joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420040
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b0ac2
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x4ec05c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x24c], 0
mov eax, dword [esi]
test eax, eax
jne 0x4201d3
push 0x208
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x220], eax
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x24c], 1
call fcn.00476450
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
je 0x4200ed
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4200e0
jmp 0x42013b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x420152
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00476450
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x420152
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x420130
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.004029b0
push str._version.dll
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.00401ad0
mov edx, dword [ebp - 0x21c]
add esp, 0xc
cmp edx, 8
jb 0x4201a9
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42019f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4201ed
push edx
push ecx
call fcn.00473d9c
add esp, 8
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea ecx, [ebp - 0x248]
mov dword [esi], eax
call fcn.00402190
mov eax, dword [esi]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00474009
mov esp, ebp
pop ebp
ret
call fcn.0047f349
int3
Function at 0x420740
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af578
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4ec05c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x28]
mov edi, dword [ebp + 8]
push esi
push eax
call fcn.0041d0c0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.00420810
add esp, 0xc
test eax, eax
jne 0x420795
xor esi, esi
jmp 0x4207b2
cmp dword [esi + 0x14], 8
jb 0x42079d
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x4207a5
mov edi, dword [edi]
push dword [ebp + 0x10]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4207e8
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4207de
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420805
push edx
push ecx
call fcn.00473d9c
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00474009
mov esp, ebp
pop ebp
ret
call fcn.0047f349
int3

Function at 0x420810
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af0b8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4ec05c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x420846
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4208ca
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x42085c
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4208ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4208ca
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.0041d0c0
add esp, 8
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
je 0x4208e9
lea eax, [ebp - 0x28]
push eax
call fcn.00420810
add esp, 4
test eax, eax
je 0x4208e9
cmp dword [esi + 0x14], 8
jb 0x4208a8
mov esi, dword [esi]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4208c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4208e9
lea ecx, [ebp - 0x28]
call fcn.00402190
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00474009
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x28]
call fcn.00402190
xor eax, eax
jmp 0x4208cf
Function at 0x420900
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 8
push ebx
push esi
push edi
test ecx, ecx
je 0x420ad8
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x420ad8
test bl, 3
jne 0x420ad8
lea eax, [ebx - 1]
xor edx, edx
add eax, ecx
mov dword [ebp - 8], edx
cmp byte [eax], 0x3d
jne 0x42094a
inc edx
dec eax
mov dword [ebp - 8], edx
cmp edx, 2
ja 0x420ad8
cmp byte [eax], 0x3d
je 0x420937
shr ebx, 2
xor edi, edi
mov dword [ebp + 8], edi
mov dword [ebp + 0x10], ebx
test ebx, ebx
je 0x420acd
lea esi, [ecx + 2]
mov dword [ebp - 4], esi
mov al, byte [esi - 2]
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x420972
sub al, 0x41
jmp 0x4209a1
lea ecx, [eax - 0x61]
cmp cl, 0x19
ja 0x42097e
sub al, 0x47
jmp 0x4209a1
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x42098a
add al, 4
jmp 0x4209a1
cmp al, 0x2b
jne 0x420992
mov al, 0x3e
jmp 0x4209a1
cmp al, 0x2f
jne 0x42099a
mov al, 0x3f
jmp 0x4209a1
cmp al, 0x3d
sete al
sub al, 1
mov dl, byte [esi - 1]
lea ecx, [edx - 0x41]
cmp cl, 0x19
ja 0x4209b1
sub dl, 0x41
jmp 0x4209e5
lea ecx, [edx - 0x61]
cmp cl, 0x19
ja 0x4209be
sub dl, 0x47
jmp 0x4209e5
lea ecx, [edx - 0x30]
cmp cl, 9
ja 0x4209cb
add dl, 4
jmp 0x4209e5
cmp dl, 0x2b
jne 0x4209d4
mov dl, 0x3e
jmp 0x4209e5
cmp dl, 0x2f
jne 0x4209dd
mov dl, 0x3f
jmp 0x4209e5
cmp dl, 0x3d
sete dl
dec dl
mov bl, byte [esi]
lea ecx, [ebx - 0x41]
cmp cl, 0x19
ja 0x4209f4
sub bl, 0x41
jmp 0x420a28
lea ecx, [ebx - 0x61]
cmp cl, 0x19
ja 0x420a01
sub bl, 0x47
jmp 0x420a28
lea ecx, [ebx - 0x30]
cmp cl, 9
ja 0x420a0e
add bl, 4
jmp 0x420a28
cmp bl, 0x2b
jne 0x420a17
mov bl, 0x3e
jmp 0x420a28
cmp bl, 0x2f
jne 0x420a20
mov bl, 0x3f
jmp 0x420a28
cmp bl, 0x3d
sete bl
dec bl
mov ah, byte [esi + 1]
mov cl, ah
sub cl, 0x41
cmp cl, 0x19
ja 0x420a3a
sub ah, 0x41
jmp 0x420a72
mov cl, ah
sub cl, 0x61
cmp cl, 0x19
ja 0x420a49
sub ah, 0x47
jmp 0x420a72
mov cl, ah
sub cl, 0x30
cmp cl, 9
ja 0x420a58
add ah, 4
jmp 0x420a72
cmp ah, 0x2b
jne 0x420a61
mov ah, 0x3e
jmp 0x420a72
cmp ah, 0x2f
jne 0x420a6a
mov ah, 0x3f
jmp 0x420a72
cmp ah, 0x3d
sete ah
dec ah
cmp al, 0xff
je 0x420ad8
cmp dl, 0xff
je 0x420ad8
cmp bl, 0xff
je 0x420ad8
cmp ah, 0xff
je 0x420ad8
mov esi, dword [ebp + 0xc]
mov cl, dl
shl al, 2
shr cl, 4
or cl, al
shl dl, 4
mov byte [edi + esi], cl
mov al, bl
mov ecx, esi
shr al, 2
mov esi, dword [ebp - 4]
or al, dl
shl bl, 6
add esi, 4
or bl, ah
mov dword [ebp - 4], esi
mov byte [edi + ecx + 1], al
mov eax, dword [ebp + 8]
inc eax
mov byte [edi + ecx + 2], bl
add edi, 3
mov dword [ebp + 8], eax
cmp eax, dword [ebp + 0x10]
jb 0x420963
mov edx, dword [ebp - 8]
sub edi, edx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420f50
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
push edi
je 0x4210c3
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x4210c3
mov eax, 0xaaaaaaab
mov ecx, edi
mul edi
push ebx
mov ebx, edx
shr ebx, 1
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebx + ebx*2]
sub ecx, eax
mov eax, 0
mov dword [ebp - 4], ecx
setne al
add eax, ebx
shl eax, 2
mov dword [ebp - 8], eax
test esi, esi
je 0x4210bc
xor eax, eax
test ebx, ebx
je 0x421020
mov edi, dword [ebp + 8]
add edi, 2
lea ebx, [ebx]
movzx ecx, byte [edi - 2]
lea edi, [edi + 3]
shr ecx, 2
movzx ecx, byte [ecx + 0x4bc460]
mov byte [eax + esi], cl
movzx edx, byte [edi - 5]
movzx ecx, byte [edi - 4]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + 0x4bc460]
mov byte [eax + esi + 1], cl
movzx edx, byte [edi - 4]
movzx ecx, byte [edi - 3]
and edx, 0xf
shr ecx, 6
shl edx, 2
or edx, ecx
movzx ecx, byte [edx + 0x4bc460]
mov byte [eax + esi + 2], cl
movzx ecx, byte [edi - 3]
and ecx, 0x3f
movzx ecx, byte [ecx + 0x4bc460]
mov byte [eax + esi + 3], cl
add eax, 4
sub ebx, 1
jne 0x420fb0
mov ecx, dword [ebp - 4]
mov edi, dword [ebp + 0x10]
sub ecx, 1
je 0x421087
sub ecx, 1
jne 0x4210b9
mov ebx, dword [ebp + 8]
movzx ecx, byte [ebx + edi - 2]
shr ecx, 2
movzx ecx, byte [ecx + 0x4bc460]
mov byte [eax + esi], cl
movzx edx, byte [ebx + edi - 2]
movzx ecx, byte [ebx + edi - 1]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + 0x4bc460]
mov byte [eax + esi + 1], cl
lea ecx, [eax + 2]
movzx eax, byte [ebx + edi - 1]
and eax, 0xf
mov al, byte [eax*4 + 0x4bc460]
mov byte [ecx + esi], al
mov eax, dword [ebp - 8]
mov byte [ecx + esi + 1], 0x3d
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
movzx ecx, byte [edx + edi - 1]
shr ecx, 2
movzx ecx, byte [ecx + 0x4bc460]
mov byte [eax + esi], cl
movzx ecx, byte [edx + edi - 1]
and ecx, 3
shl ecx, 4
movzx ecx, byte [ecx + 0x4bc460]
mov byte [eax + esi + 1], cl
mov word [eax + esi + 2], 0x3d3d
mov eax, dword [ebp - 8]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x423f20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4ec05c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x423f50
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00474009
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x423f8c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x423f8c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00474009
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x424071
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x423fb4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x423fe7
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.00484d6d
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00474009
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x424071
cmp eax, 1
jle 0x424044
cmp eax, 3
jne 0x424071
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.00418610
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00474009
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x424061
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004856e4
add esp, 0x10
cmp edi, eax
jne 0x424071
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x423f77
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00474009
mov esp, ebp
pop ebp
ret 4
Function at 0x426ea0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b1158
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4ec05c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x40]
push eax
call fcn.00427d30
push 0x4be52c
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.00401ad0
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x426ef3
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x14]
test eax, eax
sete bl
cmp edx, 8
jb 0x426f35
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x426f2b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x426f9b
push edx
push ecx
call fcn.00473d9c
add esp, 8
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x426f7f
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x426f75
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x426f9b
push edx
push ecx
call fcn.00473d9c
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00474009
mov esp, ebp
pop ebp
ret
call fcn.0047f349
int3

Function at 0x427250
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4272a9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4272a9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x42729a
cmp esi, edx
jae 0x4272a9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x427288
cmp esi, edx
jae 0x4272a9
cmp word [esi], 0
je 0x4272a9
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4287c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b13e8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x4ec05c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x10], 0
je 0x4288e6
mov esi, dword [ebp + 0x10]
cmp dword [esi + 0x10], 0
je 0x4288e6
cmp dword [eax + 0x14], 8
jb 0x428809
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x14]
call fcn.004261b0
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], 0
jb 0x428821
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x10]
call fcn.004261b0
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push eax
push 0x2001f
push 0
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x428894
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 4
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push dword [ebp - 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42887e
cmp dword [ebp - 0x1c], 4
mov ecx, 0xd
cmovne eax, ecx
mov esi, dword [ebp + 0x14]
test eax, eax
cmove esi, dword [ebp - 0x20]
test edi, edi
je 0x428897
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x428897
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp - 0x10]
or edi, 0xffffffff
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4288b4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x4288d3
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x430b10
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b2118
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4ec05c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor bl, bl
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 0x29], bl
mov dword [ebp - 0x38], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x430cdb
xor edi, edi
mov dword [ebp - 0x30], edi
cmp dword [ebp - 0x38], edi
jle 0x430cd4
mov edx, dword [eax + edi*4]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x430b93
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.004029b0
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ebx, dword [ebp - 0x28]
cmp edx, 8
mov ecx, dword [ebp - 0x18]
cmovae eax, ebx
mov dword [ebp - 4], 0
mov dword [ebp - 0x40], eax
cmp ecx, 0x10
jb 0x430c21
add ecx, 0xfffffff1
lea ecx, [eax + ecx*2]
mov dword [ebp - 0x3c], ecx
sub ecx, eax
sar ecx, 1
je 0x430c1b
lea esp, [esp]
cmp word [eax], 0x2f
je 0x430bf0
add eax, 2
sub ecx, 1
jne 0x430be0
jmp 0x430c1b
mov edx, str._startup_source
mov edi, eax
mov esi, 0x10
sub edi, edx
mov edi, edi
mov cx, word [edi + edx]
cmp cx, word [edx]
jne 0x430c6d
add edx, 2
sub esi, 1
jne 0x430c00
sub eax, dword [ebp - 0x40]
sar eax, 1
cmp eax, 0xffffffff
jne 0x430c78
mov edi, dword [ebp - 0x30]
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x430c5c
lea ecx, [edx*2 + 2]
mov eax, ebx
cmp ecx, 0x1000
jb 0x430c52
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x430cf9
push ecx
push ebx
call fcn.00473d9c
add esp, 8
mov eax, dword [ebp - 0x34]
inc edi
mov dword [ebp - 0x30], edi
cmp edi, dword [ebp - 0x38]
jge 0x430cd1
jmp 0x430b77
mov ecx, dword [ebp - 0x3c]
add eax, 2
jmp 0x430bd6
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 0x28]
cmp edx, eax
je 0x430c97
cmp dword [ebp - 0x14], 8
mov ecx, edx
push dword [ebp - 0x18]
cmovae eax, ebx
push eax
call fcn.004029b0
mov ebx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 0x29], 1
cmp ecx, 8
jb 0x430cce
lea ecx, [ecx*2 + 2]
mov eax, ebx
cmp ecx, 0x1000
jb 0x430cc4
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x430cf9
push ecx
push ebx
call fcn.00473d9c
add esp, 8
mov eax, dword [ebp - 0x34]
mov bl, byte [ebp - 0x29]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00474009
mov esp, ebp
pop ebp
ret
call fcn.0047f349
int3
Function at 0x433590
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b2490
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4ec05c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x14], eax
lea edi, [eax + 0x2c]
mov eax, dword [edi]
test eax, eax
jne 0x43360e
push dword [0x4eb164]
call fcn.004327b0
add esp, 4
mov ecx, dword [edi]
mov dword [ebp - 4], 0
mov dword [edi], eax
test ecx, ecx
je 0x4335ed
push ecx
mov ecx, edi
call fcn.00432790
mov eax, dword [edi]
mov dword [ebp - 4], 0xffffffff
test eax, eax
jne 0x43360e
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x14
call fcn.00473d6c
mov esi, eax
mov dword [ebp - 0x10], eax
add esp, 4
mov dword [ebp - 0x18], esi
xor ecx, ecx
mov dword [ebp - 4], 1
push ecx
mov dword [eax], ecx
push ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
push ecx
mov dword [eax + 0xc], ecx
push ecx
mov dword [eax + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
mov ecx, dword [ebp + 0xc]
mov eax, esi
mov byte [ebp - 4], 2
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ecx
mov eax, dword [edi]
test eax, eax
jne 0x433683
push dword [0x4eb164]
call fcn.004327b0
add esp, 4
mov ecx, dword [edi]
mov byte [ebp - 4], 3
mov dword [edi], eax
test ecx, ecx
je 0x43367f
push ecx
mov ecx, edi
call fcn.00432790
mov eax, dword [edi]
mov byte [ebp - 4], 2
mov edi, dword [ebp - 0x10]
push edi
push 0
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4336b1
mov eax, dword [ebp + 8]
push eax
push str._ld_not_overlapped
call fcn.0040a0c0
add esp, 8
mov byte [ebp + 0xb], 1
jmp 0x4336da
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x433712
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp + 8]
push eax
push str._ld_readfile_failed:__ld
call fcn.0040a0c0
add esp, 0xc
mov byte [ebp + 0xb], 0
test ebx, ebx
je 0x4336ea
cmp ebx, 0xffffffff
je 0x4336ea
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, byte [ebp + 0xb]
test esi, esi
je 0x4336fc
push 0x14
push esi
call fcn.00473d9c
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 0x14]
xor esi, esi
add ecx, 0xc
mov dword [ebp - 0x18], esi
mov dword [ebp + 8], edi
mov eax, dword [ecx + 4]
cmp eax, dword [ecx + 8]
je 0x433730
mov dword [eax], edi
add dword [ecx + 4], 4
jmp 0x43373a
lea edx, [ebp + 8]
push edx
push eax
call fcn.004098f0
mov ecx, dword [ebp - 0x14]
add ecx, 0x18
mov dword [ebp - 0x1c], esi
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
cmp eax, dword [ecx + 8]
je 0x433758
mov dword [eax], ebx
mov bl, 1
add dword [ecx + 4], 4
jmp 0x4336ed
lea edx, [ebp + 8]
push edx
push eax
call fcn.004098f0
mov bl, 1
jmp 0x4336ed