joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402b40
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [ebp - 0xc], eax
push dword [ebp + 0x14]
push dword [ebp - 0xc]
call sub.user32.dll_LoadBitmapA
mov dword [ebp - 0x18], eax
push dword [ebp + 0x18]
push dword [ebp - 0xc]
call sub.user32.dll_LoadBitmapA
mov dword [ebp - 0x1c], eax
jmp 0x402b7f
mov dword [ebp - 0x5c], 0x30
mov dword [ebp - 0x58], 0x2000
mov dword [ebp - 0x54], 0x402cc2
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0x10
push dword [ebp - 0xc]
pop dword [ebp - 0x48]
mov dword [ebp - 0x3c], 0x10
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0x402b6e
mov dword [ebp - 0x44], 0
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call sub.user32.dll_RegisterClassExA
push 0
push dword [ebp - 0xc]
push dword [ebp + 0x1c]
push dword [ebp + 8]
push 0x64
push 0x64
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x50000000
push 0
push 0x402b6e
push 0x20
call sub.user32.dll_CreateWindowExA
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
push 0
push dword [ebp - 4]
call sub.user32.dll_SetWindowLongA
push dword [ebp - 0x1c]
push 4
push dword [ebp - 4]
call sub.user32.dll_SetWindowLongA
jmp 0x402c31
push 0
push dword [ebp - 0xc]
push dword [ebp + 0x1c]
push dword [ebp - 4]
push 0
push 0
push 0
push 0
push 0x5000000e
push 0
push 0x402c2a
push 0
call sub.user32.dll_CreateWindowExA
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
push 0
push 0x172
push dword [ebp - 8]
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 8]
call sub.user32.dll_GetWindowRect
push dword [ebp - 8]
push 8
push dword [ebp - 4]
call sub.user32.dll_SetWindowLongA
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x28]
sub eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x2c]
sub eax, edx
mov dword [ebp - 0x10], eax
push 2
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push 0
push 0
push 0
push dword [ebp - 4]
call sub.user32.dll_SetWindowPos
push 5
push dword [ebp - 4]
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
leave
ret 0x18
Function at 0x40367a
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x409184]
cdq
idiv dword [0x409178]
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
cmp esi, ebx
push edi
mov edi, eax
jne 0x40369c
xor al, al
jmp 0x403824
push esi
call fcn.00403520
movzx eax, byte [esi + 0x128]
or dword [esi + 0x150], 0xffffffff
or dword [esi + 0x14c], 0xffffffff
mov dword [esi + 0x12c], eax
movsx eax, word [esi + 0x24]
mov dword [esi + 0x138], eax
mov eax, dword [esi + 0x158]
cmp eax, ebx
pop ecx
mov dword [esi + 0x140], ebx
mov dword [esi + 0x144], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x134], ebx
mov dword [esi + 0x148], ebx
mov dword [esi + 0x154], ebx
je 0x4036f7
push esi
call eax
pop ecx
movsx eax, word [esi + 0x26]
push eax
push esi
call fcn.004034eb
movsx eax, word [esi + 0x14]
imul eax, eax, 0xac
push eax
push ebx
push 0x407a60
call sub.MSVCRT.dll_memset
add esp, 0x14
xor edx, edx
cmp word [esi + 0x14], bx
jle 0x403743
mov ecx, 0x407a64
mov eax, 0x4091a0
push ebp
mov dword [ecx], eax
movsx ebp, word [esi + 0x14]
inc edx
add eax, 0x58
add ecx, 0xac
cmp edx, ebp
jl 0x40372e
pop ebp
lea eax, [edi + edi*2]
shl eax, 1
mov dword [0x4079e0], esi
mov esi, dword [sym.imp.MSVCRT.dll_calloc]
push 1
push eax
call esi
mov edi, dword [0x409184]
shl edi, 2
push 1
push edi
mov dword [0x409010], eax
call esi
or dword [0x40e9d4], 0xffffffff
add esp, 0x10
mov dword [0x40e9c4], edi
push 0x20
mov edi, 0x40e9c0
push edi
push dword [0x40e9e4]
mov dword [0x40e9e0], eax
mov dword [0x40e9d0], 0xc
mov dword [0x40e9c0], eax
mov dword [0x40e9c8], ebx
mov dword [0x40e9cc], ebx
call dword [sym.imp.winmm.dll_waveOutPrepareHeader]
mov eax, dword [0x409184]
lea eax, [eax*8 + 0x100]
push 1
push eax
call esi
mov dword [0x40917c], eax
add eax, 0xf
pop ecx
and eax, 0xfffffff0
pop ecx
mov dword [0x409174], eax
mov dword [0x4079d8], ebx
call fcn.0040318b
cmp dword [0x4079d8], ebx
jne 0x4037d9
push 0x20
push edi
push dword [0x40e9e4]
call dword [sym.imp.winmm.dll_waveOutWrite]
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push 0x403303
push ebx
mov byte [0x4079d0], bl
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push 0xf
mov dword [0x4079d4], eax
push dword [0x4079d4]
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.004047b5
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.004047b5
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.004047b5
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.004047b5
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.004047b5
mov dword [0x41203c], eax
call fcn.004047b5
test eax, eax
jge 0x402550
push 8
call fcn.004047b5
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.004047b5
pop ecx
push 1
call fcn.004047b5
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.004047b5
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.004047b5
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.004047b5
jmp 0x402495
Function at 0x1000e1bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1000e1cb
pop dword [ebp - 0x1c]
mov eax, 0x1000e1cb
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x3a2d5
push 0
mov eax, 0x1fbd0e57
add eax, 0xf044320d
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x4caf
mov esi, eax
mov edx, 0x10018600
add edx, dword [ebp - 0x1c]
mov edi, 0xa60b980e
add edi, 0x3c63f513
xor dword [ebp - 0x18], 0xa7ba411f
mov ebx, dword [edx]
add dword [ebp - 0x10], ecx
xor ebx, edi
add dword [ebp - 0xc], ecx
mov dword [esi], ebx
sub dword [ebp - 0x10], 0xfbe20ecd
add esi, 0xbc2bcbee
sub esi, 0xbc2bcbea
add edx, 0x90a3a96e
add edx, 0x6f5c5696
loop 0x1000e219
add eax, 0x6668d8a
add eax, 0xf99a9805
mov ebx, eax
add eax, 5
mov ecx, 0x2dc5bd45
sub ecx, 0x1dc5bd45
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x258010a7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x258010b6
pop dword [ebp - 0x24]
mov eax, 0x258010b6
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xd00bb65f
add dword [ebp - 0x34], 0x7e468eec
mov dword [ebp - 0x30], 0x59eceff6
add dword [ebp - 0x30], 0xd8465c4f
mov dword [ebp - 0x2c], 0x1f2c338e
sub dword [ebp - 0x2c], 0xd2dfef60
mov dword [ebp - 0x28], 0x87d8be40
sub dword [ebp - 0x28], 0x87d8be40
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x3fae4b96
sub dword [ebp - 0x34], 0xcb3be240
mov dword [ebp - 0x30], 0x9b675aa8
add dword [ebp - 0x30], 0xa60506cd
mov dword [ebp - 0x2c], 0x8e279a84
sub dword [ebp - 0x2c], 0x2ab82e18
mov dword [ebp - 0x28], 0xa32528e3
sub dword [ebp - 0x28], 0xa32528e3
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3b16c
push 0
call eax
mov ecx, 0x4223
xor edx, edx
add edx, eax
mov esi, 0x7ebf9244
sub esi, 0x593cfc44
add esi, dword [ebp - 0x24]
mov ebx, 0xb73e082c
add ebx, 0x4caad0a5
mov dword [ebp - 0x1c], 0xf201ddc4
mov edi, dword [esi]
xor edi, ebx
sub dword [ebp - 8], eax
mov dword [edx], edi
sub dword [ebp - 4], ecx
add edx, 0x305be15d
add edx, 0xcfa41ea7
add esi, 0xf427a31f
sub esi, 0xf427a31b
loop 0x258011c5
add eax, 0xfb5f
mov ebx, eax
add eax, 0xf4d6be07
sub eax, 0xf4d6be02
mov ecx, 0xf96a1b59
sub ecx, 0xd3ea1b59
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x10003c00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10021610
push 0x100067e0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x10023040]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x10003cb0
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x10003cb0
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x10003cb0
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x10003cb0
mov dword [ebp - 4], 0xfffffffe
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003f80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x1c
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, edx
push esi
mov esi, ecx
push edi
lea ecx, [esi - 0x10000]
movzx eax, cx
mov edi, ecx
sub edi, eax
test eax, eax
cmove edi, ecx
cmp edi, ebx
jbe 0x1000404b
nop dword [eax + eax]
lea eax, [edi - 0x70000000]
cmp eax, 0x10000000
ja 0x10003fc5
sub edi, 0x8000000
jmp 0x10004043
push 0x1c
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
xorps xmm0, xmm0
push eax
push edi
movups xmmword [esp + 0x1c], xmm0
movq qword [esp + 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1000404b
cmp dword [esp + 0x20], 0x10000
jne 0x1000402d
cmp dword [esp + 0x1c], 0x10000
jb 0x1000402d
push 0x40
push 0x3000
push 0x10000
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x10004107
call ebp
cmp eax, 0x677
je 0x1000404b
sub edi, 0x10000
jmp 0x10004043
mov ecx, dword [esp + 0x14]
add ecx, 0xffff0000
mov edi, ecx
movzx eax, di
sub edi, eax
test eax, eax
cmove edi, ecx
cmp edi, ebx
ja 0x10003fb0
movzx eax, si
test eax, eax
je 0x1000405a
sub esi, eax
add esi, 0x10000
mov edi, dword [esp + 0x30]
cmp esi, edi
jae 0x10004105
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
nop dword [eax]
lea eax, [esi - 0x70000000]
cmp eax, 0x10000000
ja 0x10004085
add esi, 0x8000000
jmp 0x100040fd
push 0x1c
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [esp + 0x1c], xmm0
movq qword [esp + 0x2c], xmm0
call ebx
test eax, eax
je 0x10004105
cmp dword [esp + 0x20], 0x10000
mov ecx, dword [esp + 0x1c]
jne 0x100040e7
cmp ecx, 0x10000
jb 0x100040e7
push 0x40
push 0x3000
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x10004107
call ebp
cmp eax, 0x677
je 0x10004105
add esi, 0x10000
jmp 0x100040fd
mov esi, dword [esp + 0x10]
add esi, ecx
movzx ecx, si
test ecx, ecx
je 0x100040fd
mov eax, 0x10000
sub eax, ecx
add esi, eax
cmp esi, edi
jb 0x10004070
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x100041b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
cmp dword [0x1002495c], 0
jne 0x10004226
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov edx, 0x1002495c
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10004226
push esi
mov esi, dword [0x10024950]
mov dword [0x10024940], eax
mov dword [0x10024948], eax
mov dword [0x10024954], eax
push edi
test esi, esi
je 0x1000420c
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 0x10000
push esi
call edi
test eax, eax
je 0x10004217
mov esi, dword [esi + 4]
test esi, esi
jne 0x100041f2
xor eax, eax
pop edi
mov dword [0x10024960], eax
pop esi
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov dword [0x10024960], eax
pop esi
pop ecx
ret
mov eax, 0x10dd
pop ecx
ret
Function at 0x10004b00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebp
push edi
mov ebp, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1002495c], eax
je 0x10004b1e
pop edi
mov eax, 0x10dd
pop ebp
pop ecx
ret
mov eax, dword [0x10024960]
test eax, eax
jne 0x10004c07
test ebp, ebp
jne 0x10004b36
pop edi
lea eax, [ebp + 0x57]
pop ebp
pop ecx
ret
test edi, edi
je 0x10004b4f
cmp dword [edi], 0
jne 0x10004b58
mov dword [0x10024960], 6
mov dword [0x10024954], edi
pop edi
mov eax, 6
pop ebp
pop ecx
ret
push ebx
push esi
push 0x18
call fcn.10005827
mov ecx, dword [edi]
add esp, 4
mov esi, eax
call fcn.10004140
mov ecx, ebp
mov ebx, eax
call fcn.10004140
movzx ecx, byte [ebx + 0x36]
mov ebp, dword [ebx + 0x40]
sub ebp, ecx
test ecx, ecx
je 0x10004bde
cmp ecx, 0x1e
ja 0x10004bde
cmp dword [ebx + 0x44], eax
jne 0x10004bde
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push 0x40
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10004bb2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x10004bec
mov dword [esi + 8], edi
mov dword [esi + 0x10], ebx
mov dword [esi + 0xc], ebp
mov dword [esi + 4], 1
mov eax, dword [esp + 0x10]
mov dword [esi + 0x14], eax
mov eax, dword [0x10024940]
mov dword [esi], eax
xor eax, eax
mov dword [0x10024940], esi
pop esi
pop ebx
pop edi
pop ebp
pop ecx
ret
cmp dword [0x10024944], 0
mov ebx, 9
jne 0x10004bf2
mov dword [0x10024960], ebx
push 0x18
push esi
call fcn.100054fa
add esp, 8
mov dword [0x10024954], edi
mov eax, ebx
pop esi
pop ebx
pop edi
pop ebp
pop ecx
ret

Function at 0x1000abb4
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000abf3
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000abf3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000abf3
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000abf3
cmp dword [ecx + 0x74], 0xe
jbe 0x1000abf3
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1000c4a2
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001cb60
push 0x1001cb58
push str.FlsAlloc
push 0x1f
call fcn.1000c361
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000c4d6
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001b154]
call esi
jmp 0x1000c4dc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000c520
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001cb70
push 0x1001cb68
push str.FlsGetValue
push 0x21
call fcn.1000c361
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000c557
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001b154]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1000c55f
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001cb78
push 0x1001cb70
push str.FlsSetValue
push 0x22
call fcn.1000c361
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000c599
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1001b154]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100106a9
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10010746
push ebx
push esi
call fcn.10010672
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10010606
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100106f3
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10010745
push edi
push eax
call fcn.1000cc51
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10010713
call fcn.1000c1f4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10010744
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10010606
add esp, 0x20
test eax, eax
jne 0x10010732
push edi
call fcn.1000c1f4
jmp 0x1001073a
push ebx
call fcn.1000c1f4
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x100169a4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x10024550]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100169e4
cmp byte [ebx], 0xa
jne 0x100169e4
or byte [edi + eax + 0x28], 4
jmp 0x100169e9
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x10016ae8
mov dl, byte [eax]
cmp dl, 0x1a
je 0x10016acb
inc eax
cmp dl, 0xd
je 0x10016a15
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x10016a3b
cmp eax, ecx
jae 0x10016a49
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x100169fd
jmp 0x10016ae8
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10016ac6
cmp dword [ebp - 0x10], 0
je 0x10016ac6
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x10024550]
test byte [eax + edi + 0x28], 0x48
je 0x10016aa0
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x10016a8b
mov byte [esi], dl
jmp 0x10016a9c
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x10024550]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10016ae8
cmp byte [ebp - 1], 0xa
jne 0x10016aaf
cmp esi, ebx
jne 0x10016aaf
mov byte [esi], 0xa
jmp 0x10016ae7
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10016914
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10016ae8
mov byte [esi], 0xd
jmp 0x10016ae7
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x10024550]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10016ae5
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10016ae8
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10016af1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x10024550]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10016b37
cmp word [ebx], dx
jne 0x10016b37
or byte [eax + edi + 0x28], 4
jmp 0x10016b3c
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x10016c9f
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x10016c7f
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x10016b7d
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x10016bb3
cmp eax, edx
jae 0x10016bc1
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x10016b58
jmp 0x10016c9f
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10016c7a
cmp dword [ebp - 0x18], 0
je 0x10016c7a
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x10024550]
test byte [eax + edi + 0x28], 0x48
je 0x10016c50
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x10016c14
mov word [esi], cx
jmp 0x10016c4b
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x10024550]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x10024550]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x10024550]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x10016c9f
pop eax
cmp word [ebp - 4], ax
jne 0x10016c60
cmp esi, ebx
jne 0x10016c60
mov word [esi], ax
jmp 0x10016c9c
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.10016914
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x10016c9f
push 0xd
pop eax
jmp 0x10016c5b
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x10024550]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x10016c99
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x10016c9f
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret