joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a44ab
Capabilities:
Encode data using xor

Disassembly:
aad 0x72
adc dword [ecx + 0x3e], ebx
pop ecx
ljmp 0x74ad
jo 0x4a4521
movsb byte es:[edi], byte [esi]
mov ebp, dword [edx + 0x1258253c]
push ebx
adc dword [ebx + 6], ebp
cmc
outsd dx, dword [esi]
dec esp
pop edx
sub al, 0x11
js 0x4a449a
rcr byte [0xad9de3d0], 0xe8
rcl dword [eax - 0x2e]
push ebp
sub al, 0xfc
mov al, 0xbe
stosb byte es:[edi], al
push esp
dec edi
invalid
wait
outsb dx, byte [esi]
test al, 0xe1
push 0x4b003855
dec ecx
iretd
in al, dx
or dword [ecx - 0x7e5a40a5], 0xd99eddc1
jo 0x4a4529
fstp qword [esi + 0x4cfb70d9]
dec esp
and eax, ecx
out dx, al
adc al, 0x8d
movsb byte es:[edi], byte [esi]
cmp dword [esi - 0x677ba6d7], ebp
push ebx
or al, 0xbb
sal dh, cl
push edx
dec eax
loop 0x4a455c
mov cl, 0xb2
or cl, byte [ecx + edi*2]
arpl bx, bp
and dword [eax], 0x11
sbb ch, byte [ecx]
hlt
mov dword [bp + di], edx
stosd dword es:[edi], eax
xlatb
mov ebx, 0x5de2d03c
lodsb al, byte [esi]
cmc
sbb dword [ebp - 0x626adf6f], 0x5d686354
and byte [ebp + 0x6863549d], dl
pop ebp
jo 0x4a4501
xor dx, bx
cmp eax, 0xbcf95875
mov edi, 0x4030153c
dec ebp
insd dword es:[edi], dx
xchg dword [ebx], esi
jge 0x4a456b
xchg ebp, eax
movsd dword es:[edi], dword [esi]
sbb eax, 0xabef5c82
and edx, ebx
mov al, 0x2e
inc edx
aaa
and al, 9
fstp dword [ebx + 0x15]
sbb al, 0x31
push edi
loopne 0x4a4610
mov cl, 0x60
nop
xchg edi, eax
loope 0x4a45a7
cmp dh, byte [ebx]
test byte [eax - 0x2b4f2672], ch
aad 0x31
and al, 0x86
iretd
test al, 0x8e
fnstenv [eax + 0x2431d5d4]
xchg bh, cl
test al, 0xb8
jns 0x4a460f
sub byte es:[ecx + eax + 0x78caa07c], bl
adc ah, byte [ecx - 0x80]
ret 0x9452
aaa
or byte [eax - 0x76a7ca28], ch
push eax
retf

Function at 0x4a7d2b
Capabilities:
Encode data using xor

Disassembly:
imul esp, dword [ebx], 0x2c1908f0
mov ecx, 0x396b4923
adc al, 0x82
adc dword [edi], ecx
loopne 0x4a7daa
mov eax, dword [0x17be9f6a]
cdq
add dword [edi], ecx
aaa
mov dl, 0xf7
enter 0xffffffffffffa577, 0xffffffffffffffa9
dec byte [edi]
test eax, 0x670cfe66
inc ecx
sbb esp, eax
jb 0x4a7d4c
ror dword [eax], 1
xchg edx, eax
pop edx
aaa
xchg edx, eax
mov dword [0x67b3758c], eax
or bh, dl
or eax, esp
iretd
or ch, 6
das
sar cl, 0xc4
pop eax
pop ecx
or ebp, dword [ebx + 0x2ae82b46]
stc
and dword [edi + 0x10], 0xffffffd8
mov ecx, 0xdc560278
or al, 0xe6
xchg esi, eax
aad 0xf4
lea eax, [ebx + 0x42264510]
adc byte [ebp + 0x26], al
inc edx
dec ecx
pop esi
sbb byte [edx], 0xb4
xor ebp, dword [ecx]
push 0x1d17296f
xchg ecx, eax
scasd eax, dword es:[edi]
push cs
or dl, byte [ebp + 0x49617d6d]
imul ecx, dword [ebp - 0x34c111c5], 0x28b9d5f2
cdq
xchg ebx, eax
push ebx
sbb eax, 0x116160e9
xchg esi, eax
jge 0x4a7dca
inc edx
popal
sete al
lahf
imul ecx, dword [ecx + 0x7a], 0xa841ba03
add dword [ecx - 0x37], edx
aad 0x97
out dx, al
sub byte [ecx + 0x79], dl
in eax, dx
mov edx, 0x5c12b0fe
mov al, 0xfb
add dh, al
mov ebp, 0xc092fd6e
xor al, 0x89
or cl, byte [esi]
pop ecx
salc
cli
enter 0xffffffffffff8a8b, 0x70
out 0x6f, eax
and al, 0x94
mov cl, bl
dec eax
test eax, 0x31ed20c6
mov esi, 0x367c4606
sub byte [esi], bl
push ebp
invalid
Function at 0x518fc2
Capabilities:
Encode data using xor

Disassembly:
outsb dx, byte [esi]
jbe 0x518f11
ret
or dword [edi], ecx
shr dword [esi + 0x63], 1
sbb al, bh
jmp [edx]
sbb eax, 0xad2b00d6
mov eax, dword [0x442f7bee]
jnp 0x518f74
inc esp
scasd eax, dword es:[edi]
cdq
scasd eax, dword es:[edi]
pop edi
pop esp
inc ebp
sbb byte [ebp - 0x44feb1cf], ch
out dx, al
cdq
or dl, bh
xor al, 0xb7
cmp edx, dword [edi + 0x14]
cmc
push edi
adc al, 0xf5
mov esp, dword [esi + 0x64899cb9]
jne 0x518ef3
inc ecx
sub dword [edi + 0x90c07af], esi
in eax, dx
je 0x518f3c
sbb byte [eax], dh
jge 0x518f43
into
ret 0x263b
sub esi, dword [ebx + esi*4]
adc byte [eax - 0x62], bh
sub dword [esi + ebx*4 + 0x38], 0xd22e2813
push ebx
lcall 0x6a22, 0xde30bd4
shl dword [ebp + eax + 0x528fe8b6], 1
fcomp qword ds:[edi - 0x411196ca]
inc ebx
mov cl, 0x5f
salc
push edi
and byte [ebp + 7], ah
mov esp, 0x13cc1f97
sub eax, 0xd149be6
rcr byte [0x66b83bc1], 0xc5
cmp al, 0xa0
lds esp, [esp + edi - 0x60]
push esp
push cs
pushfd
or byte [ecx + 0x7947660], 0x4c
sbb esp, dword ds:[edx - 0x39311aa1]
jg 0x518f5b
cmp eax, 0x8edb0dd1
dec esi
lodsd eax, dword [esi]
mov edx, 0x94368e54
jo 0x518f7e
adc byte [esi], 0x43
xor byte [edx], ah
rol dword [ecx], cl
jecxz 0x518fbb
js 0x518fbf
sbb byte [edx], ch
and dl, byte [eax + 0x12]
popfd
scasd eax, dword es:[edi]
lsl eax, word [edi]
push es
fdiv dword [esi + 0x11]
in al, dx
mov byte [0x85a6d60a], al
inc eax
lahf
movsd dword es:[edi], dword [esi]
daa
fadd st(1), st(0)
call 0xcfda6a7b
sub esp, edx
pop ss
fmul qword [edi + esi*8 + 0x6d96c184]
mov bl, 0xf
aad 0xce
aaa
popal
aaa
mov dh, 0x80
jbe 0x518ff7
sub dword [ebp + edx*2 + 0x6c], edi
stc
mov bh, 0x66
pop ss
jbe 0x519098
mov ch, 0x7d
invalid
test ebp, 0x9fab3ae3
add dword [ebx], 0xffffffa2
jg 0x51908f
outsb dx, byte [esi]
inc ecx
dec edx
xchg edi, eax
add dword [ecx + 0x71593277], 0x9724bb90
outsb dx, byte [esi]
int1
sub al, 0xce
sbb byte [edi], bl
xlatb
jbe 0x519069
push eax
out dx, al
in eax, 0xf3
iretd
Function at 0x578754
Capabilities:
Encode data using xor

Disassembly:
or bh, byte [ebx]
dec esi
or bh, ch
js 0x57878f
mov ecx, 0x7f838985
pop esi
mov ch, 5
dec ecx
sal bl, 1
imul ebp, esi, 0x13
xchg ecx, eax
add eax, dword [eax - 0x78517c2]
mov eax, 0xf1b44648
jae 0x5787dc
or byte [eax], cl
retf
clc
fisttp qword [ebx + 0x4fa83955]
cmp ah, byte [0xcde1fbd8]
loop 0x5787c3
sti
mov ecx, 0xa924d7d9
dec esp
or dword [eax + 0x505b58a5], esi
call ecx
pop ebp
mov cl, 0x25
pop edx
adc cl, byte [edx - 0x59cebda5]
sub ebx, dword [ebp - 0x6f557eb0]
pop eax
mov esp, 0x2d4e722b
iretd
jbe 0x578859
aad 0x48
adc al, 0x2b
push ebp
push edi
pop ebp
cli
inc edx
lea esi, [eax + eax + 0x2e471d0c]
mov al, byte [0x15985bb5]
adc eax, 0x266e6171
leave
lcall 0x4652, 0xe79b179a
cmpsb byte [esi], byte es:[edi]
mov byte [0x2d4fcab9], al
mov dl, 0x48
sbb byte [edx - 0x7f27aaf2], ah
imul edi, dword [0xc27f406f], 0x96abb825
xor eax, 0x58338eaf
cmpsb byte [esi], byte es:[edi]
dec eax
or byte [ebp - 0x2c0e34aa], al
inc ebp
dec eax
aaa
push ds
cmp ebp, 0x2126ca4
mov edi, 0xfb732519
sub al, 0xa0
test eax, 0xa0ae59d7
jge 0x578807
out dx, al
imul ecx, esp, 0x346ffb72
cmp dword [ecx], edx
sub ebp, eax
push ecx
pop edx
dec esi
cmp byte [ebx + 0x54], cl
in al, dx
mov bh, 0x92
and eax, 0x1ab40d99
sub dword [ecx + 0x1c], edx
jle 0x5788a1
sbb al, 0x7e
inc ebp
jno 0x578850
out 0x6e, eax
imul ebp, dword [ecx + 4], 0xad916100
in al, dx
push ebp
clc
push esp
invalid
jmp 0xfa401827

Function at 0x5f6dce
Capabilities:
Encode data using xor

Disassembly:
lahf
and dword [ebx], ebx
xor edx, dword [ecx + 0x10]
mov edx, 0xb92727d6
invalid
mov eax, dword [ebx]
xchg esp, eax
dec ebx
xchg edi, eax
add eax, 0xb34abdfb
ficomp dword [ebp - 0x5c]
xchg edx, eax
pop esp
aas
inc ebp
loop 0x5f6df4
jb 0x5f6d8a
aaa
push edx
ret
fisubr dword [eax]
leave
or ebx, ebx
test eax, 0xbffb98a9
cli
and eax, 0x6e1b65bc
pushfd
mov dl, 0x45
pop ecx
push ds
mov eax, 0x35dc226a
jp 0x5f6e63
cmp al, 0xf9
mov edx, 0x3fb27ffe
int3
mov dword [0xa648ac5b], eax
dec edi
mov dl, 0x47
and edi, dword [ecx - 0x69]
retf 0x52f3

Function at 0x617d95
Capabilities:
Encode data using xor

Disassembly:
out dx, al
push 0xfffffffffffffff3
jno 0x617da5
adc dword [eax - 0x5f8bc757], eax
push ss
ljmp 0xb126
push ss
add dword [ecx + 0x6c76c566], edx
jg 0x617d7e
push es
hlt
sti
aad 0x18
mov esi, 0x3c6ef21d
inc esi
rcl ebx, 0x8c
invalid
Function at 0x401fe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x70
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, esp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x4027d0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
add eax, dword [ecx + 0x3c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x78]
add eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov word [ebp - 0x42], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x30]
jae 0x40217f
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x50]
mov dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0x68]
mov dword [esp], eax
call fcn.00402830
sub esp, 4
cmp dword [ebp + 8], 0
jbe 0x402144
cmp dword [ebp + 0xc], 3
jbe 0x402144
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], 0
mov eax, esp
lea ecx, [ebp - 0x68]
mov dword [eax], ecx
mov dword [eax + 4], 0x14d
call fcn.00401e50
mov dword [ebp - 0x74], eax
jmp 0x4020e3
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x40213f
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp + 0xc]
jne 0x40213a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 0x24]
mov ecx, dword [ebp - 0x48]
shl ecx, 1
add eax, ecx
mov ax, word [eax]
mov word [ebp - 0x42], ax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 0x1c]
movzx ecx, word [ebp - 0x42]
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x70], 2
jmp 0x402154
jmp 0x40213f
jmp 0x402144
mov eax, dword [ebp - 0x2c]
add eax, 4
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x70], 0
lea ecx, [ebp - 0x68]
call fcn.004028f0
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x402171
jmp 0x40216c
jmp 0x40217f
mov eax, dword [ebp - 0x4c]
add eax, 1
mov dword [ebp - 0x4c], eax
jmp 0x402078
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x38]
add eax, ecx
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x70
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4021c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x466e00], eax
pop esi
pop edi
pop ebp
ret
Function at 0x406232
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x406271
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x406271
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x406271
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x406271
cmp dword [ecx + 0x74], 0xe
jbe 0x406271
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x407e98
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x407eb9
jl 0x407eb0
test edi, edi
jne 0x407eb9
xor eax, eax
xor edx, edx
jmp 0x407f7a
cmp dword [ebx + 0x38], 0
je 0x407ece
push eax
push edi
push dword [ebp + 8]
call fcn.00407f80
jmp 0x407f7a
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x407f15
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x407f15
cmp eax, edi
jb 0x407eef
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00409150
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x407f1b
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x407f6f
mov ecx, ebx
call fcn.00407584
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x407f5a
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.00410095
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x407f6f
jmp 0x407f2d
test edx, edx
je 0x407f6f
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00410095
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x413e15
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x413eb2
push ebx
push esi
call fcn.00413dde
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00413d27
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x413e5f
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x413eb1
push edi
push eax
call fcn.00412b7b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x413e7f
call fcn.00412bc9
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x413eb0
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00413d27
add esp, 0x20
test eax, eax
jne 0x413e9e
push edi
call fcn.00412bc9
jmp 0x413ea6
push ebx
call fcn.00412bc9
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4146de
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4238c0
push 0x4238b8
push str.FlsAlloc
push 0x1e
call fcn.0041454b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x414712
push dword [ebp + 8]
mov ecx, esi
call dword [0x420160]
call esi
jmp 0x414718
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41475c
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4238d0
push 0x4238c8
push str.FlsGetValue
push 0x20
call fcn.0041454b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x414793
push dword [ebp + 8]
mov ecx, esi
call dword [0x420160]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x418d96
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00418c07

Function at 0x419190
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0041f6c0
mov eax, dword [0x42e174]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00417dfc
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4191d2
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41932e
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0041f6f0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x42fb40]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0041a187
mov ecx, dword [esi*4 + 0x42fb40]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x419327
cmp eax, dword [edi + ecx + 0x24]
jne 0x419327
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x419327
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041a187
add esp, 0x14
test edx, edx
jl 0x419327
jg 0x41929d
test eax, eax
jb 0x419327
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x419327
jl 0x4192b7
cmp dword [ebp - 0x1008], eax
ja 0x419327
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4192d5
test ebx, ebx
je 0x41930e
cmp ecx, edi
jae 0x41930e
mov al, byte [ecx]
cmp al, 0xd
jne 0x4192ef
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4192fb
cmp byte [ecx + 1], 0xa
jne 0x4192fb
inc ecx
jmp 0x4192fb
movzx eax, al
movsx eax, byte [eax + 0x42e900]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4192d5
cmp edx, ebx
jne 0x4192d5
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x41932c
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040667c
leave
ret
Function at 0x419625
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x42fb40]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x419665
cmp byte [ebx], 0xa
jne 0x419665
or byte [eax + edi + 0x28], 4
jmp 0x41966a
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x419768
mov al, byte [edx]
cmp al, 0x1a
je 0x41974a
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x419699
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4196be
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x4196c8
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x41967b
jmp 0x419768
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x419745
cmp dword [ebp - 0xc], 0
je 0x419745
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x42fb40]
test byte [eax + edi + 0x28], 0x48
je 0x41971f
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x41970a
mov byte [esi], dl
jmp 0x41971b
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x42fb40]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x419768
cmp byte [ebp - 1], 0xa
jne 0x41972e
cmp esi, ebx
jne 0x41972e
mov byte [esi], 0xa
jmp 0x419767
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041a1a5
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x419768
mov byte [esi], 0xd
jmp 0x419767
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x42fb40]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x419764
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x419768
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x419771
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x42fb40]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4197b4
cmp word [esi], dx
jne 0x4197b4
or byte [edi + eax + 0x28], 4
jmp 0x4197b9
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x41990c
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4198ec
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4197fb
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x419831
cmp eax, edx
jae 0x41983d
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4197d3
jmp 0x41990c
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4198e8
cmp dword [ebp - 0x14], 0
je 0x4198e8
mov eax, dword [ebx*4 + 0x42fb40]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4198c0
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x419889
mov word [esi], cx
jmp 0x4198bc
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x42fb40]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x42fb40]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x42fb40]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x41990c
pop ebx
cmp word [ebp - 4], bx
jne 0x4198d1
cmp esi, dword [ebp + 0xc]
jne 0x4198d1
mov word [esi], bx
jmp 0x419909
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041a1a5
add esp, 0x10
cmp word [ebp - 4], bx
je 0x41990c
push 0xd
jmp 0x419905
mov ecx, dword [ebx*4 + 0x42fb40]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x419903
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41990c
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41f680
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f6ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f6ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret