joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4484ef
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
mov dword [ebp - 4], 4
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x20000005
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x448540
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x448540
push esi
push 0x18
push str.c:jworkspacewix3_build5059eb25_srclibsdutilinetutil.cpp
call fcn.00403970
jmp 0x44854c
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
and dword [edx + 4], 0
mov dword [edx], ecx
mov eax, esi
pop esi
leave
ret 8
Function at 0x448680
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x246c
call fcn.00449a80
mov eax, dword [0x46b008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2428], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x242c], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x20]
mov dword [ebp - 0x241c], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x2430], eax
xor esi, esi
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x24]
mov dword [ebp - 0x2420], eax
mov eax, dword [ebp + 0x1c]
push 0x3c
mov dword [ebp - 0x2424], eax
lea eax, [ebp - 0x246c]
push esi
push eax
call fcn.0042f8b0
add esp, 0xc
mov dword [ebp - 0x246c], 0x3c
cmp dword [ebp - 0x241c], esi
je 0x448712
lea eax, [ebp - 0x410]
mov dword [ebp - 0x2458], 0x101
mov dword [ebp - 0x245c], eax
mov ecx, 0x81
cmp dword [ebp - 0x2420], esi
je 0x448731
lea eax, [ebp - 0x108]
mov dword [ebp - 0x244c], ecx
mov dword [ebp - 0x2450], eax
cmp dword [ebp - 0x2424], esi
je 0x44874b
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x2444], ecx
mov dword [ebp - 0x2448], eax
mov ecx, 0x801
test ebx, ebx
je 0x448766
lea eax, [ebp - 0x1414]
mov dword [ebp - 0x243c], ecx
mov dword [ebp - 0x2440], eax
test edi, edi
je 0x44877c
lea eax, [ebp - 0x2418]
mov dword [ebp - 0x2434], ecx
mov dword [ebp - 0x2438], eax
lea eax, [ebp - 0x246c]
push eax
push 0x90000000
push esi
push dword [ebp - 0x2428]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x4487c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x56
push str.c:jworkspacewix3_build5059eb25_srclibsdutiluriutil.cpp
call fcn.00403970
jmp 0x44888d
mov ecx, dword [ebp - 0x242c]
test ecx, ecx
je 0x4487db
mov eax, dword [ebp - 0x2460]
mov dword [ecx], eax
mov eax, dword [ebp - 0x241c]
test eax, eax
je 0x448801
push dword [ebp - 0x2458]
push dword [ebp - 0x245c]
push eax
call fcn.0040224f
mov esi, eax
test esi, esi
js 0x44888d
mov eax, dword [ebp - 0x2430]
test eax, eax
je 0x448815
mov cx, word [ebp - 0x2454]
mov word [eax], cx
mov eax, dword [ebp - 0x2420]
test eax, eax
je 0x448837
push dword [ebp - 0x244c]
push dword [ebp - 0x2450]
push eax
call fcn.0040224f
mov esi, eax
test esi, esi
js 0x44888d
mov eax, dword [ebp - 0x2424]
test eax, eax
je 0x448859
push dword [ebp - 0x2444]
push dword [ebp - 0x2448]
push eax
call fcn.0040224f
mov esi, eax
test esi, esi
js 0x44888d
test ebx, ebx
je 0x448875
push dword [ebp - 0x243c]
push dword [ebp - 0x2440]
push ebx
call fcn.0040224f
mov esi, eax
test esi, esi
js 0x44888d
test edi, edi
je 0x44888d
push dword [ebp - 0x2434]
push dword [ebp - 0x2438]
push edi
call fcn.0040224f
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042dd3b
leave
ret 0x20
Function at 0x1000512c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1000513b
pop dword [ebp - 0x40]
mov eax, 0xa045439a
sub eax, 0x9044f25f
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x57748cc7
sub dword [ebp - 0x50], 0x922477c
mov dword [ebp - 0x4c], 0xeef0f7f3
sub dword [ebp - 0x4c], 0xbcbdabae
mov dword [ebp - 0x48], 0xc03edaaa
add dword [ebp - 0x48], 0x8c0d6984
mov dword [ebp - 0x44], 0xcf46ec5b
sub dword [ebp - 0x44], 0xcf46ec5b
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xe0a96a42
sub dword [ebp - 0x50], 0x6c3700ec
mov dword [ebp - 0x4c], 0xab50f2a5
add dword [ebp - 0x4c], 0x961b6ed0
mov dword [ebp - 0x48], 0x536a883
add dword [ebp - 0x48], 0x5e38c3e9
mov dword [ebp - 0x44], 0x2344f08e
add dword [ebp - 0x44], 0xdcbb0f72
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x565c9d44
add eax, 0xb9a43334
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x38858
push 0
call eax
mov ecx, 0xe193c8d4
sub ecx, 0xe193802a
mov ebx, eax
mov edx, 0xf96b4ec5
sub edx, 0xe9699ac5
add edx, dword [ebp - 0x40]
mov edi, 0x628177cd
sub edi, 0xe6b8a14a
add dword [ebp - 8], 0xf5a05c38
mov esi, dword [edx]
mov dword [ebp - 0x30], 0xc3aa1cc6
xor esi, edi
sub dword [ebp - 0x38], eax
mov dword [ebx], esi
xor dword [ebp - 0x2c], 0x7ed93000
add ebx, 0xb036c1fb
sub ebx, 0xb036c1f7
add edx, 4
loop 0x10005258
add eax, 0xd7841557
sub eax, 0xd782ffdc
mov ebx, eax
add eax, 5
mov ecx, 0x60b8a6fe
sub ecx, 0x50b8a6fe
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x10009670
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
cmp eax, 0x1a
jl 0x100096c8
mov eax, dword [esi + 8]
cmp eax, dword [esi]
jl 0x100096c8
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
push 0x10
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi]
push eax
push dword [esi + 4]
push dword [esi]
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, edi
call fcn.1000512c
push 1
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 4

Function at 0x10009c50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xd
push dword [ecx + 0x38]
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebp
ret 8
Function at 0x100015e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 8], eax
push 0x100062d0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10009604], eax
push 0
push 7
push 0x100095fc
mov ecx, dword [0x10009604]
push ecx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x10001626
jmp 0x10001692
mov edx, 0x10001580
sub edx, dword [0x10009604]
sub edx, 5
mov dword [ebp - 0xc], edx
mov eax, 1
shl eax, 0
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0x10009088], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0x40
push 7
mov eax, dword [0x10009604]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push 7
push 0x10009088
mov ecx, dword [0x10009604]
push ecx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 4]
push eax
push 7
mov ecx, dword [0x10009604]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x10001bc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x10001bec
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x10001cd2
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x10001c83
jg 0x10001c15
cmp dword [ebp + 0xc], 0
jbe 0x10001c83
cmp dword [ebp - 8], 0
jl 0x10001c83
jg 0x10001c23
cmp dword [ebp - 0xc], 0
jbe 0x10001c83
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jg 0x10001c41
jl 0x10001c35
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0xc]
jae 0x10001c41
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push eax
call fcn.100031a0
add esp, 0xc
mov eax, dword [ebp - 0xc]
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
sbb edx, dword [ebp - 8]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
cmp dword [ebp + 0x10], 0
jl 0x10001cc6
jg 0x10001c91
cmp dword [ebp + 0xc], 0
jbe 0x10001cc6
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x4c], 0
je 0x10001cc6
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10001ce0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x10001d00
jl 0x10001cf7
cmp dword [ebp + 0xc], 0
ja 0x10001d00
xor eax, eax
xor edx, edx
jmp 0x10001e3d
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x10001d23
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
jmp 0x10001e3d
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x10001d95
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.10001e50
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.100031a0
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int_]
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x10001e2e
mov ecx, dword [ebp - 8]
call fcn.10002a20
mov dword [ebp - 0x18], 0xfff
cmp dword [ebp - 4], 0xfff
jbe 0x10001e06
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x10], 0xfff
je 0x10001e04
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x10001e3d
jmp 0x10001db1
cmp dword [ebp - 4], 0
jbe 0x10001e2e
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov ecx, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 4], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10002ab0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x10002acd
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x10002ad4
mov al, 1
jmp 0x10002ba5
call fcn.100030d0
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
call eax
push eax
call fcn.100030d0
push eax
call fcn.10003120
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x10002b04
xor al, al
jmp 0x10002ba5
mov dword [ebp - 0x18], 0x20
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x3c]
push ecx
mov edx, dword [ebp - 4]
add edx, 0x40
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x38]
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10002b41
cmp dword [ebp - 8], 1
je 0x10002b48
cmp dword [ebp - 8], 3
je 0x10002b98
jmp 0x10002ba3
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x3d], 0
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0xc], edx
je 0x10002b78
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 1
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0xc], eax
je 0x10002b78
xor al, al
jmp 0x10002ba5
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x3d]
test eax, eax
jne 0x10002b8c
mov dword [ebp - 0x10], 1
jmp 0x10002b93
mov dword [ebp - 0x10], 0
mov al, byte [ebp - 0x10]
jmp 0x10002ba5
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x3d], 0
mov al, 1
jmp 0x10002ba5
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x40c980
Capabilities:
Check mutex on windows
Get file attributes

Disassembly:
push ecx
push ebx
push esi
mov ebx, ecx
push edi
push str.AOLSB_update_running_version
mov dword [esp + 0x10], ebx
push dword [ebx]
call fcn.00401860
push eax
call fcn.00402380
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexW]
add esp, 0xc
push dword [0x439008]
push 0
push 0x100000
call edi
mov esi, eax
test esi, esi
je 0x40ca02
push ebp
push str.We_got_a_handle_to_the_mutex___wait_for_aolsb_to_exit
push dword [ebx]
call fcn.004014f0
push eax
call fcn.00402380
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add esp, 0xc
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [eax]
push 0xffffffffffffffff
push esi
call ebx
push esi
call ebp
push dword [0x439008]
push 0
push 0x100000
call edi
mov esi, eax
test esi, esi
jne 0x40c9e0
mov ebx, dword [esp + 0x10]
pop ebp
pop edi
pop esi
mov ecx, ebx
pop ebx
add esp, 4
jmp fcn.0040d000
Function at 0x40ea0f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x40ea30
jl 0x40ea27
test edi, edi
jne 0x40ea30
xor eax, eax
xor edx, edx
jmp 0x40eaf1
cmp dword [ebx + 0x38], 0
je 0x40ea45
push eax
push edi
push dword [ebp + 8]
call fcn.00409730
jmp 0x40eaf1
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40ea8c
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x40ea8c
cmp eax, edi
jb 0x40ea66
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00410440
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x40ea92
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x40eae6
mov ecx, ebx
call fcn.0040e396
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x40ead1
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.00418050
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x40eae6
jmp 0x40eaa4
test edx, edx
je 0x40eae6
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00418050
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x40fb32
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40fb71
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40fb71
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40fb71
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40fb71
cmp dword [ecx + 0x74], 0xe
jbe 0x40fb71
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x41ec61
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040fd90
mov eax, dword [0x439080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0041c2ec
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41eca3
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41edff
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0042b460
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x43af98]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.0041f086
mov ecx, dword [esi*4 + 0x43af98]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x41edf8
cmp eax, dword [ecx + edi + 0x24]
jne 0x41edf8
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41edf8
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041f086
add esp, 0x14
test edx, edx
jl 0x41edf8
jg 0x41ed6e
test eax, eax
jb 0x41edf8
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41edf8
jl 0x41ed88
cmp dword [ebp - 0x1008], eax
ja 0x41edf8
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41eda6
test ebx, ebx
je 0x41eddf
cmp ecx, edi
jae 0x41eddf
mov al, byte [ecx]
cmp al, 0xd
jne 0x41edc0
lea eax, [edi - 1]
cmp ecx, eax
jae 0x41edcc
cmp byte [ecx + 1], 0xa
jne 0x41edcc
inc ecx
jmp 0x41edcc
movzx eax, al
movsx eax, byte [eax + 0x439340]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41eda6
cmp edx, ebx
jne 0x41eda6
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x41edfd
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040ef75
leave
ret

Function at 0x41f5e7
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x431828
push 0x431820
push str.FlsAlloc
push 0x1f
call fcn.0041f4ce
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41f61b
push dword [ebp + 8]
mov ecx, esi
call dword [0x42d154]
call esi
jmp 0x41f621
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41f665
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x431838
push 0x431830
push str.FlsGetValue
push 0x21
call fcn.0041f4ce
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41f69c
push dword [ebp + 8]
mov ecx, esi
call dword [0x42d154]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x41f6a4
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x431840
push 0x431838
push str.FlsSetValue
push 0x22
call fcn.0041f4ce
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41f6de
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42d154]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]

Function at 0x42186d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x43af98]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4218ad
cmp byte [ebx], 0xa
jne 0x4218ad
or byte [edi + eax + 0x28], 4
jmp 0x4218b2
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x4219b1
mov dl, byte [eax]
cmp dl, 0x1a
je 0x421994
inc eax
cmp dl, 0xd
je 0x4218de
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x421904
cmp eax, ecx
jae 0x421912
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x4218c6
jmp 0x4219b1
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42198f
cmp dword [ebp - 0x10], 0
je 0x42198f
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x43af98]
test byte [eax + edi + 0x28], 0x48
je 0x421969
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x421954
mov byte [esi], dl
jmp 0x421965
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x43af98]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4219b1
cmp byte [ebp - 1], 0xa
jne 0x421978
cmp esi, ebx
jne 0x421978
mov byte [esi], 0xa
jmp 0x4219b0
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041f0a4
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4219b1
mov byte [esi], 0xd
jmp 0x4219b0
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x43af98]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4219ae
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4219b1
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret