joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100068f1
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
mov esi, ecx
push eax
push 0x40
push 5
mov edi, dword [esi]
pop ebp
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [esp + 0x10]
call fcn.100080b0
mov ecx, dword [esi + 0x14]
mov ebx, eax
mov byte [esp + 0x14], 0xe9
lea eax, [esp + 0x14]
push ebp
push eax
mov ecx, dword [ecx + 0x1c]
sub ecx, dword [esi]
push dword [esi]
sub ecx, ebp
mov dword [esp + 0x21], ecx
call fcn.10020840
mov ecx, dword [esi + 0xc]
add esp, 0xc
sub ecx, dword [esi + 8]
cmp ecx, ebp
jbe 0x1000695e
mov eax, dword [esi]
lea esi, [eax + 5]
sub eax, esi
add eax, ecx
push eax
push 0x90
push esi
call fcn.10020dd0
add esp, 0xc
push ebx
mov edx, ebp
mov ecx, edi
call fcn.10007a4a
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x1000981a
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a4
lea eax, [esp + 0x14]
push esi
mov esi, ecx
push eax
push 0x202
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, eax
test ecx, ecx
jne 0x1000987a
mov eax, dword [esp + 0x18]
cmp al, 2
jne 0x1000985b
shr eax, 8
cmp al, 2
jne 0x1000985b
mov byte [esi], 1
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
push str.Invalid_WinSock_version
lea ecx, [esp + 8]
call fcn.100096db
push 0x1006a7c0
lea eax, [esp + 8]
jmp 0x10009898
push str.WSAStartup_failed
call fcn.100097fe
push eax
push ecx
lea ecx, [esp + 0x10]
call fcn.10002186
push 0x1006a76c
lea eax, [esp + 8]
push eax
call fcn.100207d2
int3

Function at 0x1000992d
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push esi
mov esi, ecx
mov cl, byte [ebp + 8]
push 6
push 1
call fcn.100098b1
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x100099a8
lea ecx, [esp + 8]
mov dword [esp + 8], 1
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x1000999f
mov ecx, esi
call fcn.10009ce1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push str.Failed_to_get_socket_flags
mov ecx, eax
call fcn.100097fe
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.10002186
push 0x1006a76c
lea eax, [esp + 0x10]
jmp 0x100099cd
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
call sub.WS2_32.dll_WSAGetLastError
push str.Failed_to_create_socket
mov ecx, eax
call fcn.100097fe
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.10002186
push 0x1006a76c
lea eax, [esp + 0x10]
push eax
call fcn.100207d2
int3
Function at 0x100099e2
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push esi
push edi
push dword [ebp + 0xc]
mov edi, ecx
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10009a24
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2714
jne 0x10009a2c
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x10009a08
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
call esi
cmp eax, 0x2733
jne 0x10009a97
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push 1
call fcn.10009bc6
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 4
push eax
lea eax, [esp + 0x10]
push eax
push 0x1007
push 0xffff
push dword [edi]
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x10009abb
cmp dword [esp + 0xc], 0
je 0x10009a24
push str.Failed_to_connect
call fcn.100097fe
push eax
push dword [esp + 0x14]
lea ecx, [esp + 0x20]
call fcn.10002186
push 0x1006a76c
lea eax, [esp + 0x18]
jmp 0x10009add
call esi
push str.Failed_to_connect
mov ecx, eax
call fcn.100097fe
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.10002186
push 0x1006a76c
lea eax, [esp + 0x18]
jmp 0x10009add
call esi
push str.Failed_to_get_socket_option
mov ecx, eax
call fcn.100097fe
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.10002186
push 0x1006a76c
lea eax, [esp + 0x18]
push eax
call fcn.100207d2
int3

Function at 0x10009bc6
Capabilities:
Get socket status

Disassembly:
sub esp, 0x128
mov eax, dword [ecx]
push ebx
push ebp
mov ebp, dword [esp + 0x13c]
push esi
push edi
mov edi, dword [esp + 0x140]
xor esi, esi
push esi
push 0x3e8
push ebp
push edi
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], 1
call fcn.1004f230
mov dword [esp + 0x10], eax
imul eax, ecx, 0x3e8
mov dword [esp + 0x14], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x14], eax
cmp ebp, esi
jl 0x10009c21
jg 0x10009c1b
cmp edi, esi
jb 0x10009c21
lea eax, [esp + 0x10]
jmp 0x10009c23
mov eax, esi
xor ecx, ecx
lea ebx, [esp + 0x30]
cmp dword [esp + 0x13c], 1
push eax
cmovne ebx, ecx
lea ecx, [esp + 0x34]
xor edx, edx
cmp dword [esp + 0x140], edx
push esi
cmovne ecx, edx
push ebx
push ecx
push esi
mov dword [esp + 0x2c], ecx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x10009c8e
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2714
jne 0x10009cb8
test ebp, ebp
jl 0x10009c77
jg 0x10009c71
test edi, edi
jb 0x10009c77
lea eax, [esp + 0x10]
jmp 0x10009c79
xor eax, eax
push eax
push 0
push ebx
push dword [esp + 0x24]
push 0
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x10009c5e
test eax, eax
je 0x10009c9f
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x128
ret 0xc
push str.Request_timed_out
lea ecx, [esp + 0x20]
call fcn.10009cea
push 0x1006a8e4
lea eax, [esp + 0x20]
jmp 0x10009cda
call esi
push str.Failed_to_select_socket
mov ecx, eax
call fcn.100097fe
push eax
push ecx
lea ecx, [esp + 0x28]
call fcn.10002186
push 0x1006a76c
lea eax, [esp + 0x20]
push eax
call fcn.100207d2
int3
Function at 0x100102ce
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [esp + 0x10], ecx
push edi
test esi, esi
jg 0x100102f7
jl 0x100102ee
test ebx, ebx
jne 0x100102f7
xor eax, eax
xor edx, edx
jmp 0x100103c1
cmp dword [ecx + 0x38], 0
je 0x1001030c
push esi
push ebx
push dword [ebp + 8]
call fcn.10010e6f
jmp 0x100103c1
mov eax, dword [ecx + 0x1c]
mov edi, ebx
mov edx, dword [eax]
test edx, edx
je 0x10010351
mov eax, dword [ecx + 0x2c]
cmp dword [eax], 0
jbe 0x10010351
cmp dword [eax], ebx
mov esi, ebx
mov edi, dword [ebp + 8]
cmovb esi, dword [eax]
push esi
push edx
push edi
call fcn.10020840
mov ecx, dword [esp + 0x20]
add edi, esi
mov dword [esp + 0x1c], edi
add esp, 0xc
mov edi, ebx
sub edi, esi
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0x10]
jmp 0x10010358
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
cmp dword [ecx + 0x4c], 0
je 0x100103b8
call fcn.1001174e
mov ecx, dword [esp + 0x10]
mov edx, edi
cmp edi, 0xfff
jbe 0x1001039f
mov eax, dword [esp + 0x14]
push dword [eax + 0x4c]
push 0xfff
push 1
push ecx
call fcn.10034cf5
mov ecx, dword [esp + 0x20]
sub edi, eax
add ecx, eax
add esp, 0x10
mov dword [esp + 0x10], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x100103b8
jmp 0x10010369
test edx, edx
je 0x100103b8
mov eax, dword [esp + 0x14]
push dword [eax + 0x4c]
push edi
push 1
push ecx
call fcn.10034cf5
add esp, 0x10
sub edi, eax
sub ebx, edi
mov eax, ebx
sbb esi, 0
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10012086
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x100518aa
call fcn.1004f6c8
sub esp, 0x54
mov edx, ecx
xor eax, eax
mov dword [ebp - 0x18], edx
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
movaps xmm0, xmmword [0x10064580]
push ebx
push esi
push edi
mov edi, edx
movups xmmword [ebp - 0x60], xmm0
movaps xmm0, xmmword [0x10064590]
stosd dword es:[edi], eax
movups xmmword [ebp - 0x50], xmm0
movaps xmm0, xmmword [0x100645a0]
stosd dword es:[edi], eax
movups xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [str.wxyz0123456789_]
stosd dword es:[edi], eax
movups xmmword [ebp - 0x30], xmm0
stosd dword es:[edi], eax
mov dword [edx + 0x10], ecx
mov dword [edx + 0x14], 0xf
mov byte [edx], cl
mov dword [ebp - 4], ecx
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], 1
cmp esi, eax
je 0x1001220c
mov cl, byte [esi]
mov byte [ebp + edi - 0x14], cl
inc edi
mov bl, byte [ebp - 0x13]
mov bh, byte [ebp - 0x14]
mov byte [ebp - 0xd], bl
cmp edi, 3
jne 0x10012180
movzx eax, bh
mov ecx, edx
shr eax, 2
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.10011c77
mov edi, dword [ebp - 0x18]
mov cl, bh
and cl, 3
mov al, bl
shr al, 4
shl cl, 4
add cl, al
movzx eax, cl
mov ecx, edi
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.10011c77
mov al, byte [ebp - 0x12]
mov cl, bl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
movzx eax, cl
mov ecx, edi
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.10011c77
movzx eax, byte [ebp - 0x12]
mov ecx, edi
and eax, 0x3f
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.10011c77
mov eax, dword [ebp + 0xc]
xor edi, edi
mov edx, dword [ebp - 0x18]
inc esi
cmp esi, eax
jne 0x100120fa
test edi, edi
je 0x1001220c
movzx eax, bh
mov ecx, edx
shr eax, 2
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.10011c77
mov esi, dword [ebp - 0x18]
and bh, 3
mov ecx, esi
cmp edi, 1
jne 0x100121c4
shl bh, 4
movzx eax, bh
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.10011c77
push 4
inc edi
pop ebx
jmp 0x100121fa
mov al, bl
shl bh, 4
shr al, 4
add bh, al
movzx eax, bh
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.10011c77
and bl, 0xf
mov ecx, esi
shl bl, 2
movzx eax, bl
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.10011c77
push 4
inc edi
pop ebx
cmp edi, ebx
jae 0x1001220f
sub ebx, edi
push 0x3d
mov ecx, esi
call fcn.10011c77
sub ebx, 1
jne 0x100121fc
jmp 0x1001220f
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x1001d488
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1006c048]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 4
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x1001d568
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1001d561
push ebx
cmp dword [ebp - 0x20], 0x10
jb 0x1001d546
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x1001d546
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x1001d546
mov edx, dword [esi]
test edx, edx
jne 0x1001d514
push 0x200
push edx
push dword [0x1006f454]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x1001d560
lea ebx, [esi + 8]
jmp 0x1001d53c
mov eax, dword [esi + 4]
lea ebx, [esi + 8]
cmp dword [ebx], eax
jb 0x1001d53c
shl eax, 3
push eax
push edx
push 0
push dword [0x1006f454]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x1001d560
shl dword [esi + 4], 1
mov dword [esi], edx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [ebx]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1001d4cc
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1001f88e
leave
ret

Function at 0x1001d576
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.1001d488
cmp dword [esi], ebx
je 0x1001d5d6
push edi
mov edi, ebx
cmp dword [esi + 8], ebx
jbe 0x1001d5d5
mov eax, dword [esi]
push dword [eax + edi*4]
push ebx
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1001d5cc
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 4]
mov ecx, ebx
call fcn.1001d335
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
push 0
pop ebx
cmp edi, dword [esi + 8]
jb 0x1001d59c
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001d5da
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x1001d626
push edi
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x1001d615
push ebx
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1001d60e
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x1001d5eb
pop ebx
push dword [esi]
push 0
push dword [0x1006f454]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
ret
Function at 0x1001d628
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
imul edi, ecx, 0x2c
add edi, dword [0x10085fb0]
mov al, byte [edi + 0x14]
mov esi, dword [edi]
and al, 1
je 0x1001d644
sub esi, 5
movzx eax, al
lea ebx, [eax*2 + 5]
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1001d665
push 0xa
pop eax
jmp 0x1001d6a4
mov byte [esi], 0xe9
mov eax, dword [edi + 4]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
test byte [edi + 0x14], 1
je 0x1001d680
mov eax, dword [edi]
mov word [eax], 0xf9eb
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [edi + 0x14], 6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001db4d
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edx, dword [0x10085fa8]
push esi
xor esi, esi
jmp 0x1001db5f
cmp dword [edx + 4], esi
jne 0x1001dbb3
mov edx, dword [edx]
test edx, edx
jne 0x1001db58
push 0x40
push 0x3000
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
test edx, edx
je 0x1001dbaf
push edi
push 0x20
lea ecx, [edx + 0x20]
mov dword [edx + 8], esi
pop edi
mov dword [ecx], esi
mov eax, ecx
mov dword [edx + 4], ecx
add edi, 0x20
add ecx, 0x20
mov esi, eax
cmp edi, 0xfe0
jbe 0x1001db86
mov eax, dword [0x10085fa8]
mov dword [edx], eax
mov dword [0x10085fa8], edx
pop edi
test edx, edx
jne 0x1001dbb3
xor eax, eax
pop esi
ret
mov eax, dword [edx + 4]
pop esi
mov ecx, dword [eax]
inc dword [edx + 8]
mov dword [edx + 4], ecx
ret

Function at 0x1001e6e3
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.1001e6bf
pop esi
leave
ret 8

Function at 0x1003f698
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003f61a

Function at 0x1003fe91
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10058200
push 0x100581f8
push str.FlsAlloc
push 0x1e
call fcn.1003fc7e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1003fec5
push dword [ebp + 8]
mov ecx, esi
call dword [0x100531f0]
call esi
jmp 0x1003fecb
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x1003ff0f
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10058210
push 0x10058208
push str.FlsGetValue
push 0x20
call fcn.1003fc7e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1003ff46
push dword [ebp + 8]
mov ecx, esi
call dword [0x100531f0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x10041bae
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10041a1f

Function at 0x100420db
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.10020060
mov eax, dword [0x1006c048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.1003c503
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x1004211d
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x10042279
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.1004f180
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x1006efc0]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.10043cf9
mov ecx, dword [esi*4 + 0x1006efc0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x10042272
cmp eax, dword [edi + ecx + 0x24]
jne 0x10042272
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10042272
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10043cf9
add esp, 0x14
test edx, edx
jl 0x10042272
jg 0x100421e8
test eax, eax
jb 0x10042272
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x10042272
jl 0x10042202
cmp dword [ebp - 0x1008], eax
ja 0x10042272
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x10042220
test ebx, ebx
je 0x10042259
cmp ecx, edi
jae 0x10042259
mov al, byte [ecx]
cmp al, 0xd
jne 0x1004223a
lea eax, [edi - 1]
cmp ecx, eax
jae 0x10042246
cmp byte [ecx + 1], 0xa
jne 0x10042246
inc ecx
jmp 0x10042246
movzx eax, al
movsx eax, byte [eax + 0x1006c480]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x10042220
cmp edx, ebx
jne 0x10042220
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x10042277
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1001f88e
leave
ret
Function at 0x10043105
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x1006efc0]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10043145
cmp byte [ebx], 0xa
jne 0x10043145
or byte [eax + edi + 0x28], 4
jmp 0x1004314a
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x10043248
mov al, byte [edx]
cmp al, 0x1a
je 0x1004322a
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x10043179
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x1004319e
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x100431a8
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x1004315b
jmp 0x10043248
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10043225
cmp dword [ebp - 0xc], 0
je 0x10043225
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x1006efc0]
test byte [eax + edi + 0x28], 0x48
je 0x100431ff
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x100431ea
mov byte [esi], dl
jmp 0x100431fb
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x1006efc0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10043248
cmp byte [ebp - 1], 0xa
jne 0x1004320e
cmp esi, ebx
jne 0x1004320e
mov byte [esi], 0xa
jmp 0x10043247
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10043d17
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10043248
mov byte [esi], 0xd
jmp 0x10043247
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x1006efc0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10043244
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10043248
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10043251
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x1006efc0]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10043294
cmp word [esi], dx
jne 0x10043294
or byte [edi + eax + 0x28], 4
jmp 0x10043299
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x100433ec
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x100433cc
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x100432db
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x10043311
cmp eax, edx
jae 0x1004331d
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x100432b3
jmp 0x100433ec
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100433c8
cmp dword [ebp - 0x14], 0
je 0x100433c8
mov eax, dword [ebx*4 + 0x1006efc0]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x100433a0
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x10043369
mov word [esi], cx
jmp 0x1004339c
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x1006efc0]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x1006efc0]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x1006efc0]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x100433ec
pop ebx
cmp word [ebp - 4], bx
jne 0x100433b1
cmp esi, dword [ebp + 0xc]
jne 0x100433b1
mov word [esi], bx
jmp 0x100433e9
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.10043d17
add esp, 0x10
cmp word [ebp - 4], bx
je 0x100433ec
push 0xd
jmp 0x100433e5
mov ecx, dword [ebx*4 + 0x1006efc0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x100433e3
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x100433ec
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret