joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4168f0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10c
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x1e2]
xor ebp, ebp
cmp eax, ebp
je 0x416915
push eax
call fcn.004254fc
add esp, 4
mov dword [esi + 0x1e2], ebp
mov eax, dword [esp + 0x11c]
push eax
lea ecx, [esp + 0x14]
push str.._npcmodes_recordings__s.rec
push ecx
call fcn.004253a4
lea edx, [esp + 0x1c]
push 0x435204
push edx
call fcn.004256de
add esp, 0x14
cmp eax, ebp
mov dword [esi + 0x1e2], eax
jne 0x41694f
push 1
call fcn.00426275
push edi
push 2
push ebp
push eax
call fcn.00425923
mov eax, dword [esi + 0x1e2]
push eax
call fcn.00425853
mov ecx, dword [esi + 0x1e2]
push ecx
mov edi, eax
call fcn.00426370
add esp, 0x14
cmp edi, ebp
jne 0x416981
push 1
call fcn.00426275
mov edx, dword [esi + 0x1e2]
push edx
push 4
lea eax, [esp + 0x14]
push 1
push eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
call fcn.00425636
mov ecx, dword [esi + 0x1e2]
push ecx
push 4
lea edx, [esp + 0x28]
push 1
push edx
call fcn.00425636
mov eax, dword [esp + 0x2c]
add esp, 0x20
cmp eax, 0x3e8
je 0x4169ea
mov eax, dword [esi + 0x1e2]
push eax
call fcn.004254fc
mov ecx, dword [esp + 0x120]
push ecx
lea edx, [esp + 0x1c]
push edi
push edx
call fcn.0041dc30
add esp, 0x10
push 1
call fcn.00426275
push ebx
mov ebx, dword [esp + 0x120]
cmp ebx, 1
jne 0x416a0b
mov eax, dword [esi + 0x1e2]
add edi, 0xfffffff8
push edi
push eax
mov ecx, esi
call fcn.00416740
jmp 0x416a22
cmp ebx, 2
jne 0x416a66
mov ecx, dword [esi + 0x1e2]
add edi, 0xfffffff8
push edi
push ecx
mov ecx, esi
call fcn.00416810
mov edx, dword [esi + 0x1e2]
push edx
call fcn.004254fc
add esp, 4
mov dword [esi + 0x1e2], ebp
mov dword [esi + 0x1da], ebx
mov dword [esi + 0x1de], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop ebx
pop edi
mov dword [esi + 0x1e6], ebp
mov dword [esi + 0x1ea], eax
pop esi
pop ebp
add esp, 0x10c
ret 8
push 1
call fcn.00426275
int3
Function at 0x4168f7
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10c
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x1e2]
xor ebp, ebp
cmp eax, ebp
je 0x416915
push eax
call fcn.004254fc
add esp, 4
mov dword [esi + 0x1e2], ebp
mov eax, dword [esp + 0x11c]
push eax
lea ecx, [esp + 0x14]
push str.._npcmodes_recordings__s.rec
push ecx
call fcn.004253a4
lea edx, [esp + 0x1c]
push 0x435204
push edx
call fcn.004256de
add esp, 0x14
cmp eax, ebp
mov dword [esi + 0x1e2], eax
jne 0x41694f
push 1
call fcn.00426275
push edi
push 2
push ebp
push eax
call fcn.00425923
mov eax, dword [esi + 0x1e2]
push eax
call fcn.00425853
mov ecx, dword [esi + 0x1e2]
push ecx
mov edi, eax
call fcn.00426370
add esp, 0x14
cmp edi, ebp
jne 0x416981
push 1
call fcn.00426275
mov edx, dword [esi + 0x1e2]
push edx
push 4
lea eax, [esp + 0x14]
push 1
push eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
call fcn.00425636
mov ecx, dword [esi + 0x1e2]
push ecx
push 4
lea edx, [esp + 0x28]
push 1
push edx
call fcn.00425636
mov eax, dword [esp + 0x2c]
add esp, 0x20
cmp eax, 0x3e8
je 0x4169ea
mov eax, dword [esi + 0x1e2]
push eax
call fcn.004254fc
mov ecx, dword [esp + 0x120]
push ecx
lea edx, [esp + 0x1c]
push edi
push edx
call fcn.0041dc30
add esp, 0x10
push 1
call fcn.00426275
push ebx
mov ebx, dword [esp + 0x120]
cmp ebx, 1
jne 0x416a0b
mov eax, dword [esi + 0x1e2]
add edi, 0xfffffff8
push edi
push eax
mov ecx, esi
call fcn.00416740
jmp 0x416a22
cmp ebx, 2
jne 0x416a66
mov ecx, dword [esi + 0x1e2]
add edi, 0xfffffff8
push edi
push ecx
mov ecx, esi
call fcn.00416810
mov edx, dword [esi + 0x1e2]
push edx
call fcn.004254fc
add esp, 4
mov dword [esi + 0x1e2], ebp
mov dword [esi + 0x1da], ebx
mov dword [esi + 0x1de], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop ebx
pop edi
mov dword [esi + 0x1e6], ebp
mov dword [esi + 0x1ea], eax
pop esi
pop ebp
add esp, 0x10c
ret 8
push 1
call fcn.00426275
int3

Function at 0x416eb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x434a6b
push eax
mov dword fs:[0], esp
sub esp, 0x118
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, ecx
call edi
sub eax, dword [esi + 0x1f2]
cmp eax, 0x1f4
jbe 0x416f58
cmp word [0x441ca8], 0xffff
jne 0x416f58
lea ecx, [esp + 0xc]
call fcn.00401060
push 1
push 8
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x134], 0
mov byte [esp + 0x14], 0xcf
call fcn.004016f0
push 0x44
push 0x4530a0
lea ecx, [esp + 0x14]
call fcn.004017a0
mov ecx, dword [esi]
mov edx, dword [ecx]
push 0
push 7
push 1
lea eax, [esp + 0x18]
push eax
call dword [edx + 0x18]
call edi
lea ecx, [esp + 0xc]
mov dword [esi + 0x1f2], eax
mov dword [esp + 0x128], 0xffffffff
call fcn.00401170
mov ecx, dword [esp + 0x120]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x124
ret
Function at 0x417650
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x434a6b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x134
mov eax, dword [esp + 0x144]
mov edx, dword [eax + 0x10]
push esi
mov esi, ecx
mov ecx, dword [eax + 8]
push 0
push ecx
push edx
lea ecx, [esp + 0x30]
call fcn.004010f0
cmp dword [esi + 0xc], 2
mov dword [esp + 0x140], 0
mov byte [esp + 7], 0
mov dword [esp + 8], 0
pop esi
lea ecx, [esp + 0x20]
jne 0x417726
push 1
push 8
lea eax, [esp + 0xb]
push eax
call fcn.00401230
push 1
push 0x10
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x2c]
call fcn.00401230
push 0x18
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0x28]
call fcn.004015b0
mov eax, dword [esp + 4]
cmp ax, 0x3e8
jae 0x417722
movzx eax, ax
lea ecx, [eax + eax*2]
lea edx, [ecx*8 + 0x44c338]
mov ecx, dword [esp + 8]
mov dword [edx], ecx
mov ecx, dword [esp + 0xc]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [edx + 8], ecx
mov ecx, dword [esp + 0x14]
mov dword [edx + 0xc], ecx
mov ecx, dword [esp + 0x18]
mov dword [edx + 0x10], ecx
mov ecx, dword [esp + 0x1c]
mov dword [edx + 0x14], ecx
mov byte [eax + 0x463a88], 3
lea ecx, [esp + 0x20]
mov dword [esp + 0x13c], 0xffffffff
call fcn.00401170
mov ecx, dword [esp + 0x134]
mov dword fs:[0], ecx
add esp, 0x140
ret 4
Function at 0x417810
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x434a56
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x248
mov eax, dword [esp + 0x258]
push ebx
push esi
mov esi, ecx
push edi
mov dword [esi + 0xc], 3
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0x10]
push 1
push ecx
push edx
lea ecx, [esp + 0x14c]
call fcn.004010f0
xor ebx, ebx
push 1
push 8
lea eax, [esp + 0x1b]
push eax
lea ecx, [esp + 0x14c]
mov dword [esp + 0x268], ebx
mov byte [esp + 0x1f], bl
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x20], ebx
call fcn.00401230
push 1
push 0x20
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x14c]
call fcn.00401230
push 1
push 0x10
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x14c]
call fcn.00401230
push 1
push 0x10
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x14c]
call fcn.00401230
push 1
push 0x20
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x14c]
call fcn.00401230
mov edx, dword [esp + 0x14]
mov eax, dword [esi + 4]
xor edx, 0xfd9
add eax, 0xfa2
mov dword [esp + 0x14], edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4178f3
sub eax, edi
lea ecx, [esp + 0x2c]
mov dword [esp + 0x1c], eax
call fcn.00401060
push 1
push 0x20
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x38]
mov byte [esp + 0x268], 1
mov dword [esp + 0x24], 0xfd9
call fcn.004016f0
push 1
push 8
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x18], 1
call fcn.004016f0
mov cl, byte [esp + 0x1c]
push 1
push 8
lea edx, [esp + 0x14]
mov byte [esp + 0x14], cl
push edx
lea ecx, [esp + 0x38]
call fcn.004016f0
movzx eax, byte [esp + 0x1c]
mov ecx, dword [esi + 4]
add ecx, 0xfa2
push eax
push ecx
lea ecx, [esp + 0x34]
call fcn.004017a0
mov edx, dword [esp + 0x14]
push 1
push 0x20
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x38]
mov dword [esp + 0x24], edx
call fcn.004016f0
mov esi, dword [esi]
mov edx, dword [esi]
push ebx
push ebx
push 8
push 1
lea eax, [esp + 0x3c]
push eax
push 0x435a3c
mov ecx, esi
call dword [edx + 0x64]
lea ecx, [esp + 0x2c]
mov byte [esp + 0x25c], bl
call fcn.00401170
lea ecx, [esp + 0x140]
mov dword [esp + 0x25c], 0xffffffff
call fcn.00401170
mov ecx, dword [esp + 0x254]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x254
ret 4
Function at 0x41a370
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
xor eax, eax
mov dword [esp + 0x10], 8
mov edi, dword [edx]
mov ebx, edi
mov ebp, edi
shr ebx, 5
shl ebp, 4
xor ebx, ebp
add ebx, edi
mov ebp, dword [esi]
mov edi, eax
and edi, 3
movzx edi, byte [edi + ecx + 0x24a]
add edi, eax
xor ebx, edi
add ebp, ebx
mov dword [esi], ebp
add eax, dword [ecx + 0x25e]
mov edi, ebp
mov ebx, ebp
shr ebx, 5
shl ebp, 4
xor ebx, ebp
add ebx, edi
mov edi, eax
shr edi, 0xb
and edi, 3
movzx edi, byte [edi + ecx + 0x24a]
add edi, eax
xor ebx, edi
mov edi, dword [edx]
add edi, ebx
mov ebx, edi
mov ebp, edi
mov dword [edx], edi
shr ebx, 5
shl ebp, 4
xor ebx, ebp
add ebx, edi
mov ebp, dword [esi]
mov edi, eax
and edi, 3
movzx edi, byte [edi + ecx + 0x24a]
add edi, eax
xor ebx, edi
add ebp, ebx
mov dword [esi], ebp
add eax, dword [ecx + 0x25e]
mov edi, ebp
mov ebx, ebp
shr ebx, 5
shl ebp, 4
xor ebx, ebp
add ebx, edi
mov edi, eax
shr edi, 0xb
and edi, 3
movzx edi, byte [edi + ecx + 0x24a]
add edi, eax
xor ebx, edi
mov edi, dword [edx]
add edi, ebx
mov ebx, edi
mov ebp, edi
shr ebx, 5
mov dword [edx], edi
shl ebp, 4
xor ebx, ebp
mov ebp, dword [esi]
add ebx, edi
mov edi, eax
and edi, 3
movzx edi, byte [edi + ecx + 0x24a]
add edi, eax
xor ebx, edi
add ebp, ebx
mov dword [esi], ebp
add eax, dword [ecx + 0x25e]
mov edi, ebp
mov ebx, ebp
shr ebx, 5
shl ebp, 4
xor ebx, ebp
add ebx, edi
mov edi, eax
shr edi, 0xb
and edi, 3
movzx edi, byte [edi + ecx + 0x24a]
add edi, eax
xor ebx, edi
mov edi, dword [edx]
add edi, ebx
mov ebx, edi
mov ebp, edi
mov dword [edx], edi
shr ebx, 5
shl ebp, 4
xor ebx, ebp
mov ebp, dword [esi]
add ebx, edi
mov edi, eax
and edi, 3
movzx edi, byte [edi + ecx + 0x24a]
add edi, eax
xor ebx, edi
add ebp, ebx
mov dword [esi], ebp
add eax, dword [ecx + 0x25e]
mov edi, ebp
mov ebx, ebp
shr ebx, 5
shl ebp, 4
xor ebx, ebp
mov ebp, dword [edx]
add ebx, edi
mov edi, eax
shr edi, 0xb
and edi, 3
movzx edi, byte [edi + ecx + 0x24a]
add edi, eax
xor ebx, edi
mov edi, dword [esp + 0x10]
add ebp, ebx
dec edi
mov dword [edx], ebp
mov dword [esp + 0x10], edi
jne 0x41a387
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x41a4f0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [ecx + 0x25a]
mov edx, dword [esp + 0xc]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov dword [esp + 0x10], 8
jmp 0x41a510
mov edi, dword [esi]
mov ebx, edi
mov ebp, edi
shr ebx, 5
shl ebp, 4
xor ebx, ebp
add ebx, edi
mov ebp, dword [edx]
mov edi, eax
shr edi, 0xb
and edi, 3
movzx edi, byte [edi + ecx + 0x24a]
add edi, eax
xor ebx, edi
sub ebp, ebx
mov dword [edx], ebp
sub eax, dword [ecx + 0x25e]
mov edi, ebp
mov ebx, ebp
shr ebx, 5
shl ebp, 4
xor ebx, ebp
add ebx, edi
mov edi, eax
and edi, 3
movzx edi, byte [edi + ecx + 0x24a]
add edi, eax
xor ebx, edi
mov edi, dword [esi]
sub edi, ebx
mov ebx, edi
mov ebp, edi
mov dword [esi], edi
shr ebx, 5
shl ebp, 4
xor ebx, ebp
add ebx, edi
mov ebp, dword [edx]
mov edi, eax
shr edi, 0xb
and edi, 3
movzx edi, byte [edi + ecx + 0x24a]
add edi, eax
xor ebx, edi
sub ebp, ebx
mov dword [edx], ebp
sub eax, dword [ecx + 0x25e]
mov edi, ebp
mov ebx, ebp
shr ebx, 5
shl ebp, 4
xor ebx, ebp
add ebx, edi
mov edi, eax
and edi, 3
movzx edi, byte [edi + ecx + 0x24a]
add edi, eax
xor ebx, edi
mov edi, dword [esi]
sub edi, ebx
mov ebx, edi
mov ebp, edi
mov dword [esi], edi
shr ebx, 5
shl ebp, 4
xor ebx, ebp
mov ebp, dword [edx]
add ebx, edi
mov edi, eax
shr edi, 0xb
and edi, 3
movzx edi, byte [edi + ecx + 0x24a]
add edi, eax
xor ebx, edi
sub ebp, ebx
mov dword [edx], ebp
sub eax, dword [ecx + 0x25e]
mov edi, ebp
mov ebx, ebp
shr ebx, 5
shl ebp, 4
xor ebx, ebp
add ebx, edi
mov edi, eax
and edi, 3
movzx edi, byte [edi + ecx + 0x24a]
add edi, eax
xor ebx, edi
mov edi, dword [esi]
sub edi, ebx
mov ebx, edi
mov ebp, edi
mov dword [esi], edi
shr ebx, 5
shl ebp, 4
xor ebx, ebp
mov ebp, dword [edx]
add ebx, edi
mov edi, eax
shr edi, 0xb
and edi, 3
movzx edi, byte [edi + ecx + 0x24a]
add edi, eax
xor ebx, edi
sub ebp, ebx
mov dword [edx], ebp
sub eax, dword [ecx + 0x25e]
mov edi, ebp
mov ebx, ebp
shr ebx, 5
shl ebp, 4
xor ebx, ebp
mov ebp, dword [esi]
add ebx, edi
mov edi, eax
and edi, 3
movzx edi, byte [edi + ecx + 0x24a]
add edi, eax
xor ebx, edi
mov edi, dword [esp + 0x10]
sub ebp, ebx
dec edi
mov dword [esi], ebp
mov dword [esp + 0x10], edi
jne 0x41a510
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x41dcc0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor al, al
xor ecx, ecx
test esi, esi
je 0x41dce0
push edi
mov edi, dword [esp + 0xc]
mov dl, byte [ecx + edi]
and dl, 0xaa
xor al, dl
inc ecx
cmp ecx, esi
jne 0x41dcd2
pop edi
pop esi
ret

Function at 0x4215b0
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push esi
push edi
mov esi, eax
push esi
call sub.WSOCK32.dll_inet_addr
mov edi, eax
cmp edi, 0xffffffff
jne 0x4215ef
push esi
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x4215ef
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
xor ecx, ecx
test eax, eax
je 0x4215e3
mov eax, edx
mov esi, dword [eax + 4]
add eax, 4
inc ecx
test esi, esi
jne 0x4215d8
cmp ebx, ecx
jge 0x4215ef
mov eax, dword [edx + ebx*4]
mov eax, dword [eax]
pop edi
pop esi
ret
mov eax, edi
pop edi
pop esi
ret

Function at 0x421600
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [0x476654]
sub esp, 0x10
test eax, eax
push ebp
mov ebp, dword [esp + 0x20]
jl 0x42166f
push edi
mov eax, 0x10
mov eax, dword [esp + 0x1c]
push eax
xor ecx, ecx
lea edi, [esp + 0xc]
mov word [esp + 0xc], 2
call sub.WSOCK32.dll_htons
test esi, esi
mov word [esp + 0xa], ax
pop edi
jne 0x421641
push 0xffffffffffffffff
call sub.WSOCK32.dll_htonl
jmp 0x42164c
push ebx
xor ebx, ebx
mov eax, esi
call fcn.004215b0
pop ebx
mov edx, dword [esp + 0x1c]
push 0x10
lea ecx, [esp + 8]
push ecx
push 0
push ebp
mov dword [esp + 0x18], eax
mov eax, dword [0x476654]
push edx
push eax
call sub.WSOCK32.dll_sendto
cmp eax, 0xffffffff
jne 0x421677
or eax, 0xffffffff
pop ebp
add esp, 0x10
ret
mov eax, ebp
pop ebp
add esp, 0x10
ret

Function at 0x4240e0
Capabilities:
Print debug messages

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x804
lea eax, [esp + 0x80c]
push eax
push ecx
lea edx, [esp + 8]
push edx
call fcn.00427667
add esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x804
ret

Function at 0x426056
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x426073
call fcn.0042a4dc
mov dword [eax], 0x16
xor eax, eax
jmp 0x4260dd
push esi
push 0x8c
push 1
call fcn.004262b5
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4260c8
push esi
call fcn.00429700
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x4260a6
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x425fc1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x4260dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.0042458d
test ebx, ebx
pop ecx
je 0x4260da
push ebx
call fcn.0042a4ee
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4261b2
Capabilities:
Terminate process

Disassembly:
push 8
push 0x436988
call fcn.004285dc
push 8
call fcn.00427a1a
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x476d08], esi
jne 0x4261e6
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x476d04], esi
mov al, byte [ebp + 0x10]
mov byte [0x476d00], al
cmp dword [ebp + 0xc], edi
jne 0x426230
cmp dword [0x47856c], edi
je 0x426220
mov eax, dword [0x478568]
sub eax, 4
mov dword [0x478568], eax
cmp eax, dword [0x47856c]
jb 0x426220
mov eax, dword [eax]
cmp eax, edi
je 0x426201
call eax
jmp 0x426201
push 0x43e044
mov eax, 0x43e034
call fcn.00426130
pop ecx
push 0x43e050
mov eax, 0x43e048
call fcn.00426130
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x426261
cmp dword [ebp + 0x10], edi
jne 0x42626f
mov dword [0x476d08], esi
push dword [ebp + 8]
call fcn.004260ee
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x42626e
push 8
call fcn.00427965
pop ecx
ret
call fcn.00428617
ret
Function at 0x42a8d1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x42aaa5
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x477420]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x42aaa5
test cl, 0x48
je 0x42a93c
cmp byte [eax + 5], 0xa
je 0x42a93c
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42a98e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x42a976
call fcn.0042a4dc
mov dword [eax], 9
call fcn.0042a4e5
mov dword [eax], esi
jmp 0x42a986
cmp eax, 0x6d
je 0x42aaa5
push eax
call fcn.0042a4ee
pop ecx
or eax, 0xffffffff
jmp 0x42aaa7
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x42aaa0
test eax, eax
je 0x42a9b5
cmp byte [ebx], 0xa
jne 0x42a9b5
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x42a9be
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x42aa9a
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x42aa8a
cmp al, 0xd
je 0x42a9f0
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x42aa7c
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x42aa0a
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x42aa05
add dword [ebp + 0x10], 2
jmp 0x42aa5e
mov dword [ebp + 0x10], eax
jmp 0x42aa78
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42aa32
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42aa78
cmp dword [ebp - 0xc], 0
je 0x42aa78
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x42aa53
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x42aa5e
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x42aa7b
cmp ebx, dword [ebp + 0xc]
jne 0x42aa63
cmp byte [ebp - 1], 0xa
jne 0x42aa63
mov byte [ebx], 0xa
jmp 0x42aa7b
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0042b04f
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x42aa7c
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x42a9d4
jmp 0x42aa9a
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x42aa9a
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x42aaa7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42b16e
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x4427ac]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x42b19f
xor eax, eax
jmp 0x42b328
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x477420]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x42b1db
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.00430f0a
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x42b2b6
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x42b2f4
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x42b23f
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x42b230
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x42b210
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42b27f
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x42b288
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x42b201
jmp 0x42b28a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x42b323
cmp dword [ebp - 0x6c], edi
je 0x42b2f4
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x42b2e9
call fcn.0042a4dc
mov dword [eax], 9
call fcn.0042a4e5
mov dword [eax], esi
jmp 0x42b31e
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42b2de
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x42b28a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x42b28a
push dword [ebp - 0x6c]
call fcn.0042a4ee
pop ecx
jmp 0x42b31e
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x42b30c
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x42b30c
xor eax, eax
jmp 0x42b326
call fcn.0042a4dc
mov dword [eax], 0x1c
call fcn.0042a4e5
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x42b326
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.0042a699
add ebp, 0x3a0
leave
ret