joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e03a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x1c]
mov eax, dword [esi + 0x64]
mov ebx, dword [esi + 0x2c]
mov ecx, dword [esi + 0x6c]
sub ebx, eax
sub ebx, ecx
mov dword [ebp - 4], ebx
jne 0x42e064
test eax, eax
jne 0x42e06e
test ecx, ecx
jne 0x42e06e
mov ebx, edi
jmp 0x42e0da
cmp ebx, 0xffffffff
jne 0x42e06e
push 0xfffffffffffffffe
pop ebx
jmp 0x42e0da
mov ecx, dword [esi + 0x1c]
lea ecx, [edi + ecx - 0x106]
cmp eax, ecx
jb 0x42e0da
mov eax, dword [esi + 0x28]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.0041eec0
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x38]
sub dword [esi + 0x68], edi
sub dword [esi + 0x64], edi
add esp, 0xc
sub dword [esi + 0x54], edi
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx edx, word [eax]
mov ebx, edx
sub ebx, edi
cmp edx, edi
sbb edx, edx
not edx
and edx, ebx
dec ecx
mov word [eax], dx
jne 0x42e09f
mov eax, dword [esi + 0x30]
mov edx, edi
lea eax, [eax + edi*2]
dec eax
dec eax
movzx ecx, word [eax]
mov ebx, ecx
sub ebx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, ebx
dec edx
mov word [eax], cx
jne 0x42e0be
mov ebx, dword [ebp - 4]
add ebx, edi
mov ecx, dword [esi + 4]
call fcn.0042c7f6
test eax, eax
je 0x42e13c
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 4]
add eax, dword [esi + 0x64]
push ebx
add eax, dword [esi + 0x28]
push eax
call fcn.0042ca41
add dword [esi + 0x6c], eax
mov ebx, dword [esi + 0x6c]
cmp ebx, 3
jb 0x42e124
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x28]
lea edx, [eax + ecx]
mov ecx, dword [esi + 0x50]
movzx eax, byte [edx]
mov dword [esi + 0x40], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x4c]
mov dword [esi + 0x40], eax
cmp ebx, 0x106
jae 0x42e13c
mov ecx, dword [esi + 4]
call fcn.0042c7f6
test eax, eax
jne 0x42e046
pop edi
pop esi
pop ebx
leave
ret
Function at 0x434160
Capabilities:
Encode data using xor
Encrypt data using blowfish

Disassembly:
sub esp, 0x4c
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov ecx, 0x10
mov eax, dword [ebp + 0x34]
lea edi, [esp + 0x1c]
cdq
and edx, 7
lea esi, [ebp + 0x18]
add eax, edx
mov ebx, eax
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, esi
sar ebx, 3
call fcn.00419e00
cmp eax, 0x40
mov ecx, esi
jbe 0x4341b4
call fcn.00419d60
test eax, eax
je 0x4341e5
mov ecx, esi
call fcn.00419d60
mov ecx, 0x10
mov esi, eax
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
jmp 0x4341e5
call fcn.00419d60
test eax, eax
je 0x4341e5
mov ecx, esi
call fcn.00419e00
mov ecx, esi
mov edi, eax
call fcn.00419d60
mov esi, eax
mov eax, edi
lea edi, [esp + 0x1c]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov ecx, dword [ebp + 0x2c]
mov edx, dword [eax + 0x4554f8]
mov dword [eax + ecx], edx
add eax, 4
cmp eax, 0x48
jl 0x4341e7
xor eax, eax
mov ecx, 0x100
mov edx, dword [ebp + 0x30]
mov esi, dword [eax + 0x455540]
mov dword [edx + eax], esi
add eax, 4
dec ecx
jne 0x434202
cmp eax, 0x1000
jl 0x4341fd
xor esi, esi
xor edi, edi
mov eax, dword [ebp + 0x2c]
lea ecx, [edi + eax]
lea eax, [esi + 1]
cdq
idiv ebx
mov dword [esp + 0x18], ecx
xor ecx, ecx
lea eax, [esi + 2]
add edi, 4
mov cl, byte [esp + edx + 0x1c]
cdq
idiv ebx
mov ch, byte [esp + esi + 0x1c]
xor eax, eax
shl ecx, 8
mov al, byte [esp + edx + 0x1c]
or ecx, eax
lea eax, [esi + 3]
cdq
idiv ebx
xor eax, eax
shl ecx, 8
mov al, byte [esp + edx + 0x1c]
or ecx, eax
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
xor edx, ecx
mov dword [eax], edx
lea eax, [esi + 4]
cdq
idiv ebx
cmp edi, 0x48
mov esi, edx
jl 0x43421f
xor esi, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, ebp
call fcn.00433960
mov eax, dword [ebp + 0x2c]
mov ecx, dword [esp + 0x10]
mov dword [esi + eax], ecx
mov edx, dword [ebp + 0x2c]
mov eax, dword [esp + 0x14]
mov dword [esi + edx + 4], eax
add esi, 8
cmp esi, 0x48
jl 0x43427f
mov esi, 4
mov edi, 0x80
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, ebp
call fcn.00433960
mov eax, dword [ebp + 0x30]
mov ecx, dword [esp + 0x10]
mov dword [eax + esi - 4], ecx
mov edx, dword [ebp + 0x30]
mov eax, dword [esp + 0x14]
mov dword [edx + esi], eax
add esi, 8
dec edi
jne 0x4342b7
cmp esi, 0x1004
jl 0x4342b2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
Function at 0x4351e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0x9c]
cmp eax, 0xffffffff
je 0x435265
cmp eax, 0x40
jbe 0x43520c
lea eax, [esi + 0x40]
push eax
push esi
call fcn.0043a5d0
add esp, 8
mov dword [esi + 0x9c], 0x14
mov edx, dword [esi + 0x9c]
mov ecx, 0x40
push edi
sub ecx, edx
lea edi, [edx + esi]
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, esi
mov ecx, 0x10
mov edx, dword [eax]
add eax, 4
xor edx, 0x36363636
dec ecx
mov dword [eax - 4], edx
jne 0x435234
lea edi, [esi + 0x40]
push edi
call fcn.0043a500
push edi
push 0x40
push esi
call fcn.0043a540
add esp, 0x10
mov dword [esi + 0x9c], 0xffffffff
pop edi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x43527f
add esi, 0x40
push esi
push eax
mov eax, dword [esp + 0x10]
push eax
call fcn.0043a540
add esp, 0xc
pop esi
ret

Function at 0x435290
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push esi
push edi
mov edi, dword [esp + 0x28]
cmp dword [edi + 0x9c], 0xffffffff
je 0x4352af
push edi
push 0
push 0
call fcn.004351e0
add esp, 0xc
lea esi, [edi + 0x40]
lea eax, [esp + 8]
push esi
push eax
call fcn.0043a5d0
add esp, 8
mov eax, edi
mov ecx, 0x10
mov edx, dword [eax]
add eax, 4
xor edx, 0x6a6a6a6a
dec ecx
mov dword [eax - 4], edx
jne 0x4352c7
push esi
call fcn.0043a500
push esi
push 0x40
push edi
call fcn.0043a540
push esi
lea ecx, [esp + 0x1c]
push 0x14
push ecx
call fcn.0043a540
lea edx, [esp + 0x24]
push esi
push edx
call fcn.0043a5d0
mov ecx, dword [esp + 0x48]
add esp, 0x24
test ecx, ecx
jbe 0x435320
mov edi, dword [esp + 0x20]
mov eax, ecx
lea esi, [esp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x14
ret
Function at 0x4361a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x214
push esi
lea eax, [esp + 0x38]
push edi
push eax
call fcn.00435130
mov edx, dword [esp + 0x228]
mov eax, dword [esp + 0x224]
lea ecx, [esp + 0x40]
push ecx
push edx
push eax
call fcn.00435140
mov edx, dword [esp + 0x23c]
mov eax, dword [esp + 0x238]
mov ecx, 0x28
lea esi, [esp + 0x4c]
lea edi, [esp + 0x18c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x18c]
push ecx
push edx
push eax
call fcn.004351e0
mov ecx, dword [esp + 0x254]
add esp, 0x1c
dec ecx
mov eax, 0xcccccccd
mul ecx
shr edx, 4
inc edx
mov dword [esp + 0x10], edx
je 0x43632c
push ebx
push ebp
mov dword [esp + 0x10], 0
mov ebx, 1
lea ebp, [esp + 0x1c]
xor edx, edx
mov ecx, 0x28
mov dword [esp + 0x1c], edx
lea esi, [esp + 0x184]
lea edi, [esp + 0xe4]
mov dword [esp + 0x20], edx
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], edx
mov ecx, ebx
mov dword [esp + 0x28], edx
mov eax, ebx
shr ecx, 0x10
mov dword [esp + 0x2c], edx
mov byte [esp + 0x31], cl
mov ecx, dword [esp + 0x238]
mov edx, ebx
shr eax, 0x18
shr edx, 8
mov byte [esp + 0x30], al
mov byte [esp + 0x32], dl
test ecx, ecx
mov byte [esp + 0x33], bl
mov eax, 4
jbe 0x4362e9
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0xe4]
lea edx, [esp + 0x30]
push ecx
push eax
push edx
call fcn.004351e0
lea eax, [esp + 0xf0]
lea ecx, [esp + 0x3c]
push eax
push 0x14
push ecx
call fcn.00435290
add esp, 0x18
xor eax, eax
mov dl, byte [esp + eax + 0x30]
mov cl, byte [esp + eax + 0x1c]
xor cl, dl
mov byte [esp + eax + 0x1c], cl
inc eax
cmp eax, 0x14
jb 0x4362b8
mov ecx, 0x28
lea esi, [esp + 0x44]
lea edi, [esp + 0xe4]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x14]
dec ecx
mov dword [esp + 0x14], ecx
jne 0x43628c
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp eax, dword [esp + 0x240]
jae 0x43630c
mov esi, dword [esp + 0x23c]
mov dl, byte [eax + ebp]
inc ecx
mov byte [eax + esi], dl
inc eax
cmp ecx, 0x14
jb 0x4362ef
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
inc ebx
add esi, 0x14
sub ebp, 0x14
mov dword [esp + 0x10], esi
lea eax, [ebx - 1]
cmp eax, ecx
jb 0x43622e
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x214
ret
Function at 0x4382b0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
mov eax, dword [esp + 0x18]
test ebx, ebx
jne 0x4382c5
mov eax, dword [esp + 0x1c]
xor edi, eax
mov ebp, 4
mov ecx, edi
shr ecx, 0x18
mov byte [esp + 0x10], cl
mov al, cl
mov edx, dword [esp + 0x10]
and al, 0x80
and edx, 0xff
neg al
sbb eax, eax
mov esi, edx
and eax, 0x14d
and esi, 0x7f
and eax, 0xff
and cl, 1
shl esi, 1
xor esi, eax
mov eax, edx
neg cl
sbb ecx, ecx
and ecx, 0xa6
shr eax, 1
xor ecx, eax
xor ecx, esi
mov eax, ecx
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, ecx
xor eax, edi
shl eax, 8
xor eax, edx
dec ebp
mov edi, eax
jne 0x4382cc
inc ebx
cmp ebx, 2
jl 0x4382b9
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x438340
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
mov esi, 0x458d20
mov dl, byte [edi + 0x456570]
mov al, dl
mov cl, dl
and al, 2
mov bl, dl
neg al
sbb al, al
and cl, 1
and eax, 0xb4
mov byte [esp + 0xd], cl
neg cl
sbb cl, cl
and ecx, 0x5a
shr bl, 2
xor bl, cl
mov byte [esp + 0xe], cl
xor bl, al
mov cl, dl
xor bl, dl
shr cl, 1
mov byte [esp + 0x10], bl
mov bl, byte [esp + 0xd]
xor cl, dl
shr cl, 1
neg bl
sbb bl, bl
and ebx, 0xb4
xor cl, bl
mov bl, byte [esp + 0xe]
xor cl, bl
mov bl, byte [edi + 0x456670]
xor cl, al
mov al, bl
and al, 2
xor cl, dl
neg al
sbb al, al
and eax, 0xb4
mov byte [esp + 0xd], al
mov al, bl
and al, 1
mov byte [esp + 0xe], al
neg al
sbb al, al
and eax, 0x5a
shr bl, 2
mov byte [esp + 0xf], al
xor bl, al
mov al, byte [esp + 0xd]
xor bl, al
mov al, byte [edi + 0x456670]
xor bl, al
mov byte [esp + 0x13], al
mov byte [esp + 0x11], bl
mov bl, byte [esp + 0x13]
shr al, 1
xor al, bl
mov bl, byte [esp + 0xe]
shr al, 1
neg bl
sbb bl, bl
and ebx, 0xb4
xor al, bl
mov bl, byte [esp + 0xf]
xor al, bl
mov bl, byte [esp + 0xd]
xor al, bl
mov bl, byte [edi + 0x456670]
xor al, bl
mov byte [esp + 0x14], bl
mov bl, byte [esp + 0x11]
mov byte [esp + 0x16], al
mov byte [esp + 0x15], bl
mov byte [esp + 0x17], al
mov ebx, dword [esp + 0x14]
mov byte [esp + 0x14], cl
mov dword [esi - 0x400], ebx
mov bl, byte [esp + 0x10]
mov byte [esp + 0x15], cl
mov byte [esp + 0x16], bl
mov byte [esp + 0x17], dl
mov ebx, dword [esp + 0x14]
mov byte [esp + 0x15], al
mov dword [esi], ebx
mov bl, byte [esp + 0x11]
mov byte [esp + 0x14], bl
mov bl, byte [edi + 0x456670]
mov byte [esp + 0x16], bl
mov byte [esp + 0x17], al
mov eax, dword [esp + 0x14]
mov byte [esp + 0x15], dl
mov dword [esi + 0x400], eax
mov al, byte [esp + 0x10]
mov byte [esp + 0x14], al
mov byte [esp + 0x16], cl
mov byte [esp + 0x17], al
add esi, 4
mov ecx, dword [esp + 0x14]
inc edi
mov dword [esi + 0x7fc], ecx
cmp esi, 0x459120
jl 0x43834d
pop edi
pop esi
mov dword [0x456770], 0
pop ebx
add esp, 0xc
ret
Function at 0x43a500
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
ret
Function at 0x4067a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x426e86
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x4334c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x24c], esi
call fcn.00410180
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x218]
push 0x7e
push eax
call fcn.0040fe60
lea ecx, [ebp - 0x218]
add esp, 8
mov edx, eax
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406820
sub ecx, edi
mov dword [ebp - 0x230], 0
xor eax, eax
sar ecx, 1
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
push ecx
lea ecx, [ebp - 0x230]
push eax
test edx, edx
je 0x406922
call fcn.0040cfc0
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.0040ba30
push eax
push esi
mov byte [ebp - 4], 1
call fcn.00406da0
mov edx, dword [ebp - 0x234]
add esp, 0x10
cmp edx, 0x10
jb 0x4068d3
mov ecx, dword [ebp - 0x248]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4068c9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406967
push edx
push ecx
call fcn.0040e6f9
add esp, 8
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x248], 0
mov edx, dword [ebp - 0x21c]
cmp edx, 8
jb 0x40694a
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406940
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406967
jmp 0x406940
call fcn.0040cfc0
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 2
push eax
push esi
call fcn.0040ba30
add esp, 8
jmp 0x4068ee
push edx
push ecx
call fcn.0040e6f9
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040e707
mov esp, ebp
pop ebp
ret
call fcn.00411b5f
int3
Function at 0x4180b1
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4180f0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4180f0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4180f0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4180f0
cmp dword [ecx + 0x74], 0xe
jbe 0x4180f0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41a2f4
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041a276

Function at 0x41cb8e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x434b20]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41cbce
cmp byte [ebx], 0xa
jne 0x41cbce
or byte [edi + eax + 0x28], 4
jmp 0x41cbd3
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x41ccd2
mov dl, byte [eax]
cmp dl, 0x1a
je 0x41ccb5
inc eax
cmp dl, 0xd
je 0x41cbff
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x41cc25
cmp eax, ecx
jae 0x41cc33
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x41cbe7
jmp 0x41ccd2
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41ccb0
cmp dword [ebp - 0x10], 0
je 0x41ccb0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x434b20]
test byte [eax + edi + 0x28], 0x48
je 0x41cc8a
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x41cc75
mov byte [esi], dl
jmp 0x41cc86
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x434b20]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x41ccd2
cmp byte [ebp - 1], 0xa
jne 0x41cc99
cmp esi, ebx
jne 0x41cc99
mov byte [esi], 0xa
jmp 0x41ccd1
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041d5dd
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x41ccd2
mov byte [esi], 0xd
jmp 0x41ccd1
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x434b20]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41cccf
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41ccd2
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41ccdb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x434b20]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41cd21
cmp word [ebx], dx
jne 0x41cd21
or byte [eax + edi + 0x28], 4
jmp 0x41cd26
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x41ce89
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x41ce69
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x41cd67
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41cd9d
cmp eax, edx
jae 0x41cdab
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x41cd42
jmp 0x41ce89
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41ce64
cmp dword [ebp - 0x18], 0
je 0x41ce64
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x434b20]
test byte [eax + edi + 0x28], 0x48
je 0x41ce3a
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x41cdfe
mov word [esi], cx
jmp 0x41ce35
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x434b20]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x434b20]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x434b20]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x41ce89
pop eax
cmp word [ebp - 4], ax
jne 0x41ce4a
cmp esi, ebx
jne 0x41ce4a
mov word [esi], ax
jmp 0x41ce86
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041d5dd
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x41ce89
push 0xd
pop eax
jmp 0x41ce45
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x434b20]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x41ce83
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x41ce89
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41e9ee
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42c540
push 0x42c538
push str.FlsAlloc
push 0x1f
call fcn.0041e88a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41ea22
push dword [ebp + 8]
mov ecx, esi
call dword [0x4281d0]
call esi
jmp 0x41ea28
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41ea6c
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42c550
push 0x42c548
push str.FlsGetValue
push 0x21
call fcn.0041e88a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41eaa3
push dword [ebp + 8]
mov ecx, esi
call dword [0x4281d0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x41eaab
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42c558
push 0x42c550
push str.FlsSetValue
push 0x22
call fcn.0041e88a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41eae5
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4281d0]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x41fd84
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41fe21
push ebx
push esi
call fcn.0041fd4d
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041e6d1
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41fdce
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41fe20
push edi
push eax
call fcn.0041aba3
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41fdee
call fcn.0041ab69
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41fe1f
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041e6d1
add esp, 0x20
test eax, eax
jne 0x41fe0d
push edi
call fcn.0041ab69
jmp 0x41fe15
push ebx
call fcn.0041ab69
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x424d65
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00424ce1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x424ed4
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x424ed4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x424e89
jg 0x424dc1
test eax, eax
je 0x424e7f
push 1
push 0x1000
call fcn.0041eda6
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x424de4
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x424e76
push 0x8000
push ebx
call fcn.00418277
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x424e0d
jg 0x424e08
cmp ecx, 0x1000
jb 0x424e0d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0041df25
add esp, 0x10
cmp eax, 0xffffffff
je 0x424e52
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x424e08
jl 0x424e39
test ecx, ecx
jne 0x424dfa
push dword [ebp - 0xc]
push ebx
call fcn.00418277
push esi
call fcn.0041ab69
add esp, 0xc
xor ebx, ebx
jmp 0x424ee2
cmp byte [edi + 0x24], 0
je 0x424e69
cmp dword [edi + 0x20], 5
jne 0x424e69
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x424e74
mov ebx, dword [edi + 0x18]
jmp 0x424e76
xor ebx, ebx
push esi
call fcn.0041ab69
pop ecx
jmp 0x424ee2
test ecx, ecx
jg 0x424e4b
jl 0x424e89
test eax, eax
jae 0x424e4b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041d5dd
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x424ea9
cmp byte [edi + 0x1c], 0
je 0x424e4b
jmp 0x424eda
push ebx
call fcn.00420213
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x424e4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x424ee2
cmp byte [edi + 0x1c], 0
je 0x424edf
mov ebx, dword [edi + 0x18]
jmp 0x424ee2
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0041d5dd
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret