joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4182d0
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x418394
mov edi, dword [esp + 0x1c]
cmp dword [edi], 0
je 0x4182f1
mov eax, dword [edi + 8]
mov byte [eax], 0
jmp 0x4182f9
mov eax, dword [0x5052b0]
mov dword [edi + 8], eax
mov dword [edi + 4], 0
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
test eax, eax
je 0x41838f
mov esi, eax
mov eax, dword [edi]
mov ecx, eax
sub ecx, 1
jb 0x418327
cmp ecx, esi
jb 0x418327
mov eax, dword [edi + 8]
xor ecx, ecx
jmp 0x418373
cmp eax, 2
mov ecx, 0x20
cmovae ecx, eax
mov edx, esi
inc edx
nop word cs:[eax + eax]
mov ebp, ecx
add ecx, ecx
cmp edx, ebp
ja 0x418340
test eax, eax
je 0x418360
push ebp
push dword [edi + 8]
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
add esp, 8
mov dword [edi + 8], eax
mov ecx, dword [edi + 4]
jmp 0x418371
push ebp
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov byte [eax], 0
mov dword [edi + 8], eax
xor ecx, ecx
mov dword [edi], ebp
add ecx, eax
push esi
push ebx
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, dword [edi + 4]
add eax, esi
mov dword [edi + 4], eax
mov ecx, dword [edi + 8]
mov byte [ecx + eax], 0
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [esp + 0x14]
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push esi
push str.Error:_usage:__s__str__n
push eax
call fcn.004183c0
add esp, 0xc
push 0x1dd
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3

Function at 0x419040
Capabilities:
Terminate process

Disassembly:
push esi
push eax
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
test eax, eax
je 0x419069
mov ecx, esp
push 0xa
push ecx
push eax
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
add esp, 0xc
mov ecx, dword [esp]
cmp byte [ecx], 0
jne 0x41908d
add esp, 4
pop esi
ret
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push esi
push str.Error:_usage:__s__num__n
push eax
call fcn.004183c0
add esp, 0xc
push 0x1e0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push esi
push str.Error:_usage:__s__num__n
push eax
call fcn.004183c0
add esp, 0xc
push 0x1df
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
Function at 0x4190c0
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
test edi, edi
je 0x419131
mov ebx, dword [esp + 0x1c]
mov eax, dword [ebx]
test eax, eax
je 0x419104
add ebx, 8
mov ebp, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
nop word cs:[eax + eax]
push eax
push edi
call ebp
add esp, 8
test eax, eax
je 0x419129
mov eax, dword [ebx]
add ebx, 8
test eax, eax
jne 0x4190f0
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push edi
push esi
push str.Error:_unknown__s_value:__s_n
push eax
call fcn.004183c0
add esp, 0x10
push 0x1de
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [ebx - 4]
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push esi
push str.Error:_usage:__s__value__n
push eax
call fcn.004183c0
add esp, 0xc
push 0x1dc
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
Function at 0x419a40
Capabilities:
Write file on windows

Disassembly:
push esi
sub esp, 0xc
mov esi, dword [esp + 0x1c]
mov dword [esp], 0
mov dword [esp + 4], 0
mov eax, dword [0x5052b0]
mov dword [esp + 8], eax
test esi, esi
je 0x419a84
lea eax, [esi + 0x18]
mov ecx, esp
push dword [esp + 0x28]
push dword [esp + 0x28]
push eax
push ecx
call fcn.00415920
add esp, 0x10
cmp dword [esp + 4], 0
jne 0x419ab2
jmp 0x419af7
push 0x20
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov dword [esp + 8], eax
mov dword [esp], 0x20
mov dword [eax + 3], 0x6e776f6e
mov dword [eax], 0x6e6b6e75
mov dword [esp + 4], 7
mov byte [eax + 7], 0
movzx eax, byte [esp + 0x18]
movzx eax, al
push dword [esp + 0x20]
push esi
push eax
push dword [esp + 0x20]
call fcn.004197c0
add esp, 0x10
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
mov esi, eax
push eax
push dword [esp + 8]
push 1
push dword [esp + 0x14]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
push esi
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add esp, 8
cmp dword [esp], 0
mov dword [esp + 4], 0
je 0x419b18
mov dword [esp], 0
push dword [esp + 8]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
add esp, 0xc
pop esi
ret

Function at 0x419b50
Capabilities:
Write file on windows

Disassembly:
cmp byte [0x506392], 0
je 0x419bea
push edi
push esi
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
movzx eax, dl
push dword [esp + 0x10]
push dword [esp + 0x10]
push eax
push ecx
call fcn.004197c0
add esp, 0x10
cmp byte [0x506391], 0
jne 0x419ba2
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 7
push str.e_1_31m
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push edi
push esi
push eax
call fcn.004021c0
add esp, 0xc
cmp byte [0x506391], 0
jne 0x419bde
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 4
push 0x4aaefa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
pop esi
pop edi
ret

Function at 0x419c20
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov esi, dword [esp + 0x38]
test esi, esi
je 0x419cab
movzx eax, byte [esp + 0x34]
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
movdqu xmmword [esp + 0x10], xmm0
movdqu xmmword [esp], xmm0
cmp esi, 0x20
jb 0x419c8c
mov edi, 0x20
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ebp, esp
nop word cs:[eax + eax]
push 1
call ebx
add esp, 4
push eax
push 0x20
push 1
push ebp
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
add edi, 0x20
cmp edi, esi
jbe 0x419c70
and esi, 0x1f
je 0x419cab
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
mov ecx, esp
push eax
push esi
push 1
push ecx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41a680
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x18]
push 4
push str.temp
push ebp
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strnicmp]
add esp, 0xc
test eax, eax
je 0x41a6a1
xor eax, eax
jmp 0x41a71b
mov ebx, dword [esp + 0x1c]
movzx eax, byte [ebp + 4]
cmp eax, 0x2d
je 0x41a6c3
test eax, eax
jne 0x41a69d
mov esi, dword [esp + 0x20]
push ebx
call fcn.00419160
add esp, 4
mov byte [esi], al
jmp 0x41a719
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x14]
add ebp, 5
push str.green
push ebp
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x41a708
push str.yellow
push ebp
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x41a69d
push ebx
push esi
call fcn.00419040
add esp, 8
cmp eax, 0x65
jae 0x41a720
mov byte [edi + 1], al
jmp 0x41a719
push ebx
push esi
call fcn.00419040
add esp, 8
cmp eax, 0x65
jae 0x41a720
mov byte [edi], al
mov al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push esi
push str.Error:_usage:__s_must_be_between_0_and_100_n
push eax
call fcn.0041a750
add esp, 0xc
push 0x1e0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
Function at 0x41a770
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x18]
push str.temp
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x41a799
test eax, eax
sete al
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x41a8ae
mov edi, dword [esp + 0x20]
mov edx, dword [ecx]
mov ebx, edx
and bl, 7
cmp bl, 2
je 0x41a7d0
mov ebx, edx
and ebx, 7
cmp ebx, 7
je 0x41a7d5
cmp ebx, 3
jne 0x41a8ae
test dl, 0x18
setne byte [edi]
jmp 0x41a78c
mov byte [edi], 0
jmp 0x41a78c
mov ebp, dword [ecx + 4]
mov byte [edi], 1
shld ebp, edx, 0x18
je 0x41a78c
add ecx, 0x10
mov dword [esp], ebp
mov edi, ecx
mov esi, 0x65657267
jmp 0x41a7f8
add edi, edx
add edi, 0x10
dec ebp
je 0x41a845
cmp dword [edi + 1], 5
jne 0x41a810
mov edx, dword [edi + 8]
mov ebx, dword [edx]
xor ebx, esi
movzx edx, byte [edx + 4]
xor edx, 0x6e
or edx, ebx
je 0x41a824
mov ebx, dword [edi + 0x10]
not ebx
mov edx, 0x10
test bl, 6
jne 0x41a7f0
mov edx, dword [edi + 0x18]
jmp 0x41a7f0
mov edx, 0xf7
and edx, dword [edi + 0x10]
xor ebx, ebx
cmp edx, 4
jne 0x41a83f
mov ebx, dword [edi + 0x18]
cmp ebx, 0x65
jae 0x41a8d2
mov edx, dword [esp + 0x24]
mov byte [edx], bl
mov edi, 0x6c6c6579
mov esi, dword [esp]
jmp 0x41a85c
add ecx, edx
add ecx, 0x10
dec esi
je 0x41a78c
cmp dword [ecx + 1], 6
jne 0x41a877
mov edx, dword [ecx + 8]
mov ebx, dword [edx]
xor ebx, edi
movzx edx, word [edx + 4]
xor edx, 0x776f
or edx, ebx
je 0x41a88b
mov ebx, dword [ecx + 0x10]
not ebx
mov edx, 0x10
test bl, 6
jne 0x41a850
mov edx, dword [ecx + 0x18]
jmp 0x41a850
mov edx, 0xf7
and edx, dword [ecx + 0x10]
xor ebx, ebx
cmp edx, 4
jne 0x41a8a2
mov ebx, dword [ecx + 0x18]
cmp ebx, 0x65
jae 0x41a8e9
mov ecx, dword [esp + 0x24]
mov byte [ecx + 1], bl
jmp 0x41a78c
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push esi
push str.Error:_usage:__s_must_be_an_object_or_a_boolean_n
push eax
call fcn.0041a750
add esp, 0xc
push 0x1e0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 0x33
push str.Error:_usage:_temp.green_must_be_between_0_and_100_n
jmp 0x41a8fe
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 0x34
push str.Error:_usage:_temp.yellow_must_be_between_0_and_100_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
push 0x1e0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
Function at 0x41ce40
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
cmp dword [0x505240], 0xffffffff
jne 0x41d01d
mov ebx, dword [esp + 0x18]
mov edi, dword [ebx + 0x4c]
test edi, edi
je 0x41ce88
mov edx, dword [ebx + 0x48]
test edx, edx
je 0x41ceae
push edx
mov ebp, edx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov esi, eax
mov byte [eax], 0
mov ebx, dword [ebx + 0x50]
test ebx, ebx
je 0x41ceea
lea eax, [ebp - 1]
cmp eax, edi
mov edx, ebp
jb 0x41cebf
mov ebp, edx
jmp 0x41ceff
push 0
push str._json
push str.ipinfo.io
push 0x507744
call fcn.004744c0
add esp, 0x10
movzx eax, al
mov dword [0x505240], eax
jmp 0x41d007
mov esi, dword [0x5052b0]
mov ebx, dword [ebx + 0x50]
test ebx, ebx
je 0x41d00f
cmp edx, 2
mov eax, 0x20
cmovae eax, edx
lea ecx, [edi + 1]
nop dword [eax]
mov ebp, eax
add eax, eax
cmp ecx, ebp
ja 0x41ced0
test edx, edx
je 0x41cef1
push ebp
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
add esp, 8
mov esi, eax
jmp 0x41ceff
mov dword [esp], ebp
xor edi, edi
jmp 0x41cf11
push ebp
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov esi, eax
mov byte [eax], 0
push edi
push ebx
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov byte [esi + edi], 0
mov dword [esp], ebp
push 0x4ab8b1
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_strstr
add esp, 8
mov ecx, eax
sub ecx, esi
test eax, eax
cmove ecx, edi
lea eax, [ecx + 2]
mov ebp, edi
sub ebp, eax
jbe 0x41cf51
cmp dword [esp], 0
je 0x41cf55
add eax, esi
inc eax
sub edi, ecx
lea ebp, [edi - 3]
push ebp
push eax
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
add esp, 0xc
mov byte [esi + edi - 3], 0
jmp 0x41cf57
mov ebp, edi
jmp 0x41cf57
add esi, eax
push ebp
push 0x2f
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memchr
add esp, 0xc
xor ebx, ebx
mov edi, dword [0x5052b0]
mov ecx, 0x4ab8b5
test eax, eax
je 0x41cfd0
mov edx, edi
mov edi, eax
sub edi, esi
sub ebp, edi
je 0x41cfce
xor ebx, ebx
test esi, esi
je 0x41cfca
cmp eax, esi
je 0x41cfca
add ebp, esi
lea eax, [edi + 1]
mov ecx, 0x20
nop word cs:[eax + eax]
mov ebx, ecx
add ecx, ecx
cmp eax, ebx
ja 0x41cfa0
push ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov byte [eax], 0
push edi
push ebp
mov ebp, eax
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov byte [ebp + edi], 0
mov edx, ebp
mov ecx, ebp
mov byte [esi + edi], 0
mov edi, edx
push 0
push ecx
push esi
push 0x507744
call fcn.004744c0
add esp, 0x10
movzx eax, al
mov dword [0x505240], eax
test ebx, ebx
je 0x41cff6
push edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
cmp dword [esp], 0
je 0x41d007
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 8
jmp 0x41d00a
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
mov dword [esp], 0
jmp 0x41cf11
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 0x45
push 0x4ab85b
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
Function at 0x420ac0
Capabilities:
Get file version info

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, edx
mov ebx, ecx
lea eax, [esp + 8]
push eax
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
je 0x420b6a
mov ebp, eax
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov esi, eax
push eax
push ebp
push dword [esp + 0x10]
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x420b52
mov eax, esp
lea ecx, [esp + 4]
push eax
push ecx
push 0x4ac27a
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x420b52
cmp dword [esp], 0
je 0x420b52
mov eax, dword [esp + 4]
cmp dword [eax], 0xfeef04bd
jne 0x420b52
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
movzx edx, cx
shr ecx, 0x10
movzx ebx, ax
shr eax, 0x10
push ebx
push eax
push edx
push ecx
push 0x4ac27e
push edi
call fcn.00472860
add esp, 0x18
mov bl, 1
mov al, 1
test esi, esi
jne 0x420b5d
jmp 0x420b6c
xor ebx, ebx
mov eax, 0
test esi, esi
je 0x420b6c
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov eax, ebx
jmp 0x420b6c
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4230e0
Capabilities:
Encode data using base64

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, edx
mov edi, ecx
mov esi, dword [edx + 4]
lea eax, [esi*4]
mov ebp, 0xaaaaaaab
mul ebp
shr edx, 1
add edx, 0xa
mov dword [ecx], edx
push edx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov ecx, eax
mov byte [eax], 0
mov dword [esp + 0xc], edi
mov dword [edi + 8], eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
mov eax, esi
mul ebp
shr edx, 1
lea ebp, [edx + edx*2]
sub esi, ebp
mov eax, esi
test ebp, ebp
jne 0x423175
mov edi, ecx
mov edx, dword [esp]
mov ebx, ecx
cmp eax, 2
je 0x4231f5
cmp eax, 1
jne 0x42323c
movsx ecx, byte [edx]
mov edx, ecx
shr edx, 2
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi], dl
shl ecx, 4
and ecx, 0x30
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 1], cl
mov byte [edi + 2], 0x3d
jmp 0x423235
mov edx, dword [esp]
add edx, ebp
mov dword [esp + 4], edx
xor edx, edx
mov edi, ecx
mov dword [esp + 8], ecx
nop word cs:[eax + eax]
mov ecx, dword [esp]
mov ecx, dword [ecx + edx]
bswap ecx
mov esi, ecx
shr esi, 0x1a
movzx ebx, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi], bl
mov esi, ecx
shr esi, 0x14
and esi, 0x3f
movzx ebx, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 1], bl
mov esi, ecx
shr esi, 0xe
and esi, 0x3f
movzx ebx, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 2], bl
shr ecx, 8
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 3], cl
add edi, 4
add edx, 3
cmp ebp, edx
jne 0x423190
mov ebx, dword [esp + 8]
mov edx, dword [esp + 4]
cmp eax, 2
jne 0x42313f
movsx ecx, byte [edx]
shl ecx, 0x10
movsx edx, byte [edx + 1]
mov esi, edx
shl esi, 8
or esi, ecx
mov ecx, esi
shr ecx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi], cl
shr esi, 0xc
and esi, 0x3f
movzx ecx, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 1], cl
and edx, 0xf
movzx ecx, byte [edx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 2], cl
mov byte [edi + 3], 0x3d
add edi, 4
mov byte [edi], 0
sub edi, ebx
mov eax, dword [esp + 0xc]
mov dword [eax + 4], edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x425380
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [0x507638]
mov esi, eax
sub esi, dword [0x50763c]
jb 0x425400
inc esi
je 0x425400
movaps xmm0, xmmword [str._n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_ne__sm]
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp], xmm0
cmp esi, 0x20
jb 0x4253dc
mov edi, 0x20
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ebp, esp
nop dword [eax + eax]
push 1
call ebx
add esp, 4
push eax
push 0x20
push 1
push ebp
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
add edi, 0x20
cmp edi, esi
jbe 0x4253c0
and esi, 0x1f
je 0x4253fb
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
mov ecx, esp
push eax
push esi
push 1
push ecx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
mov eax, dword [0x507638]
inc eax
mov dword [0x50763c], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4432f0
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, ecx
cmp dword [ecx + 0x10], 0
je 0x44332a
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push dword [esi + 0x10]
push 1
push dword [esi + 0x14]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
cmp dword [esi + 0x1c], 0
je 0x44334c
push 0x20
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
jmp 0x443330
cmp dword [esi + 0x1c], 0
je 0x443385
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push dword [esi + 0x1c]
push 1
push dword [esi + 0x20]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
cmp dword [esi + 0x28], 0
je 0x443364
mov eax, dword [esi + 0x2c]
sub esp, 8
mov dword [esp + 4], eax
call fcn.00444d80
add esp, 8
test bl, bl
je 0x4433a7
cmp byte [esi + 0x30], 0
je 0x4433a7
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 2
push 0x4f45d9
jmp 0x44339f
cmp dword [esi + 0x28], 0
je 0x4433a7
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push dword [esi + 0x28]
push 1
push dword [esi + 0x2c]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
pop esi
pop ebx
ret
Function at 0x473df0
Capabilities:
Get system firmware table

Disassembly:
cmp dword [0x505ee8], 0
je 0x473dff
mov eax, 0x505eec
ret
push edi
push esi
sub esp, 0x10
movaps xmm0, xmmword [str.BMSR]
movups xmmword [esp], xmm0
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
call edi
mov esi, eax
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov dword [0x505ee8], eax
push esi
push eax
push 0
push 0x52534d42
call edi
mov ecx, dword [0x505ee8]
mov eax, dword [ecx + 4]
test eax, eax
jle 0x473eb8
lea esi, [ecx + eax]
add esi, 8
add ecx, 8
jmp 0x473e58
inc edi
mov ecx, edi
inc ecx
cmp ecx, esi
jae 0x473eb8
movzx eax, byte [ecx]
cmp eax, 0x7e
ja 0x473e80
cmp dword [eax*4 + 0x505eec], 0
jne 0x473e85
mov dword [eax*4 + 0x505eec], ecx
jmp 0x473e85
cmp eax, 0x7f
je 0x473eb8
movzx eax, byte [ecx + 1]
lea edi, [ecx + eax]
cmp byte [ecx + eax], 0
je 0x473e50
nop word cs:[eax + eax]
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
lea ecx, [eax + edi]
inc ecx
cmp byte [eax + edi + 1], 0
mov edi, ecx
jne 0x473ea0
jmp 0x473e53
pop esi
pop edi
mov eax, 0x505eec
ret
Function at 0x474200
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x18]
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov esi, eax
cmp eax, 2
jb 0x4742bd
mov ebp, dword [esp + 0x1c]
cmp dword [ebp], 0
je 0x47424f
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov ecx, dword [ebp]
lea ebx, [ebp + 4]
mov dword [ebp + 4], 0
mov edx, ecx
sub edx, 1
setb al
jb 0x474268
cmp edx, esi
jb 0x474268
mov eax, dword [ebp + 8]
jmp 0x4742af
mov eax, dword [0x5052b0]
mov dword [ebp + 8], eax
lea eax, [ebp + 4]
mov dword [esp], eax
mov dword [ebp + 4], 0
mov al, 1
jmp 0x474270
mov dword [esp], ebx
cmp ecx, 1
ja 0x474275
mov ecx, 0x20
lea edx, [esi + 1]
nop dword [eax + eax]
mov ebx, ecx
add ecx, ecx
cmp edx, ebx
ja 0x474280
test al, al
je 0x47429a
push ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov byte [eax], 0
jmp 0x4742a6
push ebx
push dword [ebp + 8]
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
add esp, 8
mov dword [ebp + 8], eax
mov dword [ebp], ebx
mov ebx, dword [esp]
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [esi - 1]
mov dword [ebx], eax
cmp esi, 2
setae al
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret