je 0x1003abc2
dec eax
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x1003abb0
jmp 0x1003ac1e
ja 0x1003abc8
cmp edx, edi
mov ebx, ebp
jne 0x1003ab85
mov eax, dword [esp + 0x24]
test eax, eax
je 0x1003ac22
mov esi, dword [esp + 0x20]
cmp eax, 1
movzx ecx, cx
mov ebx, esi
lea edi, [esi + eax]
mov al, 1
sbb ebx, 0xffffffff
nop word cs:[eax + eax]
nop
movzx edx, byte [esi]
test dl, dl
jns 0x1003ac07
cmp ebx, edi
je 0x1003ac2b
movzx esi, byte [ebx]
and edx, 0x7f
inc ebx
shl edx, 8
or edx, esi
mov esi, ebx
sub ecx, edx
js 0x1003ac24
xor al, 1
xor ebx, ebx
cmp esi, edi
setne bl
add ebx, esi
cmp esi, edi
jne 0x1003abf0
jmp 0x1003ac24
xor eax, eax
jmp 0x1003ac24
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x100bbb08
call fcn.1004db30
push 0x100bbb18
push ebp
push ebx
call fcn.1004df20
push 0x100bbb18
push dword [esp + 0x20]
push ebp
call fcn.1004df00
Function at 0x10042dd2
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10042e11
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10042e11
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10042e11
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10042e11
cmp dword [ecx + 0x74], 0xe
jbe 0x10042e11
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10043e7f
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100bd710
push 0x100bd708
push str.FlsAlloc
push 0x1f
call fcn.10043d9b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10043eb3
push dword [ebp + 8]
mov ecx, esi
call dword [0x1004f22c]
call esi
jmp 0x10043eb9
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10043efd
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100bd720
push 0x100bd718
push str.FlsGetValue
push 0x21
call fcn.10043d9b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10043f34
push dword [ebp + 8]
mov ecx, esi
call dword [0x1004f22c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10043f3c
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100bd728
push 0x100bd720
push str.FlsSetValue
push 0x22
call fcn.10043d9b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10043f76
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1004f22c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1004672e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100467cb
push ebx
push esi
call fcn.100466f7
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1004668b
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10046778
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100467ca
push edi
push eax
call fcn.100447ef
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10046798
call fcn.10043c48
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100467c9
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1004668b
add esp, 0x20
test eax, eax
jne 0x100467b7
push edi
call fcn.10043c48
jmp 0x100467bf
push ebx
call fcn.10043c48
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x10047d41
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x100da790]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10047d81
cmp byte [ebx], 0xa
jne 0x10047d81
or byte [edi + eax + 0x28], 4
jmp 0x10047d86
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x10047e85
mov dl, byte [eax]
cmp dl, 0x1a
je 0x10047e68
inc eax
cmp dl, 0xd
je 0x10047db2
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x10047dd8
cmp eax, ecx
jae 0x10047de6
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x10047d9a
jmp 0x10047e85
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10047e63
cmp dword [ebp - 0x10], 0
je 0x10047e63
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x100da790]
test byte [eax + edi + 0x28], 0x48
je 0x10047e3d
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x10047e28
mov byte [esi], dl
jmp 0x10047e39
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x100da790]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10047e85
cmp byte [ebp - 1], 0xa
jne 0x10047e4c
cmp esi, ebx
jne 0x10047e4c
mov byte [esi], 0xa
jmp 0x10047e84
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10049c88
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10047e85
mov byte [esi], 0xd
jmp 0x10047e84
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x100da790]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10047e82
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10047e85
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10047e8e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x100da790]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10047ed4
cmp word [ebx], dx
jne 0x10047ed4
or byte [eax + edi + 0x28], 4
jmp 0x10047ed9
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x1004803c
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x1004801c
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x10047f1a
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x10047f50
cmp eax, edx
jae 0x10047f5e
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x10047ef5
jmp 0x1004803c
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10048017
cmp dword [ebp - 0x18], 0
je 0x10048017
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x100da790]
test byte [eax + edi + 0x28], 0x48
je 0x10047fed
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x10047fb1
mov word [esi], cx
jmp 0x10047fe8
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x100da790]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x100da790]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x100da790]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x1004803c
pop eax
cmp word [ebp - 4], ax
jne 0x10047ffd
cmp esi, ebx
jne 0x10047ffd
mov word [esi], ax
jmp 0x10048039
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.10049c88
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x1004803c
push 0xd
pop eax
jmp 0x10047ff8
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x100da790]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x10048036
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x1004803c
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1004bdf0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1004be1d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1004be1d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1004dd50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
sub esp, 0x68
movzx eax, byte [esp + 0x78]
mov esi, dword [esp + 0x84]
mov ebx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x88]
mov edi, dword [esp + 0x80]
test eax, eax
mov dword [esp + 8], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edx
je 0x1004dda1
cmp eax, 1
jne 0x1004de1e
mov dword [esp], 0x100bb284
jmp 0x1004dda8
mov dword [esp], 0x100bb282
mov edx, 2
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
jne 0x1004de3a
mov ecx, esp
lea edx, [esp + 8]
lea esi, [esp + 0x10]
mov dword [esp + 0x38], 0x100bb2c0
mov dword [esp + 0x3c], 3
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 0x10037590
mov dword [esp + 0x20], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x24], 0x10037570
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0x10037570
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 3
lea ecx, [esp + 0x38]
push eax
push ecx
call fcn.1004db60
mov edx, 7
mov dword [esp], 0x100bb286
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
je 0x1004ddbd
movsd xmm0, qword [ecx + 0x10]
movsd xmm2, qword [ecx]
movsd xmm1, qword [ecx + 8]
mov edx, esp
lea esi, [esp + 0x50]
mov dword [esp + 0x38], 0x100bb2f4
mov dword [esp + 0x3c], 4
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], edx
lea edx, [esp + 8]
mov dword [esp + 0x1c], 0x10037590
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 0x100365a0
lea esi, [esp + 0x10]
mov dword [esp + 0x28], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x2c], 0x10037570
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 0x10037570
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 4
movsd qword [esp + 0x60], xmm0
movsd qword [esp + 0x58], xmm1
movsd qword [esp + 0x50], xmm2
lea ecx, [esp + 0x38]
push eax
push ecx
call fcn.1004db60
int3