joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f5c8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45a06c]
xor eax, ebp
mov dword [ebp - 8], eax
and dword [ebp - 0x10], 0
xor eax, eax
push esi
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x20]
push edi
mov edi, ecx
mov dword [ebp - 0xc], 7
mov ecx, dword [ebp + 8]
push eax
call fcn.0041ebf9
cmp dword [ebp - 0x10], 0
pop ecx
je 0x41f632
and dword [ebp - 0x24], 0
lea ecx, [ebp - 0x24]
cmp dword [ebp - 0xc], 8
lea eax, [ebp - 0x20]
push ecx
cmovae eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
je 0x41f632
push esi
push dword [ebp - 0x24]
mov ecx, edi
call fcn.0041f64c
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x20]
call fcn.00402499
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.00427412
mov esp, ebp
pop ebp
ret 4

Function at 0x41fa88
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45a06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0xc], 7
xor ecx, ecx
xor eax, eax
push edi
mov dword [ebp - 0x10], ecx
mov edi, edx
mov byte [ebp - 8], cl
lea ecx, [ebp - 0x20]
push str.HKEY_CURRENT_USER_
mov word [ebp - 0x20], ax
call fcn.004011b7
mov esi, eax
push str.SoftwareYandexYandexBrowser
mov ecx, esi
call fcn.0040239a
push 0x5c
mov ecx, esi
call fcn.00401263
mov esi, eax
push ebx
mov ecx, esi
call fcn.0040239a
push 0x45462c
mov ecx, esi
call fcn.004011b7
push edi
mov ecx, eax
call fcn.0040239a
lea eax, [ebp - 0x20]
xor esi, esi
push eax
push eax
push 0x29
push str.installer::StoreValueInRegistry
push esi
call fcn.00415994
add esp, 0x14
lea ecx, [ebp - 0x20]
call fcn.00402499
push 0x20006
push ecx
push ecx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], esi
call fcn.00421db4
test eax, eax
jne 0x41fb55
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x41fb30
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
push esi
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 0x24], esi
je 0x41fb63
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00427412
mov esp, ebp
pop ebp
ret
Function at 0x41fc57
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45a06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], 7
xor ebx, ebx
lea ecx, [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x10], ebx
push str.Remove_HKEY_CURRENT_USER_
mov word [ebp - 0x20], ax
mov byte [ebp - 8], bl
call fcn.004011b7
mov esi, eax
push str.SoftwareYandexYandexBrowser
mov ecx, esi
call fcn.0040239a
push 0x5c
mov ecx, esi
call fcn.00401263
push edi
mov ecx, eax
call fcn.0040239a
lea eax, [ebp - 0x20]
push eax
push eax
push 0x42
push str.installer::RemoveValueFromRegistry
push ebx
call fcn.00415994
add esp, 0x14
lea ecx, [ebp - 0x20]
call fcn.00402499
push 0x20006
push ecx
push ecx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], ebx
call fcn.00421db4
test eax, eax
jne 0x41fcea
push edi
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp - 0x24], ebx
je 0x41fcf8
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00427412
mov esp, ebp
pop ebp
ret
Function at 0x41fe7f
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x45a06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor ebx, ebx
mov dword [ebp - 0x244], edx
lea eax, [ebp - 0x210]
mov edi, ecx
push ebx
push eax
call fcn.00429740
add esp, 0xc
test edi, edi
jne 0x41fed6
push 0x104
lea eax, [ebp - 0x210]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x41fed6
xor al, al
jmp 0x42002e
test edi, edi
lea esi, [ebp - 0x210]
push ebx
cmovne esi, edi
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x41fecf
push ecx
push edi
lea ecx, [ebp - 0x240]
call fcn.0040dabe
push dword [ebp - 0x240]
push edi
push ebx
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x420006
lea eax, [ebp - 0x234]
mov dword [ebp - 0x230], ebx
push eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x234], ebx
push eax
push 0x454440
push dword [ebp - 0x240]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x420006
cmp dword [ebp - 0x234], 0x34
jb 0x420006
xor eax, eax
mov dword [ebp - 0x21c], ebx
push str.Module:
lea ecx, [ebp - 0x22c]
mov dword [ebp - 0x218], 7
mov word [ebp - 0x22c], ax
mov byte [ebp - 0x214], bl
call fcn.004011b7
mov edi, eax
push esi
mov ecx, edi
call fcn.0040239a
mov eax, dword [ebp - 0x230]
mov ecx, edi
push str._Version:
mov esi, dword [eax + 0x10]
call fcn.004011b7
push esi
mov ecx, eax
call fcn.004012b3
mov ecx, eax
mov eax, dword [ebp - 0x230]
push 0x2e
mov esi, dword [eax + 0x14]
call fcn.00401263
push esi
mov ecx, eax
call fcn.004012b3
lea eax, [ebp - 0x22c]
push eax
push eax
push 0x82
push str.installer::GetFileVersion
push ebx
call fcn.00415994
add esp, 0x14
lea ecx, [ebp - 0x22c]
call fcn.00402499
mov eax, dword [ebp - 0x230]
xor edx, edx
mov ecx, dword [eax + 0x10]
or edx, dword [eax + 0x14]
or ecx, ebx
mov eax, dword [ebp - 0x244]
mov bl, 1
mov dword [eax], edx
mov dword [eax + 4], ecx
cmp dword [ebp - 0x240], 0
je 0x42002c
mov ecx, dword [ebp - 0x238]
sub ecx, dword [ebp - 0x240]
push 1
push ecx
push dword [ebp - 0x240]
call fcn.0040110b
add esp, 0xc
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00427412
mov esp, ebp
pop ebp
ret
Function at 0x42046c
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x45a06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov edx, ecx
lea ecx, [ebp - 0x74]
push edi
call fcn.0042024b
mov esi, dword [ebp - 0x74]
xor ebx, ebx
test esi, esi
je 0x420564
cmp esi, 0xffffffff
je 0x420564
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], 0x44
push eax
lea eax, [ebp - 0x50]
push eax
push ebx
push 0x1a
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
jne 0x4204fc
push str.CreateWellKnownSid_failed
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], 7
mov word [ebp - 0x6c], ax
mov byte [ebp - 0x54], bl
call fcn.004011b7
lea eax, [ebp - 0x6c]
push eax
push eax
push 0x63
push str.InstallUACUtil::IsUserAnAdminGroup
push 1
call fcn.00415994
add esp, 0x14
lea ecx, [ebp - 0x6c]
call fcn.00402499
jmp 0x420564
lea eax, [ebp - 0x84]
mov dword [ebp - 0x84], ebx
push eax
mov ecx, esi
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
call fcn.004202d5
mov esi, dword [ebp - 0x84]
pop ecx
test al, al
je 0x42054f
mov edi, ebx
cmp dword [esi], ebx
jbe 0x42054f
lea eax, [esi + 4]
mov dword [ebp - 0x70], eax
push dword [eax]
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x42054d
mov eax, dword [ebp - 0x70]
inc edi
add eax, 8
mov dword [ebp - 0x70], eax
cmp edi, dword [esi]
jb 0x42052d
jmp 0x42054f
mov bl, 1
test esi, esi
je 0x420564
mov eax, dword [ebp - 0x7c]
push 1
sub eax, esi
push eax
push esi
call fcn.0040110b
add esp, 0xc
lea ecx, [ebp - 0x74]
call fcn.004042a8
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00427412
mov esp, ebp
pop ebp
ret
Function at 0x420c75
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x45a06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push ebx
push ebx
push ebx
push str.Yandex.Browser_lite_installer
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x2c], eax
mov edi, 0x4573d8
test eax, eax
je 0x420d0a
xor ecx, ecx
mov dword [ebp - 0xc], ebx
cmp dword [esi + 0x14], 8
mov dword [ebp - 8], 7
mov word [ebp - 0x1c], cx
jb 0x420cbf
mov esi, dword [esi]
lea ecx, [ebp - 0x1c]
push ecx
push 0x80000000
push 0xffffffffffffffff
push 0x451d94
push esi
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x28]
test eax, eax
je 0x420cfa
mov edi, 0x4573d8
mov dword [ebp - 0x28], edi
call fcn.0041fa70
lea ecx, [ebp - 0x1c]
call fcn.00402499
mov bl, 1
jmp 0x420d5b
mov dword [ebp - 0x28], edi
call fcn.0041fa70
lea ecx, [ebp - 0x1c]
call fcn.00402499
xor eax, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], 7
mov word [ebp - 0x20], ax
mov byte [ebp - 8], bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.Cannot_report_extended_stat:
lea ecx, [ebp - 0x20]
mov esi, eax
call fcn.004011b7
push esi
mov ecx, eax
call fcn.004012b3
lea eax, [ebp - 0x20]
push eax
push eax
push 0xd3
push str.installer::InstallStatSender::SendUrl
push 1
call fcn.00415994
add esp, 0x14
lea ecx, [ebp - 0x20]
call fcn.00402499
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], edi
call fcn.0041fa70
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00427412
mov esp, ebp
pop ebp
ret
Function at 0x421b71
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x45a06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x214], 7
push edi
mov word [ebp - 0x228], ax
xor ebx, ebx
mov word [ebp - 0x210], ax
mov esi, ecx
lea eax, [ebp - 0x210]
mov dword [ebp - 0x218], ebx
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x421cb0
push ecx
push ecx
lea eax, [ebp - 0x210]
mov edx, esp
mov ecx, eax
mov dword [edx], eax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x421bd6
sub ecx, edi
sar ecx, 1
mov dword [edx + 4], ecx
lea ecx, [ebp - 0x258]
call fcn.00417a30
push eax
lea ecx, [ebp - 0x228]
call fcn.00417cb0
lea ecx, [ebp - 0x258]
call fcn.00417ae0
push ecx
push ecx
mov eax, esp
lea ecx, [ebp - 0x228]
mov dword [eax], 0x454b08
mov dword [eax + 4], 9
lea eax, [ebp - 0x258]
push eax
call fcn.00418de0
push eax
lea ecx, [ebp - 0x228]
call fcn.00417cb0
lea ecx, [ebp - 0x258]
call fcn.00417ae0
lea ecx, [ebp - 0x228]
call fcn.00416ad0
test al, al
je 0x421cb0
push 0xf
pop edi
push 0xffffffffffffffff
lea edx, [ebp - 0x240]
mov dword [ebp - 0x230], ebx
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x22c], edi
mov byte [ebp - 0x240], bl
call fcn.0041bed0
pop ecx
mov ecx, esi
test al, al
jne 0x421ca2
push ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], edi
push 0x450659
mov byte [esi], bl
call fcn.0040256f
lea ecx, [ebp - 0x240]
call fcn.00402525
jmp 0x421cc9
lea eax, [ebp - 0x240]
push eax
call fcn.00402445
jmp 0x421c95
push ebx
mov dword [esi + 0x10], ebx
mov ecx, esi
mov dword [esi + 0x14], 0xf
push 0x450659
mov byte [esi], bl
call fcn.0040256f
lea ecx, [ebp - 0x228]
call fcn.00417ae0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00427412
mov esp, ebp
pop ebp
ret

Function at 0x421e16
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.004283b0
mov eax, dword [0x45a06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x100c]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push edx
lea edx, [ebp - 0x804]
mov dword [ebp - 0x100c], 0x800
push edx
lea edx, [ebp - 0x1008]
inc ebx
push edx
push 0
push eax
push dword [ecx]
mov dword [ebp - 0x1008], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x421ecc
cmp dword [ebp - 0x1008], ebx
jne 0x421e87
lea eax, [ebp - 0x804]
push eax
mov ecx, edi
call fcn.004067a8
jmp 0x421ecc
cmp dword [ebp - 0x1008], 2
jne 0x421ec7
mov ebx, 0x400
lea eax, [ebp - 0x1004]
push ebx
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x100c], eax
test eax, eax
je 0x421ec0
cmp eax, ebx
ja 0x421ec0
lea eax, [ebp - 0x1004]
jmp 0x421e7d
mov esi, 0xea
jmp 0x421ecc
mov esi, 0x3f4
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00427412
mov esp, ebp
pop ebp
ret 8
Function at 0x4225e9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push dword [ebp + 8]
xor eax, eax
mov edi, edx
push dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 0x10], eax
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x422658
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x422658
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x422658
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
test ebx, ebx
je 0x42265c
mov edi, dword [ebp - 4]
mov ecx, eax
push edi
call fcn.00422c22
push edi
push ebx
push dword [ebp - 0x10]
call fcn.004291c0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.00415f3a
lea ecx, [ebp - 0x10]
call fcn.0040ac5b
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x422e23
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x45a06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [ecx + 4]
push esi
xor ebx, ebx
push ebx
push ebx
push 0x8004
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x422ea2
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], 7
mov word [ebp - 0x20], ax
mov byte [ebp - 8], bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.Failed_to_initialize_hash_object__error:
lea ecx, [ebp - 0x20]
mov esi, eax
call fcn.004011b7
push esi
mov ecx, eax
call fcn.004012b3
lea eax, [ebp - 0x20]
push eax
push eax
push 0x35
push str.SignatureVerifier::HashData
push 1
call fcn.00415994
add esp, 0x14
lea ecx, [ebp - 0x20]
call fcn.00402499
xor al, al
jmp 0x422eec
push ebx
push dword [ebp + 0xc]
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x422eea
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], 7
mov word [ebp - 0x20], ax
mov byte [ebp - 8], bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.Failed_to_hash_data__error:
lea ecx, [ebp - 0x20]
mov esi, eax
call fcn.004011b7
push esi
mov ecx, eax
call fcn.004012b3
lea eax, [ebp - 0x20]
push eax
push eax
push 0x3a
jmp 0x422e87
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00427412
mov esp, ebp
pop ebp
ret 8
Function at 0x424c66
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov ecx, edx
mov dword [ebp - 8], edx
add edi, 0xdeadbeef
add edi, ecx
push 0xc
pop eax
mov edx, edi
mov esi, edi
mov dword [ebp - 4], edx
cmp ecx, eax
jbe switch.0x00424d64
lea eax, [ecx - 0xd]
xor edx, edx
push 0xc
pop ecx
div ecx
inc eax
mov dword [ebp - 0xc], eax
movzx edx, byte [ebx + 7]
movzx ecx, byte [ebx + 6]
movzx eax, byte [ebx + 5]
shl edx, 8
add edx, ecx
movzx ecx, byte [ebx + 0xb]
shl ecx, 8
shl edx, 8
add edx, eax
movzx eax, byte [ebx + 4]
add esi, eax
shl edx, 8
movzx eax, byte [ebx + 0xa]
add esi, edx
add ecx, eax
movzx edx, byte [ebx + 8]
movzx eax, byte [ebx + 9]
add edx, edi
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 2]
shl ecx, 8
add edx, ecx
movzx ecx, byte [ebx + 3]
shl ecx, 8
mov edi, edx
add ecx, eax
rol edi, 4
movzx eax, byte [ebx + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx]
shl ecx, 8
add ecx, eax
sub ecx, edx
add edx, esi
add ecx, dword [ebp - 4]
xor edi, ecx
sub esi, edi
mov eax, edi
add edi, edx
rol eax, 6
xor eax, esi
sub edx, eax
mov ecx, eax
rol ecx, 8
add eax, edi
xor ecx, edx
sub edi, ecx
mov edx, ecx
rol edx, 0x10
add ecx, eax
xor edx, edi
mov esi, edx
sub eax, edx
ror esi, 0xd
add edx, ecx
xor esi, eax
mov dword [ebp - 4], edx
sub ecx, esi
mov edi, esi
rol edi, 4
add esi, edx
xor edi, ecx
mov ecx, dword [ebp - 8]
push 0xc
pop eax
sub ecx, eax
add ebx, eax
sub dword [ebp - 0xc], 1
mov dword [ebp - 8], ecx
jne 0x424ca1
cmp ecx, eax
ja 0x424dd0
jmp dword [ecx*4 + 0x424e1e]
movzx eax, byte [ebx + 0xb]
shl eax, 0x18
add edi, eax
movzx eax, byte [ebx + 0xa]
shl eax, 0x10
add edi, eax
movzx eax, byte [ebx + 9]
shl eax, 8
add edi, eax
movzx eax, byte [ebx + 8]
add edi, eax
movzx eax, byte [ebx + 7]
shl eax, 0x18
add esi, eax
movzx eax, byte [ebx + 6]
shl eax, 0x10
add esi, eax
movzx eax, byte [ebx + 5]
shl eax, 8
add esi, eax
movzx eax, byte [ebx + 4]
add esi, eax
movzx eax, byte [ebx + 3]
shl eax, 0x18
add edx, eax
movzx eax, byte [ebx + 2]
shl eax, 0x10
add edx, eax
movzx eax, byte [ebx + 1]
shl eax, 8
add edx, eax
movzx eax, byte [ebx]
add edx, eax
mov dword [ebp - 4], edx
xor edi, esi
mov eax, esi
rol eax, 0xe
sub edi, eax
mov eax, edi
mov edx, edi
xor edx, dword [ebp - 4]
rol eax, 0xb
sub edx, eax
xor esi, edx
mov eax, edx
ror eax, 7
sub esi, eax
mov eax, esi
xor edi, esi
rol eax, 0x10
sub edi, eax
mov eax, edi
mov ecx, edi
rol eax, 4
xor ecx, edx
sub ecx, eax
mov eax, ecx
xor esi, ecx
rol eax, 0xe
sub esi, eax
mov eax, esi
xor edi, esi
ror eax, 8
sub edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427cf0
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x457ab0
call fcn.004281e0
push 1
call fcn.00427745
pop ecx
test al, al
jne 0x427ba1
push 7
call fcn.00427e28
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00427710
mov byte [ebp - 0x24], al
mov eax, dword [0x45afe0]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x427b9a
test eax, eax
jne 0x427c0b
mov dword [0x45afe0], ecx
push 0x446284
push 0x446260
call fcn.00437b30
pop ecx
pop ecx
test eax, eax
je 0x427bee
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x427ce4
push 0x44625c
push 0x446238
call fcn.00437ad4
pop ecx
pop ecx
mov dword [0x45afe0], 2
jmp 0x427c10
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.004278b2
pop ecx
call fcn.0042833f
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x427c40
push esi
call fcn.00427828
pop ecx
test al, al
je 0x427c40
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00427d08
call esi
call fcn.00428345
mov esi, eax
cmp dword [esi], edi
je 0x427c5e
push esi
call fcn.00427828
pop ecx
test al, al
je 0x427c5e
push dword [esi]
call fcn.00436d4f
pop ecx
call fcn.00427f44
movzx eax, ax
push eax
call fcn.00437a8e
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.00436c5e
test al, al
jne 0x427c89
push esi
call fcn.00436d87
test bl, bl
jne 0x427c92
call fcn.00436d2a
push edi
push 1
call fcn.004278cf
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x427ce4
call fcn.00428226
ret
call fcn.0042828a
jmp 0x427b82

Function at 0x42b097
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x4488c0
push 0x4488b8
push str.FlsAlloc
push 0
call fcn.0042b017
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42b0c9
push dword [ebp + 8]
mov ecx, esi
call fcn.00427d08
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x42b10b
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x4488d0
push 0x4488c8
push str.FlsGetValue
push 2
call fcn.0042b017
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x42b13c
mov ecx, esi
call fcn.00427d08
call esi
jmp 0x42b142
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x42b145
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x4488d8
push 0x4488d0
push str.FlsSetValue
push 3
call fcn.0042b017
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x42b179
mov ecx, esi
call fcn.00427d08
call esi
jmp 0x42b17f
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret
Function at 0x43be61
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
mov edx, dword [ebp + 0xc]
push ebx
sar ecx, 6
push esi
push edi
imul edi, eax, 0x30
mov eax, dword [ecx*4 + 0x45b7e0]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x43bea2
cmp byte [edx], 0xa
jne 0x43bea2
or byte [eax + edi + 0x28], 4
jmp 0x43bea7
and byte [eax + edi + 0x28], 0xfb
lea eax, [edx + ecx]
mov ebx, edx
mov dword [ebp - 8], eax
mov esi, edx
cmp edx, eax
jae 0x43bf98
mov al, byte [ebx]
cmp al, 0x1a
je 0x43bf79
cmp al, 0xd
je 0x43bed0
mov byte [esi], al
inc esi
inc ebx
jmp 0x43bf6e
lea eax, [ebx + 1]
cmp eax, dword [ebp - 8]
jae 0x43bef0
cmp byte [eax], 0xa
jne 0x43bee5
push 2
mov byte [esi], 0xa
pop eax
jmp 0x43beeb
xor eax, eax
mov byte [esi], 0xd
inc eax
add ebx, eax
inc esi
jmp 0x43bf6e
push 0
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43bf67
cmp dword [ebp - 0x14], 0
je 0x43bf67
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x45b7e0]
test byte [eax + edi + 0x28], 0x48
je 0x43bf3e
mov dl, byte [ebp - 1]
cmp dl, 0xa
jne 0x43bf2e
mov byte [esi], dl
jmp 0x43bf6a
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x45b7e0]
mov byte [eax + edi + 0x2a], dl
jmp 0x43bf6a
cmp byte [ebp - 1], 0xa
jne 0x43bf50
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x43bf50
mov byte [esi], 0xa
jmp 0x43beed
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0044313b
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x43bf6b
mov byte [esi], 0xd
inc esi
mov edx, dword [ebp + 0xc]
cmp ebx, dword [ebp - 8]
jb 0x43beb9
jmp 0x43bf98
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x45b7e0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x43bf93
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x43bf98
mov cl, byte [ebx]
mov byte [esi], cl
inc esi
sub esi, edx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret