joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100246c0
Capabilities:
Parse pe header

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
mov bl, byte [edi]
test bl, bl
je 0x10024786
lea ebx, [ebx]
mov cl, byte [ebp]
test cl, cl
je 0x10024786
test esi, esi
je 0x1002478a
movsx eax, bl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x100246fe
jmp dword [eax*4 + 0x100247bc]
mov bl, 0x41
jmp case.default.0x100246fe
mov bl, 0x42
jmp case.default.0x100246fe
mov bl, 0x43
jmp case.default.0x100246fe
mov bl, 0x44
jmp case.default.0x100246fe
mov bl, 0x45
jmp case.default.0x100246fe
mov bl, 0x46
jmp case.default.0x100246fe
mov bl, 0x47
jmp case.default.0x100246fe
mov bl, 0x48
jmp case.default.0x100246fe
mov bl, 0x49
jmp case.default.0x100246fe
mov bl, 0x4a
jmp case.default.0x100246fe
mov bl, 0x4b
jmp case.default.0x100246fe
mov bl, 0x4c
jmp case.default.0x100246fe
mov bl, 0x4d
jmp case.default.0x100246fe
mov bl, 0x4e
jmp case.default.0x100246fe
mov bl, 0x4f
jmp case.default.0x100246fe
mov bl, 0x50
jmp case.default.0x100246fe
mov bl, 0x51
jmp case.default.0x100246fe
mov bl, 0x52
jmp case.default.0x100246fe
mov bl, 0x53
jmp case.default.0x100246fe
mov bl, 0x54
jmp case.default.0x100246fe
mov bl, 0x55
jmp case.default.0x100246fe
mov bl, 0x56
jmp case.default.0x100246fe
mov bl, 0x57
jmp case.default.0x100246fe
mov bl, 0x58
jmp case.default.0x100246fe
mov bl, 0x59
jmp case.default.0x100246fe
mov bl, 0x5a
push ecx
call fcn.10024830
add esp, 4
cmp bl, al
jne 0x10024786
mov bl, byte [edi + 1]
inc edi
dec esi
inc ebp
test bl, bl
jne 0x100246e0
test esi, esi
jne 0x10024794
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
movzx eax, byte [edi]
push eax
call fcn.10024830
movzx ecx, byte [ebp]
mov bl, al
push ecx
call fcn.10024830
add esp, 8
xor ecx, ecx
cmp bl, al
sete cl
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
ret

Function at 0x10024830
Capabilities:
Parse pe header

Disassembly:
mov cl, byte [esp + 4]
movsx eax, cl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x1002483f
jmp dword [eax*4 + 0x10024898]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret
mov al, cl
ret
Function at 0x10024900
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, dword [esp + 0x10]
cmp esi, 1
jb 0x100249ac
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
sub edi, edx
lea esp, [esp]
mov cl, byte [edx]
movsx eax, cl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x1002492d
jmp dword [eax*4 + 0x100249b0]
mov cl, 0x41
jmp case.default.0x1002492d
mov cl, 0x42
jmp case.default.0x1002492d
mov cl, 0x43
jmp case.default.0x1002492d
mov cl, 0x44
jmp case.default.0x1002492d
mov cl, 0x45
jmp case.default.0x1002492d
mov cl, 0x46
jmp case.default.0x1002492d
mov cl, 0x47
jmp case.default.0x1002492d
mov cl, 0x48
jmp case.default.0x1002492d
mov cl, 0x49
jmp case.default.0x1002492d
mov cl, 0x4a
jmp case.default.0x1002492d
mov cl, 0x4b
jmp case.default.0x1002492d
mov cl, 0x4c
jmp case.default.0x1002492d
mov cl, 0x4d
jmp case.default.0x1002492d
mov cl, 0x4e
jmp case.default.0x1002492d
mov cl, 0x4f
jmp case.default.0x1002492d
mov cl, 0x50
jmp case.default.0x1002492d
mov cl, 0x51
jmp case.default.0x1002492d
mov cl, 0x52
jmp case.default.0x1002492d
mov cl, 0x53
jmp case.default.0x1002492d
mov cl, 0x54
jmp case.default.0x1002492d
mov cl, 0x55
jmp case.default.0x1002492d
mov cl, 0x56
jmp case.default.0x1002492d
mov cl, 0x57
jmp case.default.0x1002492d
mov cl, 0x58
jmp case.default.0x1002492d
mov cl, 0x59
jmp case.default.0x1002492d
mov cl, 0x5a
mov byte [edi + edx], cl
mov al, byte [edx]
inc edx
test al, al
je 0x100249ab
dec esi
jne 0x10024920
pop edi
pop esi
ret
Function at 0x1002a410
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push dword [esp + 0x108]
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x1002a459
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x1002a459
lea eax, [esp]
push eax
call dword [0x1003e1f0]
add esp, 4
add esp, 0x104
ret
xor eax, eax
add esp, 0x104
ret
Function at 0x1002f2a0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebp
xor ebp, ebp
mov dword [esp + 4], ebp
mov dword [eax], ebp
lea eax, [esp + 8]
push eax
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.DLL_getaddrinfo]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x1002f433
push ebx
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x1002f41d
push esi
mov eax, dword [edi + 4]
cmp eax, 2
jne 0x1002f2ef
lea ebx, [eax + 0xe]
jmp 0x1002f2fb
cmp eax, 0x17
jne 0x1002f3aa
lea ebx, [eax + 5]
cmp dword [edi + 0x18], 0
je 0x1002f3aa
mov eax, dword [edi + 0x10]
test eax, eax
je 0x1002f3aa
cmp eax, ebx
jb 0x1002f3aa
push 0x20
call dword [0x1003e1e4]
mov esi, eax
add esp, 4
test esi, esi
je 0x1002f412
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
call dword [0x1003e1e4]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x1002f401
push ebx
push dword [edi + 0x18]
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [edi + 0x14]
add esp, 0xc
test eax, eax
je 0x1002f395
push eax
call dword [0x1003e1f0]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x1002f3e7
test ebp, ebp
jne 0x1002f39b
mov ebp, esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1002f3a6
mov dword [eax + 0x1c], esi
mov dword [esp + 0x10], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x1002f2e2
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
pop esi
test eax, eax
je 0x1002f3c9
push eax
call dword [sym.imp.WS2_32.DLL_freeaddrinfo]
test ebx, ebx
je 0x1002f419
push ebp
call fcn.1002f260
mov eax, dword [esp + 0x2c]
add esp, 4
xor ebp, ebp
mov dword [eax], ebp
mov eax, ebx
pop edi
pop ebx
pop ebp
add esp, 0xc
ret
push dword [esi + 0x18]
mov ebx, 8
call dword [0x1003e1e8]
push esi
call dword [0x1003e1e8]
add esp, 8
jmp 0x1002f3b9
push esi
mov ebx, 8
call dword [0x1003e1e8]
add esp, 4
jmp 0x1002f3b9
mov ebx, 8
jmp 0x1002f3b9
test ebp, ebp
jne 0x1002f429
mov ebx, 0x2af9
push ebx
call dword [sym.imp.WSOCK32.DLL_WSASetLastError]
mov eax, dword [esp + 0x28]
pop edi
mov dword [eax], ebp
mov eax, ebx
pop ebx
pop ebp
add esp, 0xc
ret

Function at 0x1002f880
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x264], 2
je fcn.1002f830
mov al, 1
ret
Function at 0x100352cb
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov edi, ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
mov esi, 0x100400b8
cmp dword [0x100400b4], edi
jne 0x100352fa
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x100400b4], 1
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x100400b0]
test esi, esi
je 0x10035355
test edi, edi
jne 0x1003549c
xor eax, eax
lea ecx, [esi + 0x114]
inc eax
cmp ebx, dword [ecx]
je 0x1003532b
inc eax
add ecx, 4
cmp eax, 0x40
jl 0x1003531c
jmp 0x10035347
push dword [esp + 0x1c]
add eax, 0x84
push dword [esp + 0x1c]
lea eax, [esi + eax*4]
push eax
call fcn.10035274
xor edi, edi
add esp, 0xc
inc edi
mov esi, dword [esi]
test esi, esi
jne 0x1003530b
test edi, edi
jne 0x1003549c
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [esp + 0x10]
push ebp
push ebp
push 0x100000
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1003549c
mov esi, dword [0x100400b0]
jmp 0x10035396
cmp dword [esi + 0xc], 0x3f
jl 0x10035437
mov esi, dword [esi]
test esi, esi
jne 0x1003538a
push 0x310
push 8
push dword [0x1003fab8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
test esi, esi
je 0x10035496
push ebp
push 1
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [esi + 8], eax
test eax, eax
je 0x10035488
push ebp
push ebp
push esi
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x1c]
push 0x100354af
mov dword [esi + 0x114], ebx
lea ebx, [esi + 0x214]
push 0x1000
mov dword [esi + 0x14], eax
mov dword [ebx], ebp
push ebp
mov dword [esi + 0xc], 2
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10035483
push eax
call edi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push ebx
call fcn.10035274
mov eax, dword [0x100400b0]
add esp, 0xc
mov dword [esi + 4], ebp
mov dword [esi], eax
test eax, eax
je 0x1003542f
mov dword [eax + 4], esi
mov dword [0x100400b0], esi
jmp 0x1003549c
mov ecx, dword [esi + 0xc]
mov eax, dword [esp + 0x10]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
mov dword [esi + ecx*4 + 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [esi + eax*4 + 0x110], ebx
mov eax, dword [esi + 0xc]
mov dword [esi + eax*4 + 0x210], ebp
mov eax, dword [esi + 0xc]
add eax, 0x84
lea eax, [esi + eax*4]
push eax
call fcn.10035274
add esp, 0xc
inc dword [esi + 0xc]
push ebp
push 1
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
jmp 0x1003549c
push dword [esi + 8]
call edi
push esi
push ebp
push dword [0x1003fab8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x10]
call edi
push 0x100400b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x402403
Capabilities:
Enumerate files on windows
Get disk size
Get geographical location
Print debug messages
Query environment variable

Disassembly:
inc eax
add dl, bh
jbe 0x402397
add dl, ah
mov dword [0xa22759], eax
push 0x40c0cd
jmp [ebp - 0x1dbfc917]
daa
mov byte [0xc0cd6800], al
inc eax
add bh, bh
lodsd eax, dword [esi]
jmp 0xe92263e0
inc eax
loop 0x402392
popal
add dl, ah
add byte [ebx + 0x40bb6d], ah
push 0x402249
jecxz 0x4023ef
jmp 0xe840c5f5
and ah, byte [edx - 0x3417b000]
add byte [eax], al
add byte [edi], bh
popal
daa
inc eax
loop 0x402456
push 0x40bf32
push eax
cli
push es
add byte [eax], al
loop 0x4023ad
daa
mov byte [0x5955c300], al
in eax, 0x83
in al, dx
salc
mov edi, dword [ebp + 8]
jl 0x40239b
aas
dec ebp
mov byte [ebp + 0x65], dh
mov eax, ebp
add edx, dword [edi + 0x3c]
jl 0x4023a7
cmp dl, byte [eax - 0x63]
jne 0x402484
mov dword [ebp + 0x6a428bf4], ecx
add eax, dword [ebp + 8]
pop ecx
inc ebp
clc
mov esp, dword [edx - 0x25bafce0]
mov dword [ebp - 4], eax
mov cl, 0xc9
mov edx, dword [ebp - 0x16]
cmp ecx, dword [edx + 0x18]
cmp cl, byte gs:[ebx + 0x1c8be65d]
mov ebx, edi
pop ebp
or bh, bh
insd dword es:[edi], dx
or al, 0x53
push ebx
call fcn.0040220a
pop edi
clc
add dword [edi + ebx*8 + 0x41], esi
jmp 0x402442
mov cl, 0xc0
mov esp, ebp
test edx, eax
or byte [eax], al

Function at 0x4042a0
Capabilities:
Terminate process

Disassembly:
mov edx, eax
push dword [0x402740]
call dword [sym.imp.pdh.dll_PdhValidatePathA]
and eax, 0xf
add eax, 0xb
xor edi, edi
xor esi, esi
cmp eax, 0x18
je 0x4042c9
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
mov dword [0x403705], eax
ret

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x40c7d0
mov ecx, 0x4e352ddb
nop
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x4293a45
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x1002a8d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp + 0x14]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp + 0x14], esi
push dword [ebp + 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1002ae8
mov eax, dword [ebp + 0x14]
cmp eax, 2
jb 0x1002ae3
shr eax, 1
xor ecx, ecx
cmp cx, word [edi + eax*2 - 2]
jne 0x1002ae3
mov eax, dword [ebp + 0x10]
dec eax
je 0x1002adf
dec eax
jne 0x1002ae3
push esi
push edi
call fcn.01002996
test eax, eax
jne 0x1002ae8
xor eax, eax
jmp 0x1002ae8
mov eax, 0x3f7
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x1002d87
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1003220
call fcn.01002f44
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x10043c8
push ebx
push esi
push edi
call dword [sym.imp.API_MS_Win_Core_Interlocked_L1_1_0.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1002b9c
cmp eax, esi
jne 0x1002b8f
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1002b9f
push 0x3e8
call dword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_Sleep]
jmp 0x1002b76
xor esi, esi
inc esi
mov eax, dword [0x10043c4]
cmp eax, esi
jne 0x1002bb2
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1002bed
mov eax, dword [0x10043c4]
test eax, eax
jne 0x1002be7
mov dword [0x10043c4], esi
push 0x1001188
push 0x100117c
call fcn.01128000
pop ecx
pop ecx
test eax, eax
je 0x1002bed
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1002cb7
mov dword [0x1004078], esi
mov eax, dword [0x10043c4]
cmp eax, esi
jne 0x1002c11
push 0x1001178
push 0x1001170
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10043c4], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1002c1e
push ebx
push edi
call dword [sym.imp.API_MS_Win_Core_Interlocked_L1_1_0.dll_InterlockedExchange]
cmp dword [0x10043cc], ebx
je 0x1002c3f
push 0x10043cc
call fcn.01002eb9
pop ecx
test eax, eax
je 0x1002c3f
push ebx
push 2
push ebx
call dword [0x10043cc]
push dword [0x1004060]
push dword [0x1004064]
push dword [0x100405c]
call fcn.010018dc
add esp, 0xc
mov dword [0x1004074], eax
cmp dword [0x1004068], ebx
jne 0x1002c9d
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1004078], ebx
jne 0x1002cab
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1004074]
call fcn.01002f89
ret
call fcn.01003091
jmp 0x1002b54
Function at 0x4024ed
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2c
mov eax, dword [0x49a0c0]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
mov esi, dword [0x4aace0]
xor ebx, ebx
push edi
mov dword [esp + 0x14], edx
mov eax, dword [esi + 0x3c]
mov ebp, dword [eax + esi + 0x78]
add ebp, esi
mov edi, dword [ebp + 0x20]
mov eax, dword [ebp + 0x18]
add edi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x402554
mov eax, dword [edi]
lea ecx, [esp + 0x1c]
add eax, esi
push eax
call fcn.0040342a
lea ecx, [esp + 0x1c]
call fcn.004020f3
cmp eax, dword [esp + 0x14]
je 0x40256c
lea ecx, [esp + 0x1c]
add edi, 4
call fcn.00404312
inc ebx
cmp ebx, dword [esp + 0x18]
jb 0x402524
xor edi, edi
mov ecx, dword [esp + 0x34]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042d331
add esp, 0x2c
ret
mov eax, dword [ebp + 0x24]
lea eax, [eax + ebx*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebp + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x1c]
call fcn.00404312
jmp 0x402556

Function at 0x402610
Capabilities:
Access peb ldr_data
Delete file
Get kernel32 base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
push ebx
push esi
push edi
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x4aace0], eax
push 0x27
mov ebx, 0x4a81b0
mov edx, 0x547
push 0x49ab80
mov ecx, ebx
call fcn.00401f18
push 1
push 0x492e6c
call fcn.0040113f
mov edx, 0x8aafdc01
call fcn.004024ed
lea ecx, [esp + 0x20]
mov edi, eax
call fcn.00403172
push 0x64
pop esi
lea ecx, [esp + 0x10]
call fcn.004051cb
push eax
call fcn.00405199
pop ecx
sub esi, 1
jne 0x402674
lea ecx, [esp + 0x10]
call fcn.004030ff
push str.static.lib
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0xc]
push eax
push 0x40
push 0x4e4
push ebx
call edi
test eax, eax
je 0x4026b5
call fcn.004025ab
lea ecx, [esp + 0x10]
call fcn.004026c9
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x46f6c4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046f2ab

Function at 0x46fbf2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0042e850
mov eax, dword [0x49a0c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00469882
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x46fc34
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x46fd90
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00484f10
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x4aa880]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00471a10
mov ecx, dword [esi*4 + 0x4aa880]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x46fd89
cmp eax, dword [edi + ecx + 0x24]
jne 0x46fd89
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46fd89
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00471a10
add esp, 0x14
test edx, edx
jl 0x46fd89
jg 0x46fcff
test eax, eax
jb 0x46fd89
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x46fd89
jl 0x46fd19
cmp dword [ebp - 0x1008], eax
ja 0x46fd89
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x46fd37
test ebx, ebx
je 0x46fd70
cmp ecx, edi
jae 0x46fd70
mov al, byte [ecx]
cmp al, 0xd
jne 0x46fd51
lea eax, [edi - 1]
cmp ecx, eax
jae 0x46fd5d
cmp byte [ecx + 1], 0xa
jne 0x46fd5d
inc ecx
jmp 0x46fd5d
movzx eax, al
movsx eax, byte [eax + 0x49a3a0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x46fd37
cmp edx, ebx
jne 0x46fd37
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x46fd8e
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0042d331
leave
ret
Function at 0x470b99
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4aa880]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x470bd9
cmp byte [ebx], 0xa
jne 0x470bd9
or byte [eax + edi + 0x28], 4
jmp 0x470bde
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x470cdc
mov al, byte [edx]
cmp al, 0x1a
je 0x470cbe
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x470c0d
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x470c32
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x470c3c
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x470bef
jmp 0x470cdc
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x470cb9
cmp dword [ebp - 0xc], 0
je 0x470cb9
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x4aa880]
test byte [eax + edi + 0x28], 0x48
je 0x470c93
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x470c7e
mov byte [esi], dl
jmp 0x470c8f
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4aa880]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x470cdc
cmp byte [ebp - 1], 0xa
jne 0x470ca2
cmp esi, ebx
jne 0x470ca2
mov byte [esi], 0xa
jmp 0x470cdb
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00471a2e
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x470cdc
mov byte [esi], 0xd
jmp 0x470cdb
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x4aa880]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x470cd8
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x470cdc
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret