joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404a83
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x404ad6
cmp dword [ebp + 0xc], edi
je 0x404ad6
mov ebx, dword [ebp + 0x10]
cmp ebx, edi
je 0x404ad6
push edi
push edi
push 3
push edi
push 3
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x404ad6
push edi
lea eax, [ebp + 8]
push eax
push dword [ebx]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x404ad8
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x404b29
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push esi
push 0x44
xor esi, esi
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.00406ca0
push 0x10
lea eax, [ebp - 0x10]
push esi
push eax
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 0x81
mov word [ebp - 0x24], 5
call fcn.00406ca0
push dword [ebp + 8]
lea eax, [ebp - 0x158]
push eax
call fcn.00407170
add esp, 0x20
cmp dword [ebp + 0xc], esi
je 0x404b9b
lea eax, [ebp - 0x158]
push 0x40e2c8
push eax
call fcn.00407180
push dword [ebp + 0xc]
lea eax, [ebp - 0x158]
push eax
call fcn.00407180
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x158]
push esi
push esi
push 1
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x404bc1
inc eax
jmp 0x404bd3
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
xor eax, eax
pop esi
leave
ret

Function at 0x404d0d
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push edi
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x404d67
push ebx
push esi
mov esi, dword [esp + 0x14]
movzx edx, byte [esi]
mov ecx, eax
and ecx, 0xf
movzx ecx, word [ecx*4 + 0x417a48]
shr ax, 4
mov ebx, edx
and ebx, 0xf
xor cx, word [ebx*4 + 0x417a48]
shr edx, 4
xor ecx, eax
mov eax, ecx
and eax, 0xf
movzx eax, word [eax*4 + 0x417a48]
xor ax, word [edx*4 + 0x417a48]
shr cx, 4
xor eax, ecx
inc esi
dec edi
jne 0x404d20
pop esi
pop ebx
pop edi
ret

Function at 0x404daf
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
push 0x100
lea eax, [ebp - 0x100]
push eax
xor esi, esi
call sub.WS2_32.dll_gethostname
test eax, eax
jne 0x404de7
lea eax, [ebp - 0x100]
push eax
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x404de7
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov esi, dword [eax]
mov eax, esi
pop esi
leave
ret

Function at 0x404dec
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x404e13
call fcn.00404daf
test eax, eax
je 0x404e13
cmp eax, 0x100007f
je 0x404e13
xor eax, eax
inc eax
pop ecx
ret
xor eax, eax
pop ecx
ret
Function at 0x405766
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
mov edi, eax
xor ebx, ebx
cmp dword [edi + 0x14], ebx
jle 0x40579a
lea eax, [ebp - 4]
push eax
mov eax, dword [edi + 0x10]
push dword [eax + ebx*4]
call fcn.0040565a
mov esi, eax
test esi, esi
pop ecx
pop ecx
jne 0x4057a9
inc ebx
cmp ebx, dword [edi + 0x14]
jl 0x40577b
jmp 0x40579d
mov esi, dword [ebp - 4]
test esi, esi
jne 0x4057a9
mov eax, dword [ebp - 4]
jmp 0x40585e
xor ebx, ebx
xor edi, edi
cmp dword [esi + 0x24], ebx
mov dword [ebp - 4], ebx
jle 0x40584e
push 0x207
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 4]
push esi
call fcn.00401868
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 4]
push esi
call fcn.004017a5
add esp, 0x1c
test eax, eax
jne 0x405839
mov eax, dword [esi + 0x1c]
test byte [ebx + eax + 0x210], 1
je 0x40581f
push 0
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00404b29
mov edi, eax
add esp, 0xc
test edi, edi
je 0x40581f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
and edi, 0xffff
or edi, 0x80080000
mov eax, dword [esi + 0x1c]
test byte [ebx + eax + 0x210], 2
je 0x405839
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add ebx, 0x21c
cmp eax, dword [esi + 0x24]
jl 0x4057b9
push esi
call fcn.004014c2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x405863
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push edi
push 0x406
call fcn.004069a3
xor edi, edi
cmp eax, edi
pop ecx
mov dword [ebp - 4], eax
je 0x405893
push 0x407
call fcn.004069a3
cmp eax, edi
pop ecx
mov dword [ebp - 8], eax
jne 0x4058a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0xffff
or eax, 0x800a0000
jmp 0x405991
push esi
lea eax, [ebp - 0x314]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call fcn.00404be2
movzx eax, ax
push 0x64
pop ecx
cdq
idiv ecx
lea eax, [ebp - 0x210]
push edx
push dword [ebp - 8]
push eax
call fcn.004078f8
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00407170
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00407180
lea eax, [ebp - 0x10c]
push eax
call fcn.00404a1f
add esp, 0x20
test eax, eax
jne 0x4058bc
push esi
lea eax, [ebp - 0x418]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push edi
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
pop esi
jne 0x405952
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
and edi, 0xffff
or edi, 0x80090000
jmp 0x40597d
push edi
push dword [ebp - 4]
lea eax, [ebp - 0x10c]
push eax
call fcn.00404b29
add esp, 0xc
test eax, eax
je 0x40597d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
and edi, 0xffff
or edi, 0x80080000
push dword [ebp - 4]
call fcn.004069cc
push dword [ebp - 8]
call fcn.004069cc
pop ecx
pop ecx
mov eax, edi
pop edi
leave
ret
Function at 0x405efb
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
cmp dword [ebp + 8], 0
je 0x405f20
push 0x103
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x405f24
xor eax, eax
leave
ret
lea eax, [ebp - 0x104]
push eax
push eax
call fcn.00407270
pop ecx
push eax
push 7
call fcn.00405ca8
push eax
push dword [ebp + 8]
call fcn.00405b90
add esp, 0x14
leave
ret

Function at 0x405f48
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x405f5d
xor eax, eax
jmp 0x405f9e
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x104]
push eax
mov dword [ebp + 8], 0x103
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x405f9b
lea eax, [ebp - 0x104]
push eax
push eax
call fcn.00407270
pop ecx
push eax
push 8
call fcn.00405ca8
push eax
push esi
call fcn.00405b90
add esp, 0x14
jmp 0x405f9e
mov eax, dword [esi + 4]
pop esi
leave
ret

Function at 0x40601e
Capabilities:
Get networking parameters

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
cmp dword [ebp + 8], 0
je 0x40607d
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24c]
push eax
mov dword [ebp - 4], 0x248
call sub.iphlpapi.dll_GetNetworkParams
test eax, eax
jne 0x40607d
lea eax, [ebp - 0x1c8]
push eax
call fcn.00407270
test eax, eax
pop ecx
jbe 0x40607d
lea eax, [ebp - 0x1c8]
push eax
push eax
call fcn.00407270
pop ecx
push eax
push 9
call fcn.00405ca8
push eax
push dword [ebp + 8]
call fcn.00405b90
add esp, 0x14
leave
ret
xor eax, eax
leave
ret
Function at 0x4060d3
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4060e8
xor eax, eax
jmp 0x406215
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
jne 0x406212
push esi
push dword [ebp - 4]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
mov dword [ebp - 0xc], esi
je 0x406211
lea eax, [ebp - 4]
push eax
push esi
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
je 0x406133
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x406211
push edi
push 8
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00406ca0
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x19c]
call fcn.00405bb0
add esp, 0x14
call fcn.004018c8
mov edi, eax
test edi, edi
je 0x406207
push 6
lea eax, [esi + 0x194]
push eax
push edi
call fcn.00401908
add esp, 0xc
lea eax, [esi + 0x1b0]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 8], eax
push 4
lea eax, [ebp - 8]
push eax
push edi
call fcn.00401908
xor eax, eax
mov al, byte [esi + 0x1a0]
push eax
push edi
call fcn.004019a2
push dword [ebp - 0x14]
push edi
call fcn.004019a2
push dword [ebp - 0x10]
push edi
call fcn.004019a2
xor eax, eax
mov al, byte [esi + 0x1a4]
push eax
push edi
call fcn.004019a2
lea ebx, [esi + 0x10c]
push ebx
call fcn.00407270
inc eax
push eax
push ebx
push edi
call fcn.00401908
push dword [edi]
push dword [edi + 4]
push 0x41
call fcn.00405ca8
add esp, 0x48
test eax, eax
je 0x4061f3
push eax
push dword [ebp + 8]
call fcn.00405b90
pop ecx
pop ecx
push edi
call fcn.004018de
mov esi, dword [esi]
test esi, esi
mov ebx, dword [ebp + 8]
pop ecx
jne 0x406134
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
mov eax, dword [ebx + 4]
pop ebx
leave
ret

Function at 0x406389
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
mov esi, 0x104
push esi
call fcn.004069a3
mov edi, eax
test edi, edi
pop ecx
je 0x4063e1
push esi
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x104]
push 0x40e28c
push eax
call fcn.00407180
lea eax, [ebp - 0x104]
push edi
push eax
call fcn.00407180
lea eax, [ebp - 0x104]
push eax
call fcn.00404d98
add esp, 0x14
pop edi
pop esi
leave
ret
Function at 0x406669
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
call fcn.00404bd6
call fcn.00406957
call fcn.004050d0
test eax, eax
mov dword [0x418a38], eax
jne 0x40669d
or eax, 0xffffffff
jmp 0x40672b
push edi
call fcn.00406389
mov edi, eax
test edi, edi
jne 0x4066ae
or eax, 0xffffffff
jmp 0x40672a
push esi
push edi
call fcn.00404a1f
test eax, eax
pop ecx
je 0x4066ce
push edi
push dword [0x418a38]
call fcn.0040548e
mov esi, eax
test esi, esi
pop ecx
pop ecx
jge 0x4066f5
push dword [0x418a38]
call fcn.004050fa
push dword [0x418a38]
call fcn.004052e4
push edi
push dword [0x418a38]
mov esi, eax
call fcn.0040532c
add esp, 0x10
push edi
call fcn.004069cc
test esi, esi
pop ecx
je 0x406705
or eax, 0xffffffff
jmp 0x406729
call fcn.00405b47
test eax, eax
mov dword [0x418a3c], eax
jne 0x406716
or esi, 0xffffffff
call fcn.00404f63
test eax, eax
mov dword [0x418a40], eax
jne 0x406727
or esi, 0xffffffff
mov eax, esi
pop esi
pop edi
add esp, 0x190
ret
Function at 0x406aec
Capabilities:
Create process on windows
Get common file path
Resume thread
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74c
push ebx
push esi
push 0x404
call fcn.004069a3
mov ebx, eax
xor esi, esi
cmp ebx, esi
pop ecx
jne 0x406b11
xor eax, eax
jmp 0x406c78
push edi
lea eax, [ebp - 0x364]
push eax
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x364]
push ebx
push eax
call fcn.00407180
push ebx
call fcn.004069cc
lea eax, [ebp - 0x364]
push eax
lea eax, [ebp - 0x15c]
push eax
call fcn.00407170
add esp, 0x14
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x406c75
push edi
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x405
call fcn.004069a3
mov edi, eax
cmp edi, esi
pop ecx
je 0x406c75
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x260]
push eax
push eax
lea eax, [ebp - 0x74c]
push edi
push eax
call fcn.004078f8
push edi
call fcn.004069cc
add esp, 0x18
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x74c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x74c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call edi
push 0x44
pop ebx
push ebx
lea eax, [ebp - 0x58]
push esi
push eax
call fcn.00406ca0
push 0x10
lea eax, [ebp - 0x10]
push esi
push eax
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x2c], 1
mov word [ebp - 0x28], si
call fcn.00406ca0
add esp, 0x18
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push ebx
push esi
push esi
push esi
lea eax, [ebp - 0x15c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x406c75
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0xfffffffffffffff1
push dword [ebp - 0xc]
call esi
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0xc]
call edi
push dword [ebp - 0x10]
call edi
xor eax, eax
inc eax
jmp 0x406c77
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407b24
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x40e330
call fcn.00408a0c
mov edi, 0x94
mov eax, edi
call fcn.00407300
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x418bd4], ecx
mov eax, dword [esi + 4]
mov dword [0x418be0], eax
mov edx, dword [esi + 8]
mov dword [0x418be4], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x418bd8], esi
cmp ecx, 2
je 0x407b84
or esi, 0x8000
mov dword [0x418bd8], esi
shl eax, 8
add eax, edx
mov dword [0x418bdc], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x407bbf
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x407bbf
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x407bd7
cmp eax, 0x20b
je 0x407bc4
mov dword [ebp - 0x1c], esi
jmp 0x407beb
cmp dword [ecx + 0x84], 0xe
jbe 0x407bbf
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x407be5
cmp dword [ecx + 0x74], 0xe
jbe 0x407bbf
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.00407e97
pop ecx
test eax, eax
jne 0x407bff
push 0x1c
call fcn.00407b00
pop ecx
call fcn.00409f49
test eax, eax
jne 0x407c10
push 0x10
call fcn.00407b00
pop ecx
call fcn.0040b293
mov dword [ebp - 4], esi
call fcn.0040980b
test eax, eax
jge 0x407c29
push 0x1b
call fcn.00407adb
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x41a2e8], eax
call fcn.0040b171
mov dword [0x418a48], eax
call fcn.0040b0cf
test eax, eax
jge 0x407c4f
push 8
call fcn.00407adb
pop ecx
call fcn.0040ae9c
test eax, eax
jge 0x407c60
push 9
call fcn.00407adb
pop ecx
push 1
call fcn.0040a9be
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x407c76
push eax
call fcn.00407adb
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0040ae3f
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x407c97
movzx eax, word [ebp - 0x40]
jmp 0x407c9a
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00401413
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x407cb8
push edi
call fcn.0040aaeb
call fcn.0040ab0d
jmp 0x407cea
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00408a47
ret
Function at 0x4090a8
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x4186b0]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x4090d9
xor eax, eax
jmp 0x409262
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x4191a0]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x409115
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.0040bf55
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x4091f0
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x40922e
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x409179
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x40916a
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x40914a
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4091b9
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x4091c2
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x40913b
jmp 0x4091c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x40925d
cmp dword [ebp - 0x6c], edi
je 0x40922e
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x409223
call fcn.00409489
mov dword [eax], 9
call fcn.00409492
mov dword [eax], esi
jmp 0x409258
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x409218
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x4091c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x4091c4
push dword [ebp - 0x6c]
call fcn.0040949b
pop ecx
jmp 0x409258
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x409246
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x409246
xor eax, eax
jmp 0x409260
call fcn.00409489
mov dword [eax], 0x1c
call fcn.00409492
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x409260
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.0040c009
add ebp, 0x3a0
leave
ret
Function at 0x409630
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x409804
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x4191a0]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x409804
test cl, 0x48
je 0x40969b
cmp byte [eax + 5], 0xa
je 0x40969b
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4096ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x4096d5
call fcn.00409489
mov dword [eax], 9
call fcn.00409492
mov dword [eax], esi
jmp 0x4096e5
cmp eax, 0x6d
je 0x409804
push eax
call fcn.0040949b
pop ecx
or eax, 0xffffffff
jmp 0x409806
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x4097ff
test eax, eax
je 0x409714
cmp byte [ebx], 0xa
jne 0x409714
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x40971d
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x4097f9
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x4097e9
cmp al, 0xd
je 0x40974f
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x4097db
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x409769
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x409764
add dword [ebp + 0x10], 2
jmp 0x4097bd
mov dword [ebp + 0x10], eax
jmp 0x4097d7
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x409791
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4097d7
cmp dword [ebp - 0xc], 0
je 0x4097d7
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x4097b2
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x4097bd
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x4097da
cmp ebx, dword [ebp + 0xc]
jne 0x4097c2
cmp byte [ebp - 1], 0xa
jne 0x4097c2
mov byte [ebx], 0xa
jmp 0x4097da
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00409a09
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x4097db
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x409733
jmp 0x4097f9
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x4097f9
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x409806
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret