joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473f70
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104
call fcn.00419550
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x473fb9
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x473fb9
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
push 0x4e3d88
call fcn.0049e300
add esp, 0xc
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
push edx
push eax
lea ecx, [ebp - 0x104]
push 0xff
push ecx
call fcn.0049e2b0
add esp, 0x10
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4740cb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov ebx, eax
test ebx, ebx
je 0x4740cb
lea edx, [ebp - 4]
push edx
push 0
push 0
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
jne 0x4740cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4740cb
mov eax, dword [ebp - 4]
cmp eax, 0x200
ja 0x4740cb
lea esi, [eax + 1]
and esi, 0xfffffffe
mov dword [ebp - 4], esi
lea eax, [esi + 2]
add eax, 3
and al, 0xfc
call fcn.00419550
lea eax, [ebp - 4]
mov edi, esp
push eax
push esi
push edi
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
je 0x4740cb
mov ecx, dword [ebp - 4]
push str.Service_0x
push edi
lea eax, [ecx + 1]
and al, 0xfe
mov dword [ebp - 4], eax
shr eax, 1
mov word [edi + eax*2], 0
call fcn.00417709
add esp, 8
test eax, eax
je 0x4740cb
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push 0
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x104]
push 1
push esi
mov dword [ebp - 4], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
lea ecx, [ebp - 0x104]
push str.OpenSSL:_FATAL
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a5f57
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push edi
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x4a5f87
push edi
call ebx
push eax
call fcn.004abc7f
push esi
mov esi, dword [ebp + 0xc]
movzx eax, byte [esi + 0x10]
cmp eax, dword [ebp - 4]
je 0x4a5fb1
test byte [ebp - 4], 1
je 0x4a5fb1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x4a5fb1
push edi
call ebx
push eax
call fcn.004abc7f
cmp dword [esi + 4], edi
lea eax, [esi + 4]
je 0x4a6057
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.004a5ea4
cmp dword [esi + 8], edi
lea eax, [esi + 8]
pop ecx
pop ecx
je 0x4a5fe3
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.004a5ea4
pop ecx
lea eax, [ebp - 0x14]
pop ecx
mov dword [ebp - 8], eax
cmp dword [esi], edi
je 0x4a5ff9
lea eax, [ebp - 0x1c]
push eax
push esi
call fcn.004a5ea4
pop ecx
lea eax, [ebp - 0x1c]
pop ecx
mov dword [ebp - 0xc], eax
push edi
push 0x80
push 3
push edi
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4a6023
push 0
call ebx
push eax
call fcn.004abc7f
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x4a6041
push eax
call ebx
push eax
call fcn.004abc7f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x4a6055
push eax
call ebx
push eax
call fcn.004abc7f
xor edi, edi
movzx eax, byte [esi + 0x10]
cmp eax, dword [ebp - 4]
pop esi
je 0x4a607e
test byte [ebp - 4], 1
jne 0x4a607e
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x4a607e
push edi
call ebx
push eax
call fcn.004abc7f
pop edi
pop ebx
leave
ret 8
Function at 0x4a77f2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x4be8c0
call fcn.00418b28
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.004b5e41
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x4a7831
call fcn.004b5e41
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4a783f
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4a784d
or eax, 0xffffffff
jmp 0x4a7935
mov ecx, esi
call fcn.004a7768
mov dword [ebp - 0x14], eax
call fcn.004a8628
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x4a7884
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4a7884
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.004a85dc
push dword [ebp - 0x14]
call fcn.004a810d
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.004a7483
cmp eax, edi
je 0x4a78f7
test byte [esi + 0x24], 0x10
je 0x4a78c5
push 4
mov ecx, esi
pop ebx
call fcn.004ab48f
test ah, 1
je 0x4a78bd
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.004aab79
cmp dword [esi + 0x1c], edi
je 0x4a78f7
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.004ab61b
jmp 0x4a78f7
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x4a790b
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x4a7924
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x4a7924
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.004a77a2
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x4a8b20
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4a8b58
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004a4e83
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004a4e5b
jmp 0x4a8b64
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x4aa922
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4aa964
call fcn.004b5e41
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4aa964
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4aa95b
xor eax, eax
jmp 0x4aa96c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004aa972
pop edi
pop esi
pop ebx
ret 4
Function at 0x710c76
Capabilities:
Encode data using xor

Disassembly:
push 0x7109ec
pop edx
add esi, esi
call fcn.00710c9e
add ebx, ebx
xor dword [ecx], edx
sub ebx, 0x791ff237
dec esi
inc ecx
sub ebx, ebx
cmp ecx, edi
jne fcn.00710c76
sub ebx, esi
ret
Function at 0x401486
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
push esi
xor esi, esi
cmp dword [0x2442e54], 0x400
push edi
jne 0x401504
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push str.nihunigufemakulidoyudu
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DrawStateW]
push esi
push esi
call fcn.00401dab
push esi
push esi
call fcn.0040175c
push esi
call fcn.00401d46
push esi
call fcn.00402014
push esi
push esi
call fcn.00401b91
push esi
call fcn.00402088
push esi
push esi
call fcn.00401660
push esi
call fcn.00401e58
add esp, 0x30
push ebx
mov ebx, dword [sym.imp.GDI32.dll_GetCharWidthI]
xor edi, edi
cmp edi, 0xacc
jge 0x401539
push esi
push esi
call dword [sym.imp.USER32.dll_SetCaretPos]
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_GetCharABCWidthsI]
push esi
push esi
push esi
push esi
push esi
call ebx
push esi
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp edi, 0x45be411
jg 0x401553
inc edi
cmp edi, 0x3330601
jl 0x40150d
xor edi, edi
cmp edi, 0x16d2a
jge 0x401564
push esi
push esi
push esi
push esi
push esi
call ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalCompact]
cmp edi, 0x12e82fe
jg 0x401588
inc edi
cmp edi, 0x3011b
jl 0x401555
mov eax, dword [0x425804]
mov dword [0x2442e54], eax
call fcn.004011ea
mov edi, 0x2ec37
pop ebx
cmp dword [0x2442e54], 0x51f
jne 0x4015b7
push esi
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec edi
jne 0x40159d
pop edi
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x4075e1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422cdc]
jne 0x4075eb
repz ret
jmp fcn.004095a6
Function at 0x408836
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x422cdc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405a01
and dword [ebp - 0x14], 0
cmp dword [0x430418], 0
mov dword [ebp - 0x18], eax
jne 0x4088e9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408991
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x408991
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x430418], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x43041c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x430420], eax
call edi
push eax
call esi
mov dword [0x430428], eax
test eax, eax
je 0x4088e9
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x430424], eax
mov eax, dword [0x430424]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x408942
cmp dword [0x430428], ecx
je 0x408942
push eax
call esi
push dword [0x430428]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x408942
test ebx, ebx
je 0x408942
call edi
test eax, eax
je 0x408939
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x408939
test byte [ebp - 8], 1
jne 0x408942
or dword [ebp + 0x10], 0x200000
jmp 0x408975
mov eax, dword [0x43041c]
cmp eax, dword [ebp - 0x18]
je 0x408975
push eax
call esi
test eax, eax
je 0x408975
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x408975
mov eax, dword [0x430420]
cmp eax, dword [ebp - 0x18]
je 0x408975
push eax
call esi
test eax, eax
je 0x408975
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x430418]
call esi
test eax, eax
je 0x408991
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408993
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004075e1
leave
ret
Function at 0x401230
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x423004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
push edi
push str.run_child:_about_to_run__ls_n
call fcn.004010c0
add esp, 8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
mov esi, eax
lea eax, [ebp - 0x7c]
push eax
push 0x70
lea eax, [ebp - 0x78]
push eax
push 9
push esi
call dword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
test eax, eax
je 0x4013fa
cmp dword [ebp - 0x7c], 0x70
jne 0x4013fa
test esi, esi
je 0x4013fa
or dword [ebp - 0x68], 0x3000
lea eax, [ebp - 0x78]
push 0x70
push eax
push 9
push esi
call dword [sym.imp.KERNEL32.dll_SetInformationJobObject]
test eax, eax
jne 0x4012b5
push str.Job_information_setting_failed
push 0x65
call fcn.00401110
push 0x44
lea eax, [ebp - 0xd8]
push 0
push eax
call fcn.00402e90
add esp, 0xc
lea eax, [ebp - 0xd8]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff6
call ebx
lea edx, [ebp - 0xa0]
mov ecx, eax
call fcn.004011c0
test eax, eax
jne 0x4012fc
push str.stdin_duplication_failed
push 0x64
call fcn.00401110
push 0xfffffffffffffff5
call ebx
lea edx, [ebp - 0x9c]
mov ecx, eax
call fcn.004011c0
test eax, eax
jne 0x40131d
push str.stdout_duplication_failed
push 0x64
call fcn.00401110
push 0xfffffffffffffff4
call ebx
lea edx, [ebp - 0x98]
mov ecx, eax
call fcn.004011c0
test eax, eax
jne 0x40133e
push str.stderr_duplication_failed
push 0x64
call fcn.00401110
push 1
push 0x401220
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
jne 0x40135b
push str.control_handler_setting_failed
push 0x65
call fcn.00401110
lea eax, [ebp - 0x8c]
mov dword [ebp - 0xac], 0x100
push eax
lea eax, [ebp - 0xd8]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x401399
push edi
push str.Unable_to_create_process_using__ls
push 0x65
call fcn.00401110
push dword [ebp - 0x8c]
push esi
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
push dword [ebp - 0x88]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0xffffffffffffffff
push dword [ebp - 0x8c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x8c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x4013e2
push str.Failed_to_get_exit_code_of_process
push 0x65
call fcn.00401110
push dword [ebp - 0x7c]
push str.child_process_exit_code:__d_n
call fcn.004010c0
add esp, 8
push dword [ebp - 0x7c]
call fcn.004056e1
push str.Job_information_querying_failed
push 0x65
call fcn.00401110
int3

Function at 0x40559b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4055da
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4055da
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4055da
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4055da
cmp dword [ecx + 0x74], 0xe
jbe 0x4055da
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40f036
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41cc5c
push 0x41cc54
push str.FlsAlloc
push 0x1f
call fcn.0040ef14
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40f06a
push dword [ebp + 8]
mov ecx, esi
call dword [0x41b15c]
call esi
jmp 0x40f070
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40f0b4
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41cc6c
push 0x41cc64
push str.FlsGetValue
push 0x21
call fcn.0040ef14
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40f0eb
push dword [ebp + 8]
mov ecx, esi
call dword [0x41b15c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40f0f3
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41cc74
push 0x41cc6c
push str.FlsSetValue
push 0x22
call fcn.0040ef14
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40f12d
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x41b15c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4107cc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x424140]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41080c
cmp byte [ebx], 0xa
jne 0x41080c
or byte [edi + eax + 0x28], 4
jmp 0x410811
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x410910
mov dl, byte [eax]
cmp dl, 0x1a
je 0x4108f3
inc eax
cmp dl, 0xd
je 0x41083d
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x410863
cmp eax, ecx
jae 0x410871
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x410825
jmp 0x410910
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4108ee
cmp dword [ebp - 0x10], 0
je 0x4108ee
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x424140]
test byte [eax + edi + 0x28], 0x48
je 0x4108c8
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4108b3
mov byte [esi], dl
jmp 0x4108c4
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x424140]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x410910
cmp byte [ebp - 1], 0xa
jne 0x4108d7
cmp esi, ebx
jne 0x4108d7
mov byte [esi], 0xa
jmp 0x41090f
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004162e1
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x410910
mov byte [esi], 0xd
jmp 0x41090f
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x424140]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41090d
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x410910
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x410919
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x424140]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41095f
cmp word [ebx], dx
jne 0x41095f
or byte [eax + edi + 0x28], 4
jmp 0x410964
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x410ac7
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x410aa7
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x4109a5
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4109db
cmp eax, edx
jae 0x4109e9
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x410980
jmp 0x410ac7
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x410aa2
cmp dword [ebp - 0x18], 0
je 0x410aa2
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x424140]
test byte [eax + edi + 0x28], 0x48
je 0x410a78
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x410a3c
mov word [esi], cx
jmp 0x410a73
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x424140]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x424140]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x424140]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x410ac7
pop eax
cmp word [ebp - 4], ax
jne 0x410a88
cmp esi, ebx
jne 0x410a88
mov word [esi], ax
jmp 0x410ac4
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004162e1
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x410ac7
push 0xd
pop eax
jmp 0x410a83
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x424140]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x410ac1
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x410ac7
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret