joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007fba
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
xor edi, edi
push edi
push dword [esp + 0x18]
push dword [esp + 0x14]
call fcn.1000a6ac
mov esi, eax
add esp, 0xc
test esi, esi
je 0x1000803c
push esi
call fcn.10011050
pop ecx
test eax, eax
jne 0x10008034
push edi
push 0x200080
push 1
push edi
push 3
push 0xc0000000
push esi
call dword [sym.imp.kernel32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10008043
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
cmp edi, 0x50
je 0x10008034
cmp edi, 0xb7
je 0x10008034
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10008034
push edi
call dword [sym.imp.kernel32.dll_SetLastError]
push str.Could_not_open_file
push dword [esp + 0x10]
call sym.java.dll__JNU_ThrowIOExceptionWithLastError_8
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
xor al, al
pop edi
pop esi
ret 0xc
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov al, 1
jmp 0x1000803e

Function at 0x1000836f
Capabilities:
Get disk size

Disassembly:
push ebp
lea ebp, [esp - 0x7a8]
sub esp, 0x828
mov eax, dword [0x1001ff00]
xor eax, ebp
mov dword [ebp + 0x7a4], eax
mov eax, dword [ebp + 0x7b8]
xorps xmm0, xmm0
mov ecx, dword [ebp + 0x7b0]
push ebx
push esi
push edi
push dword [0x1001ff58]
movlpd qword [ebp - 0x80], xmm0
push eax
push ecx
call fcn.1000a1e8
add esp, 0xc
mov ebx, eax
lea eax, [ebp - 0x60]
push 0x400
push eax
push ebx
call dword [sym.imp.kernel32.dll_GetVolumePathNameW]
test eax, eax
je 0x1000840e
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x1000840e
mov eax, dword [ebp + 0x7bc]
sub eax, 0
je 0x10008406
sub eax, 1
je 0x100083fe
sub eax, 1
jne 0x1000840e
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
jmp 0x10008414
mov esi, dword [ebp - 0x70]
mov edi, dword [ebp - 0x6c]
jmp 0x10008414
mov esi, dword [ebp - 0x78]
mov edi, dword [ebp - 0x74]
jmp 0x10008414
mov edi, dword [ebp - 0x7c]
mov esi, dword [ebp - 0x80]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov ecx, dword [ebp + 0x7a4]
mov edx, edi
pop edi
mov eax, esi
xor ecx, ebp
pop esi
pop ebx
call fcn.10014785
add ebp, 0x7a8
leave
ret 0x10
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x401c66
pop dword [ebp - 8]
mov eax, 0x401c66
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x6156cce1
add dword [ebp - 0x18], 0xecfb786a
mov dword [ebp - 0x14], 0xd6102bf3
add dword [ebp - 0x14], 0x5c232052
mov dword [ebp - 0x10], 0x33855f13
sub dword [ebp - 0x10], 0xe7391ae5
mov dword [ebp - 0xc], 0x1964f081
sub dword [ebp - 0xc], 0x1964f081
lea eax, [ebp - 0x18]
push eax
mov eax, 0xbb2708ea
sub eax, 0xbae6d896
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x45328e4d
sub dword [ebp - 0x18], 0xd0c024f7
mov dword [ebp - 0x14], 0xade0c04d
add dword [ebp - 0x14], 0x938ba128
mov dword [ebp - 0x10], 0xe91514fb
sub dword [ebp - 0x10], 0x85a5a88f
mov dword [ebp - 0xc], 0x2bd0f541
sub dword [ebp - 0xc], 0x2bd0f541
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xab6f18ba
sub eax, 0xab2ee88e
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x33e2e
push 0
call eax
mov ecx, 0xa8e0a63f
add ecx, 0x571f9760
mov ebx, eax
mov esi, 0x32c8c46f
sub esi, 0x3288546f
add esi, dword [ebp - 8]
mov edi, 0x51e69ad0
sub edi, 0xdc7021a3
mov dword [ebp - 4], 0xbbd782ef
mov edx, dword [esi]
add dword [ebp - 4], ecx
xor edx, edi
mov dword [ebx], edx
xor dword [ebp - 4], eax
add ebx, 4
add esi, 0x9da88239
add esi, 0x62577dcb
loop 0x401d83
add eax, 0x7509776e
sub eax, 0x75088e1f
mov ebx, eax
add eax, 5
mov ecx, 0x7fe2f052
sub ecx, 0x7fa2f052
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x401dc4
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401e03
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401e03
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401e03
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401e03
cmp dword [ecx + 0x74], 0xe
jbe 0x401e03
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1000128f
Capabilities:
Query environment variable

Disassembly:
push ebx
xor ebx, ebx
cmp dword [esp + 8], ebx
je 0x100012b2
push 0x104
push dword [esp + 0xc]
push str.USER_JPI_PROFILE
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x100012b2
mov bl, 1
mov al, bl
pop ebx
ret

Function at 0x100017d8
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x10011265
call fcn.10002bb0
mov eax, dword [ebp + 8]
push 0x104
push eax
xor edi, edi
push edi
push edi
xor ecx, ecx
push 0x10012858
mov word [eax], cx
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
cmp esi, edi
jge 0x1000184c
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__NULL__pPath__MAX_PATH_
call fcn.1000230d
pop ecx
pop ecx
push edi
push esi
call fcn.1000b5c9
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x14], esi
call fcn.10002085
push eax
push esi
push 0x100124f4
call fcn.1000230d
or dword [ebp - 4], 0xffffffff
add esp, 0xc
mov eax, 0x10001845
ret
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x100018fd
push dword [ebp + 8]
mov dword [ebp - 4], 2
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x100018a9
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x10001810
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x100018fd
push 1
push 0x1a
push dword [ebp + 8]
mov dword [ebp - 4], 4
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x100018fd
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x10001810
mov eax, esi
call fcn.10002be6
ret

Function at 0x10002390
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10016040]
jne 0x1000239a
repz ret
jmp fcn.100046fe
Function at 0x10028bde
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x10028bed
pop dword [ebp - 0x20]
mov eax, 0x10028bed
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x3d8db
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x37d2
mov edi, eax
mov edx, 0x691f45dc
add edx, 0xa6f8c224
add edx, dword [ebp - 0x20]
mov esi, 0x834c45e
add esi, 0x42877c53
sub dword [ebp - 4], ebx
mov ebx, dword [edx]
xor dword [ebp - 0xc], 0x65c2cfb6
sub ebx, esi
sub dword [ebp - 8], 0x6ca64aa7
mov dword [edi], ebx
add edi, 4
add edx, 0xf180144f
add edx, 0xe7febb5
loop 0x10028c3c
add eax, 0xbdac6ac5
sub eax, 0xbdab98aa
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x1006d523
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
jne 0x1006d5a6
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 8]
push edi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x1006d570
mov byte [esi + 0x2d], 0xff
test edi, edi
je 0x1006d570
cmp edi, ebx
jge 0x1006d570
mov eax, ebx
sub eax, edi
push eax
mov eax, dword [ebp + 0xc]
add eax, edi
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 0
je 0x1006d5a0
add dword [esi + 0x1c], ebx
cmp dword [esi + 0x1c], 0xffff
jle 0x1006d5a0
xor eax, eax
mov word [esi + 0x1e], ax
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x18]
push 1
push dword [esi + 0x20]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0xc]
mov edi, dword [ebp + 8]
mov eax, edi
pop edi
pop ebx
jmp 0x1006d5b8
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.MSVCR120.dll_memset
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc

Function at 0x1006d792
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100b4850]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1016f148], 0
mov eax, dword [ebp + 8]
je 0x1006d7ba
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1006d7d4
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.10028bde
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10070e7b
mov esp, ebp
pop ebp
ret 4

Function at 0x1006d97b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100b4850]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1016f148], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x1006d9b1
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1006da17
push 0x103
lea eax, [ebp - 0x107]
mov byte [ebp - 0x108], 0
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.10028bde
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.10028bde
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.10028bde
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10070e7b
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1006da2a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100b4850]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1016f148], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1006da56
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1006da87
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1006da85
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10028bde
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1006da87
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10070e7b
mov esp, ebp
pop ebp
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x407320
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00405fb0
add esp, 4
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.004074c0
add esp, 8
push eax
lea ecx, [ebp - 8]
call fcn.00407530
lea ecx, [ebp - 0xc]
call fcn.00407430
mov dword [ebp - 0x10], 0x407570
mov edx, dword [ebp - 4]
add edx, 4
push edx
push 0
lea ecx, [ebp - 8]
call fcn.004016d0
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0
call fcn.0040e36b
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0
je 0x407393
lea ecx, [ebp - 8]
call fcn.00406a80
jmp 0x4073a4
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0
push 6
call fcn.004079d2
lea ecx, [ebp - 8]
call fcn.00407430
mov esp, ebp
pop ebp
ret 4

Function at 0x40a321
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40a360
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40a360
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40a360
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40a360
cmp dword [ecx + 0x74], 0xe
jbe 0x40a360
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x416b53
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42aae4
push 0x42aadc
push str.FlsAlloc
push 0x1e
call fcn.00416980
mov esi, eax
add esp, 0x10
test esi, esi
je 0x416b87
push dword [ebp + 8]
mov ecx, esi
call dword [0x427148]
call esi
jmp 0x416b8d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x416bd1
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42aaf4
push 0x42aaec
push str.FlsGetValue
push 0x20
call fcn.00416980
mov esi, eax
add esp, 0x10
test esi, esi
je 0x416c08
push dword [ebp + 8]
mov ecx, esi
call dword [0x427148]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x41965f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00419301

Function at 0x41966a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00419490
Function at 0x41acd5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040a6c0
mov eax, dword [0x436018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004187ef
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41ad17
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41ae73
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00426540
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x437ba8]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0041b0fb
mov ecx, dword [esi*4 + 0x437ba8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x41ae6c
cmp eax, dword [edi + ecx + 0x24]
jne 0x41ae6c
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41ae6c
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041b0fb
add esp, 0x14
test edx, edx
jl 0x41ae6c
jg 0x41ade2
test eax, eax
jb 0x41ae6c
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41ae6c
jl 0x41adfc
cmp dword [ebp - 0x1008], eax
ja 0x41ae6c
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41ae1a
test ebx, ebx
je 0x41ae53
cmp ecx, edi
jae 0x41ae53
mov al, byte [ecx]
cmp al, 0xd
jne 0x41ae34
lea eax, [edi - 1]
cmp ecx, eax
jae 0x41ae40
cmp byte [ecx + 1], 0xa
jne 0x41ae40
inc ecx
jmp 0x41ae40
movzx eax, al
movsx eax, byte [eax + 0x436970]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41ae1a
cmp edx, ebx
jne 0x41ae1a
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x41ae71
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00409b28
leave
ret
Function at 0x41ea5d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41eafa
push ebx
push esi
call fcn.0041ea26
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041d6ab
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41eaa7
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41eaf9
push edi
push eax
call fcn.0041788d
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41eac7
call fcn.004166a5
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41eaf8
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041d6ab
add esp, 0x20
test eax, eax
jne 0x41eae6
push edi
call fcn.004166a5
jmp 0x41eaee
push ebx
call fcn.004166a5
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x423584
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x437ba8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4235c4
cmp byte [ebx], 0xa
jne 0x4235c4
or byte [eax + edi + 0x28], 4
jmp 0x4235c9
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x4236c7
mov al, byte [edx]
cmp al, 0x1a
je 0x4236a9
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x4235f8
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x42361d
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x423627
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x4235da
jmp 0x4236c7
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4236a4
cmp dword [ebp - 0xc], 0
je 0x4236a4
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x437ba8]
test byte [eax + edi + 0x28], 0x48
je 0x42367e
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x423669
mov byte [esi], dl
jmp 0x42367a
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x437ba8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4236c7
cmp byte [ebp - 1], 0xa
jne 0x42368d
cmp esi, ebx
jne 0x42368d
mov byte [esi], 0xa
jmp 0x4236c6
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041b119
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4236c7
mov byte [esi], 0xd
jmp 0x4236c6
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x437ba8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4236c3
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4236c7
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4236d0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x437ba8]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x423713
cmp word [esi], dx
jne 0x423713
or byte [edi + eax + 0x28], 4
jmp 0x423718
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x42386b
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x42384b
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x42375a
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x423790
cmp eax, edx
jae 0x42379c
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x423732
jmp 0x42386b
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x423847
cmp dword [ebp - 0x14], 0
je 0x423847
mov eax, dword [ebx*4 + 0x437ba8]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x42381f
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x4237e8
mov word [esi], cx
jmp 0x42381b
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x437ba8]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x437ba8]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x437ba8]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x42386b
pop ebx
cmp word [ebp - 4], bx
jne 0x423830
cmp esi, dword [ebp + 0xc]
jne 0x423830
mov word [esi], bx
jmp 0x423868
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041b119
add esp, 0x10
cmp word [ebp - 4], bx
je 0x42386b
push 0xd
jmp 0x423864
mov ecx, dword [ebx*4 + 0x437ba8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x423862
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x42386b
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x426340
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42636d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42636d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret