joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4170f0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x102c
call fcn.00408f60
mov eax, dword [0x41b008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x100c], eax
cmp ebx, 0x182
jne 0x417129
lea ecx, [ebp - 0x102c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
jmp 0x417139
cmp ebx, 0x19f
jne 0x417139
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push edi
xor edi, edi
test ebx, ebx
jle 0x4171bf
push esi
jmp 0x417150
lea esi, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0
call fcn.004170e0
mov dl, byte [ebp - 0x1008]
mov eax, dword [ebp - 0x100c]
xor byte [eax + edi], dl
cmp ebx, 0xf
jne 0x4171b9
lea eax, [ebp - 0x1010]
push eax
lea ecx, [ebp - 0x1004]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push str.nozekapajo
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push 0
lea edx, [ebp - 0x804]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SleepEx]
inc edi
cmp edi, ebx
jl 0x417150
pop esi
pop edi
cmp ebx, 0x2d
jne 0x4171d9
mov dword [0x512f40], 0xa62e7790
mov dword [0x512f44], 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret

Function at 0x4171f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x41b008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x512e0c]
push ebx
push esi
mov esi, dword [0x512c54]
mov ebx, eax
cmp eax, 0x5dd
jne 0x41722d
push 0
lea eax, [ebp - 0x404]
push eax
push str.kamemaxolosobiyo_gonulilajodabipizosares
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov eax, dword [0x41c000]
call fcn.004170b0
cmp dword [0x512e0c], 0x2f
jne 0x417248
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push esi
call fcn.004170f0
add esp, 4
cmp dword [0x512e0c], 0x568
pop esi
pop ebx
jne 0x41727a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov ecx, dword [ebp - 0x408]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret
Function at 0x401030
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c380
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x43b00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi + 0xc]
xor eax, eax
test ecx, ecx
je 0x401071
cmp word [ecx], ax
sete al
jmp 0x401078
cmp dword [edi + 0x24], 2
setle al
test eax, eax
je 0x40108f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
jmp 0x4011ce
lea ecx, [ebp - 0x268]
call fcn.004018a0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x238]
push 0x228
push 0
push eax
call fcn.004117e0
add esp, 0xc
mov dword [ebp - 0x23c], 0x22c
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4010e0
mov dword [ebp - 4], eax
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4011c1
lea eax, [ebp - 0x23c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4011b1
nop word [eax + eax]
xor ecx, ecx
mov dword [ebp - 0x25c], ecx
mov eax, dword [ebp - 0x24c]
test eax, eax
je 0x401128
push eax
mov eax, dword [ebp - 0x258]
lea ecx, [ebp - 0x258]
call dword [eax + 0xc]
mov ecx, dword [ebp - 0x25c]
xor edx, edx
xor esi, esi
mov dword [ebp - 0x24c], edx
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x248], edx
cmp word [ebp - 0x218], dx
je 0x40116b
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x258]
call fcn.0040e520
mov esi, dword [ebp - 0x244]
mov edx, dword [ebp - 0x24c]
mov ecx, dword [ebp - 0x25c]
test ecx, ecx
jne 0x401179
test esi, esi
mov ecx, 0x435f88
cmovne ecx, edx
mov eax, dword [edi + 0xc]
test eax, eax
jne 0x40118d
cmp dword [edi + 0x24], eax
mov eax, 0x435f88
je 0x40118d
mov eax, dword [edi + 0x1c]
push ecx
push eax
call fcn.00416f46
add esp, 8
test eax, eax
je 0x40120c
lea eax, [ebp - 0x23c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x401100
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
mov dword [ebp - 4], 0xffffffff
xor esi, esi
lea ecx, [ebp - 0x268]
call fcn.004015a0
push esi
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov esi, eax
call ebx
xor eax, eax
test esi, esi
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040fcbe
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
mov esi, dword [ebp - 0x234]
mov dword [ebp - 4], 0xffffffff
jmp 0x4011c3
Function at 0x40b180
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42dc4b
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
mov eax, dword [0x43b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x400000
mov dword [0x43cc10], 0x4366dc
mov dword [0x43cc18], 0x436854
push 0
mov dword [ebp - 0x10], 0x43cc10
mov dword [0x43cc2c], 1
mov dword [0x43cc28], 0x100
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40b42e
lea eax, [ecx + 0x400000]
mov dword [0x43cc24], ecx
mov dword [0x43cc20], eax
mov edx, 0x1555
mov eax, dword [0x43cc28]
mov dword [0x43cc1c], ecx
add eax, ecx
mov dword [ecx], eax
mov eax, dword [0x43cc28]
add ecx, eax
add eax, ecx
mov dword [ecx], eax
mov eax, dword [0x43cc28]
add ecx, eax
add eax, ecx
mov dword [ecx], eax
mov eax, dword [0x43cc28]
add ecx, eax
sub edx, 1
jne 0x40b214
mov dword [ecx], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], 0x43cc30
mov dword [ebp - 0x18], 0x43cc30
mov dword [ebp - 0x1c], 0x43cc30
mov dword [0x43cc30], 0x435dd4
mov dword [0x43cc34], edx
mov dword [0x43cc38], edx
mov byte [ebp - 4], 1
mov dword [0x43cc30], 0x435d70
mov dword [0x43cc3c], edx
mov dword [0x43cc44], edx
mov dword [0x43cc40], edx
mov dword [0x43cc48], 0x40
mov byte [ebp - 4], 2
mov dword [0x43cc48], 0x80
mov byte [ebp - 4], 5
mov dword [0x43cc4c], edx
mov byte [ebp - 4], 6
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x43cc60
mov dword [ebp - 0x1c], 0x43cc60
call esi
mov byte [ebp - 4], 7
mov dword [0x43cc78], 0
mov byte [ebp - 4], 8
push 0x43cc84
mov dword [ebp - 0x1c], 0x43cc84
call esi
mov byte [ebp - 4], 9
mov dword [0x43cc9c], 0x3e8
mov dword [ebp - 0x18], 0x43ccb0
mov dword [ebp - 0x14], 0x43ccb0
mov dword [0x43ccb0], 0x435dd4
mov dword [0x43ccb4], 0
mov dword [0x43ccb8], 0
mov byte [ebp - 4], 0xa
mov dword [0x43ccb0], 0x435d70
mov dword [0x43ccbc], 0
mov dword [0x43ccc4], 0
mov dword [0x43ccc0], 0
mov dword [0x43ccc8], 0x40
mov byte [ebp - 4], 0xb
mov dword [0x43ccc8], 0x80
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x2c]
mov dword [0x43cca4], 0x3e80
mov dword [0x43cca8], 1
mov dword [0x43ccac], 0
lea eax, [eax*2 + 2]
mov dword [0x43cca0], eax
mov byte [ebp - 4], 0xe
push 0x43cccc
call esi
mov byte [ebp - 4], 0xf
push ecx
mov ecx, 0x43cce4
call fcn.0040aa00
mov byte [ebp - 4], 0x10
mov dword [0x43cc50], 0
mov dword [0x43cd0c], 0
movsd xmm0, qword [0x436898]
movsd qword [0x43cc58], xmm0
xorps xmm0, xmm0
mov dword [0x43cd10], 0
mov dword [0x43cd14], 0
mov dword [0x43cd18], 0
mov dword [0x43cc54], 0
movq qword [0x43cc7c], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, 0x43cc10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00416ba5
int3
Function at 0x40bc80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [esi + 0x14], 0
test ebx, ebx
jne 0x40bc9f
pop esi
lea eax, [ebx + 1]
pop ebx
pop ebp
ret 0xc
mov eax, dword [ecx]
push edi
xor edi, edi
call dword [eax]
push dword [ebp + 0x10]
mov ecx, eax
movzx eax, bx
push eax
push ecx
mov dword [ebp + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x40bd75
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0x10], eax
test eax, eax
je 0x40bd75
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x40bd6c
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [esi + 0x14], 0
cmp dword [esi + 0x10], edi
jl 0x40bd50
cmp edi, 1
jne 0x40bd15
mov eax, dword [esi + 0xc]
mov cl, byte [ebx]
mov byte [eax], cl
inc dword [esi + 0x14]
jmp 0x40bd67
cmp edi, 2
jne 0x40bd28
mov eax, dword [esi + 0xc]
movzx ecx, word [ebx]
mov word [eax], cx
add dword [esi + 0x14], edi
jmp 0x40bd67
cmp edi, 4
jne 0x40bd39
mov eax, dword [esi + 0xc]
mov ecx, dword [ebx]
mov dword [eax], ecx
add dword [esi + 0x14], edi
jmp 0x40bd67
cmp edi, 8
jne 0x40bd50
mov eax, dword [esi + 0xc]
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [eax], ecx
mov dword [eax + 4], edx
add dword [esi + 0x14], edi
jmp 0x40bd67
test edi, edi
jle 0x40bd67
push edi
mov ecx, esi
call fcn.0040e470
push edi
push ebx
push eax
call fcn.00413470
add esp, 0xc
mov edi, 1
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x40cca0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c49d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
mov eax, dword [0x43b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
test edx, edx
je 0x40cd71
cmp word [edx], 0
je 0x40cd71
lea ecx, [ebp - 0x38]
call fcn.004018a0
mov dword [ebp - 4], 0
cmp word [edx], 0
je 0x40cd40
cmp word [edx + 2], 0
je 0x40cd40
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40cd00
sub ecx, esi
sar ecx, 1
cmp word [edx + ecx*2 - 2], 0x5c
jne 0x40cd40
cmp word [edx + ecx*2 - 4], 0x3a
je 0x40cd40
lea eax, [ecx - 1]
push eax
push edx
lea ecx, [ebp - 0x38]
call fcn.0040f620
mov edx, dword [ebp - 0x2c]
test edx, edx
jne 0x40cd40
cmp dword [ebp - 0x14], 0
mov edx, 0x435f88
cmovne edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004015a0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d350
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42dfbd
mov eax, dword fs:[0]
push eax
sub esp, 0x70
push esi
mov eax, dword [0x43b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
je 0x40d4c3
cmp word [esi], 0
je 0x40d4c3
push 0x44
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.004117e0
or dword [ebp - 0x50], 1
mov eax, 1
mov dword [ebp - 0x38], 0x435dbc
add esp, 0xc
mov dword [ebp - 0x7c], 0x44
mov word [ebp - 0x4c], ax
mov dword [ebp - 0x38], vtable.CVolObject.0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x38], vtable.CVolMem.0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0x40
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x38]
push esi
call fcn.0040e520
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp dword [ebp - 0x24], ecx
cmove eax, ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x7c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40d430
xor esi, esi
jmp 0x40d453
push 0x1f4
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1c]
call esi
mov esi, 1
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x38], vtable.CVolMem.0
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x40d48e
mov eax, dword [ebp - 0x38]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x40d489
mov ecx, 0x43cc18
call fcn.0040ede0
jmp 0x40d48e
lea ecx, [ebp - 0x38]
call eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov dword [ebp - 0x38], vtable.CVolObject.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40d510
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
call fcn.00408ba0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
movzx eax, word [edx]
test ax, ax
je 0x40d549
mov ecx, eax
cmp cx, 0x20
ja 0x40d549
movzx eax, word [edx + 2]
add edx, 2
mov ecx, eax
test ax, ax
jne 0x40d535
movzx eax, word [edx]
mov esi, eax
mov ecx, eax
mov dword [ebp - 8], esi
cmp eax, 0x22
jne 0x40d55c
movzx ecx, word [edx + 2]
xor eax, eax
cmp esi, 0x22
lea esi, [edx + 2]
sete al
lea eax, [eax*2 + 0x20]
movzx edi, ax
mov eax, dword [ebp - 8]
cmp ax, 0x22
cmovne esi, edx
movzx edx, cx
cmp cx, di
je 0x40d59e
movzx ecx, cx
test cx, cx
je 0x40d5a8
movzx eax, word [esi + 2]
add esi, 2
mov ecx, eax
mov edx, eax
cmp ax, di
jne 0x40d586
mov eax, dword [ebp - 8]
test dx, dx
je 0x40d5ab
add esi, 2
jmp 0x40d5ab
mov eax, dword [ebp - 8]
cmp ax, 0x22
jne 0x40d5ba
cmp word [esi], 0x20
jne 0x40d5ba
add esi, 2
movzx eax, word [esi]
test ax, ax
je 0x40d719
mov ecx, eax
nop dword [eax + eax]
cmp cx, 0x22
jne 0x40d677
movzx eax, word [esi + 2]
add esi, 2
mov ebx, esi
test ax, ax
je 0x40d604
mov ecx, eax
nop word [eax + eax]
cmp cx, 0x22
je 0x40d604
movzx eax, word [ebx + 2]
add ebx, 2
mov ecx, eax
test ax, ax
jne 0x40d5f0
mov edi, ebx
sub edi, esi
sar edi, 1
test edi, edi
jle 0x40d636
mov ecx, dword [ebp - 4]
add edi, edi
mov edx, dword [ecx]
lea eax, [edi + 2]
push eax
call dword [edx]
push edi
push esi
push eax
mov dword [ebp - 8], eax
call fcn.00413470
mov eax, dword [ebp - 8]
add esp, 0xc
xor ecx, ecx
mov word [edi + eax], cx
mov edi, eax
jmp 0x40d638
xor edi, edi
mov ecx, dword [ebp - 4]
add ecx, 4
mov eax, dword [ecx + 0x10]
mov esi, dword [ecx + 0x14]
sub eax, esi
cmp eax, 4
jl 0x40d657
mov eax, dword [ecx + 0xc]
mov dword [esi + eax], edi
add dword [ecx + 0x14], 4
jmp 0x40d663
lea eax, [esi + 4]
push eax
call fcn.0040e470
mov dword [eax + esi], edi
cmp word [ebx], 0
mov esi, ebx
je 0x40d708
lea esi, [ebx + 2]
jmp 0x40d708
cmp cx, 0x20
jbe 0x40d705
mov ebx, esi
movzx ecx, cx
cmp cx, 0x22
je 0x40d6a0
cmp cx, 0x20
jbe 0x40d6a0
movzx eax, word [ebx + 2]
add ebx, 2
mov ecx, eax
test ax, ax
jne 0x40d686
mov edi, ebx
sub edi, esi
sar edi, 1
test edi, edi
jle 0x40d6d2
mov ecx, dword [ebp - 4]
add edi, edi
mov edx, dword [ecx]
lea eax, [edi + 2]
push eax
call dword [edx]
push edi
push esi
push eax
mov dword [ebp - 8], eax
call fcn.00413470
mov eax, dword [ebp - 8]
add esp, 0xc
xor ecx, ecx
mov word [edi + eax], cx
mov edi, eax
jmp 0x40d6d4
xor edi, edi
mov ecx, dword [ebp - 4]
add ecx, 4
mov eax, dword [ecx + 0x10]
mov esi, dword [ecx + 0x14]
sub eax, esi
cmp eax, 4
jl 0x40d6f5
mov eax, dword [ecx + 0xc]
mov dword [esi + eax], edi
mov esi, ebx
add dword [ecx + 0x14], 4
jmp 0x40d708
lea eax, [esi + 4]
push eax
call fcn.0040e470
mov dword [eax + esi], edi
mov esi, ebx
jmp 0x40d708
add esi, 2
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x40d5d0
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
pop edi
pop esi
shr eax, 2
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416a5f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x416a9e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x416a9e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x416a9e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x416a9e
cmp dword [ecx + 0x74], 0xe
jbe 0x416a9e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41d5da
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x431988
push 0x431980
push str.FlsAlloc
push 0x1f
call fcn.0041d464
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41d60e
push dword [ebp + 8]
mov ecx, esi
call dword [0x42f290]
call esi
jmp 0x41d614
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41d658
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x431998
push 0x431990
push str.FlsGetValue
push 0x21
call fcn.0041d464
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41d68f
push dword [ebp + 8]
mov ecx, esi
call dword [0x42f290]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x41d697
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4319a0
push 0x431998
push str.FlsSetValue
push 0x22
call fcn.0041d464
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41d6d1
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42f290]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x420399
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x43c510]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4203d9
cmp byte [ebx], 0xa
jne 0x4203d9
or byte [edi + eax + 0x28], 4
jmp 0x4203de
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x4204dd
mov dl, byte [eax]
cmp dl, 0x1a
je 0x4204c0
inc eax
cmp dl, 0xd
je 0x42040a
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x420430
cmp eax, ecx
jae 0x42043e
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x4203f2
jmp 0x4204dd
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4204bb
cmp dword [ebp - 0x10], 0
je 0x4204bb
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x43c510]
test byte [eax + edi + 0x28], 0x48
je 0x420495
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x420480
mov byte [esi], dl
jmp 0x420491
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x43c510]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4204dd
cmp byte [ebp - 1], 0xa
jne 0x4204a4
cmp esi, ebx
jne 0x4204a4
mov byte [esi], 0xa
jmp 0x4204dc
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041eff7
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4204dd
mov byte [esi], 0xd
jmp 0x4204dc
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x43c510]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4204da
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4204dd
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4204e6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x43c510]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x42052c
cmp word [ebx], dx
jne 0x42052c
or byte [eax + edi + 0x28], 4
jmp 0x420531
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x420694
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x420674
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x420572
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4205a8
cmp eax, edx
jae 0x4205b6
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x42054d
jmp 0x420694
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42066f
cmp dword [ebp - 0x18], 0
je 0x42066f
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x43c510]
test byte [eax + edi + 0x28], 0x48
je 0x420645
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x420609
mov word [esi], cx
jmp 0x420640
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x43c510]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x43c510]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x43c510]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x420694
pop eax
cmp word [ebp - 4], ax
jne 0x420655
cmp esi, ebx
jne 0x420655
mov word [esi], ax
jmp 0x420691
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041eff7
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x420694
push 0xd
pop eax
jmp 0x420650
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x43c510]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x42068e
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x420694
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret