joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10022720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003f478
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x1005400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], 0x4f0053
mov dword [ebp - 0x34], 0x540046
mov dword [ebp - 0x30], 0x410057
mov dword [ebp - 0x2c], 0x450052
mov dword [ebp - 0x28], 0x41005c
mov dword [ebp - 0x24], 0x430049
mov dword [ebp - 0x20], 0x65006c
mov dword [ebp - 0x1c], 0x6e0061
mov dword [ebp - 0x18], 0x720065
mov word [ebp - 0x14], ax
call fcn.10005f40
mov ecx, eax
test ecx, ecx
je 0x100227fe
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.100066e0
test al, al
jne 0x100227e0
lea ecx, [ebp - 0x38]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100227c5
sub ecx, edx
lea eax, [ebp - 0x38]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10005a50
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000faec
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10005d10
int3

Function at 0x10022810
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003f4a8
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x1005400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], 0x4a0059
mov dword [ebp - 0x48], 0x420048
mov dword [ebp - 0x44], 0x43005a
mov dword [ebp - 0x40], 0x6e006f
mov dword [ebp - 0x3c], 0x690066
mov dword [ebp - 0x38], 0x430067
mov dword [ebp - 0x34], 0x6e0065
mov dword [ebp - 0x30], 0x650074
mov dword [ebp - 0x2c], 0x570072
mov dword [ebp - 0x28], 0x64006e
mov dword [ebp - 0x24], 0x6c0043
mov dword [ebp - 0x20], 0x730061
mov dword [ebp - 0x1c], 0x4e0073
mov dword [ebp - 0x18], 0x6d0061
mov dword [ebp - 0x14], 0x65
call fcn.10005f40
mov ecx, eax
test ecx, ecx
je 0x1002291a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.100066e0
test al, al
jne 0x100228fb
lea ecx, [ebp - 0x4c]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100228e0
sub ecx, edx
lea eax, [ebp - 0x4c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10005a50
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000faec
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10005d10
int3
Function at 0x10022930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003f448
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x1005400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], 0x4f0053
mov dword [ebp - 0x3c], 0x540046
mov dword [ebp - 0x38], 0x410057
mov dword [ebp - 0x34], 0x450052
mov dword [ebp - 0x30], 0x54005c
mov dword [ebp - 0x2c], 0x610072
mov dword [ebp - 0x28], 0x650063
mov dword [ebp - 0x24], 0x65006c
mov dword [ebp - 0x20], 0x730073
mov dword [ebp - 0x1c], 0x680063
mov dword [ebp - 0x18], 0x740061
mov word [ebp - 0x14], ax
call fcn.10005f40
mov ecx, eax
test ecx, ecx
je 0x10022a1e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.100066e0
test al, al
jne 0x100229ff
lea ecx, [ebp - 0x40]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100229e4
sub ecx, edx
lea eax, [ebp - 0x40]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10005a50
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000faec
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10005d10
int3
Function at 0x10022a30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003eb7b
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x1005400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x90], 0x6f0043
mov dword [ebp - 0x8c], 0x66006e
mov dword [ebp - 0x88], 0x670069
mov dword [ebp - 0x84], 0x650043
mov dword [ebp - 0x80], 0x74006e
mov dword [ebp - 0x7c], 0x720065
mov dword [ebp - 0x78], 0x690053
mov dword [ebp - 0x74], 0x6c006e
mov dword [ebp - 0x70], 0x650067
mov dword [ebp - 0x6c], 0x6e0049
mov dword [ebp - 0x68], 0x740073
mov dword [ebp - 0x64], 0x6e0061
mov dword [ebp - 0x60], 0x650063
mov dword [ebp - 0x5c], 0x32005f
mov dword [ebp - 0x58], 0x390039
mov dword [ebp - 0x54], 0x370039
mov dword [ebp - 0x50], 0x360045
mov dword [ebp - 0x4c], 0x2d0045
mov dword [ebp - 0x48], 0x330033
mov dword [ebp - 0x44], 0x340036
mov dword [ebp - 0x40], 0x34002d
mov dword [ebp - 0x3c], 0x330030
mov dword [ebp - 0x38], 0x2d0038
mov dword [ebp - 0x34], 0x440038
mov dword [ebp - 0x30], 0x310038
mov dword [ebp - 0x2c], 0x44002d
mov dword [ebp - 0x28], 0x330046
mov dword [ebp - 0x24], 0x420045
mov dword [ebp - 0x20], 0x360046
mov dword [ebp - 0x1c], 0x320038
mov dword [ebp - 0x18], 0x420036
mov dword [ebp - 0x14], 0x45
call fcn.10005f40
mov ecx, eax
test ecx, ecx
je 0x10022bce
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x90]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.100066e0
test al, al
jne 0x10022bae
lea ecx, [ebp - 0x90]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10022b90
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10005a50
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000faec
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10005d10
int3
Function at 0x10022be0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003ec28
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x1005400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0x690059
mov dword [ebp - 0x64], 0x67006e
mov dword [ebp - 0x60], 0x610079
mov dword [ebp - 0x5c], 0x43006e
mov dword [ebp - 0x58], 0x6e006f
mov dword [ebp - 0x54], 0x690066
mov dword [ebp - 0x50], 0x430067
mov dword [ebp - 0x4c], 0x6e0065
mov dword [ebp - 0x48], 0x650074
mov dword [ebp - 0x44], 0x530072
mov dword [ebp - 0x40], 0x750074
mov dword [ebp - 0x3c], 0x500062
mov dword [ebp - 0x38], 0x650072
mov dword [ebp - 0x34], 0x690066
mov dword [ebp - 0x30], 0x570078
mov dword [ebp - 0x2c], 0x64006e
mov dword [ebp - 0x28], 0x6c0043
mov dword [ebp - 0x24], 0x730061
mov dword [ebp - 0x20], 0x4e0073
mov dword [ebp - 0x1c], 0x6d0061
mov dword [ebp - 0x18], 0x5f0065
mov word [ebp - 0x14], ax
call fcn.10005f40
mov ecx, eax
test ecx, ecx
je 0x10022d1b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x68]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.100066e0
test al, al
jne 0x10022cfb
lea ecx, [ebp - 0x68]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10022ce0
sub ecx, edx
lea eax, [ebp - 0x68]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10005a50
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000faec
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10005d10
int3

Function at 0x10022d30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003ed88
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x1005400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], 0x4f0053
mov dword [ebp - 0x30], 0x540046
mov dword [ebp - 0x2c], 0x410057
mov dword [ebp - 0x28], 0x450052
mov dword [ebp - 0x24], 0x59005c
mov dword [ebp - 0x20], 0x6e0069
mov dword [ebp - 0x1c], 0x790067
mov dword [ebp - 0x18], 0x6e0061
mov word [ebp - 0x14], ax
call fcn.10005f40
mov ecx, eax
test ecx, ecx
je 0x10022e09
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.100066e0
test al, al
jne 0x10022deb
lea ecx, [ebp - 0x34]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10022dd0
sub ecx, edx
lea eax, [ebp - 0x34]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10005a50
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000faec
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10005d10
int3
Function at 0x100231b0
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x1005400c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
js 0x10023319
push 0x208
lea eax, [ebp - 0x228]
push 0
push eax
call fcn.100241f0
add esp, 0xc
lea eax, [ebp - 0x228]
push 0x104
push eax
push 0x10000000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x228]
push eax
call edi
test esi, esi
jle 0x1002321f
lea eax, [ebp - 0x228]
push eax
call edi
sub esi, 1
jne 0x10023211
mov eax, dword [0x1005588c]
mov esi, dword [eax]
cmp esi, eax
je 0x10023319
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
nop word [eax + eax]
push 0x208
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.100241f0
add esp, 0xc
lea eax, [ebp - 0x228]
push dword [esi + 0x14]
push eax
lea eax, [ebp - 0x430]
push eax
call edi
lea eax, [ebp - 0x430]
push eax
call ebx
mov ecx, dword [esi + 0x10]
test eax, eax
jne 0x10023340
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x770030
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x700070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
mov word [ebp - 8], ax
cmp ecx, 3
jne 0x100232d1
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x430]
push eax
call edi
lea eax, [ebp - 0x430]
push eax
call ebx
test eax, eax
jne 0x1002332c
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x100232f7
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x100232f3
cmp esi, dword [eax + 8]
jne 0x100232f3
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x100232e3
mov esi, eax
jmp 0x1002330d
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x1002330d
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x10023301
cmp esi, dword [0x1005588c]
jne 0x10023240
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000faec
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000faec
mov esp, ebp
pop ebp
ret
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000faec
mov esp, ebp
pop ebp
ret

Function at 0x10033e44
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10033b04

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x407006
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x407027
jl 0x40701e
test edi, edi
jne 0x407027
xor eax, eax
xor edx, edx
jmp 0x4070e8
cmp dword [ebx + 0x38], 0
je 0x40703c
push eax
push edi
push dword [ebp + 8]
call fcn.004070ee
jmp 0x4070e8
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x407083
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x407083
cmp eax, edi
jb 0x40705d
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00409300
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x407089
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x4070dd
mov ecx, ebx
call fcn.0040686e
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x4070c8
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.0040f3f2
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x4070dd
jmp 0x40709b
test edx, edx
je 0x4070dd
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0040f3f2
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x408ae8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x408b27
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x408b27
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x408b27
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x408b27
cmp dword [ecx + 0x74], 0xe
jbe 0x408b27
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x416d0e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x429080
push 0x429078
push str.FlsAlloc
push 0x1e
call fcn.00416b7b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x416d42
push dword [ebp + 8]
mov ecx, esi
call dword [0x42514c]
call esi
jmp 0x416d48
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x416d8c
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x429090
push 0x429088
push str.FlsGetValue
push 0x20
call fcn.00416b7b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x416dc3
push dword [ebp + 8]
mov ecx, esi
call dword [0x42514c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x4180c2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00417f33

Function at 0x4184bc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00408c50
mov eax, dword [0x433010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0041556a
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4184fe
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41865a
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004240c0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x434980]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.004194b3
mov ecx, dword [esi*4 + 0x434980]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x418653
cmp eax, dword [edi + ecx + 0x24]
jne 0x418653
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x418653
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004194b3
add esp, 0x14
test edx, edx
jl 0x418653
jg 0x4185c9
test eax, eax
jb 0x418653
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x418653
jl 0x4185e3
cmp dword [ebp - 0x1008], eax
ja 0x418653
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x418601
test ebx, ebx
je 0x41863a
cmp ecx, edi
jae 0x41863a
mov al, byte [ecx]
cmp al, 0xd
jne 0x41861b
lea eax, [edi - 1]
cmp ecx, eax
jae 0x418627
cmp byte [ecx + 1], 0xa
jne 0x418627
inc ecx
jmp 0x418627
movzx eax, al
movsx eax, byte [eax + 0x4332a0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x418601
cmp edx, ebx
jne 0x418601
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x418658
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00407e96
leave
ret
Function at 0x418951
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x434980]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x418991
cmp byte [ebx], 0xa
jne 0x418991
or byte [eax + edi + 0x28], 4
jmp 0x418996
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x418a94
mov al, byte [edx]
cmp al, 0x1a
je 0x418a76
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x4189c5
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4189ea
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x4189f4
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x4189a7
jmp 0x418a94
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x418a71
cmp dword [ebp - 0xc], 0
je 0x418a71
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x434980]
test byte [eax + edi + 0x28], 0x48
je 0x418a4b
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x418a36
mov byte [esi], dl
jmp 0x418a47
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x434980]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x418a94
cmp byte [ebp - 1], 0xa
jne 0x418a5a
cmp esi, ebx
jne 0x418a5a
mov byte [esi], 0xa
jmp 0x418a93
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004194d1
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x418a94
mov byte [esi], 0xd
jmp 0x418a93
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x434980]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x418a90
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x418a94
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x418a9d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x434980]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x418ae0
cmp word [esi], dx
jne 0x418ae0
or byte [edi + eax + 0x28], 4
jmp 0x418ae5
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x418c38
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x418c18
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x418b27
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x418b5d
cmp eax, edx
jae 0x418b69
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x418aff
jmp 0x418c38
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x418c14
cmp dword [ebp - 0x14], 0
je 0x418c14
mov eax, dword [ebx*4 + 0x434980]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x418bec
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x418bb5
mov word [esi], cx
jmp 0x418be8
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x434980]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x434980]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x434980]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x418c38
pop ebx
cmp word [ebp - 4], bx
jne 0x418bfd
cmp esi, dword [ebp + 0xc]
jne 0x418bfd
mov word [esi], bx
jmp 0x418c35
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004194d1
add esp, 0x10
cmp word [ebp - 4], bx
je 0x418c38
push 0xd
jmp 0x418c31
mov ecx, dword [ebx*4 + 0x434980]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x418c2f
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x418c38
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41cf1d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41cfba
push ebx
push esi
call fcn.0041cee6
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041bb6b
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41cf67
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41cfb9
push edi
push eax
call fcn.00414679
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41cf87
call fcn.0041463f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41cfb8
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041bb6b
add esp, 0x20
test eax, eax
jne 0x41cfa6
push edi
call fcn.0041463f
jmp 0x41cfae
push ebx
call fcn.0041463f
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x423ec0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x423eed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x423eed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret