joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42bdf3
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call sub.MSVCRT.dll_strlen
mov edi, eax
mov eax, dword [0x495d60]
test eax, eax
pop ecx
je 0x42be11
push eax
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
test eax, eax
mov dword [0x495d60], eax
jne 0x42be32
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby187g.exc_rb_w32_map_errno
pop ecx
xor eax, eax
pop edi
pop esi
ret
cmp byte [eax], 0
mov esi, eax
je 0x42be2d
push edi
push dword [esp + 0x10]
push esi
call dword [sym.imp.MSVCRT.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x42be52
cmp byte [esi + edi], 0x3d
je 0x42be66
push esi
call sub.MSVCRT.dll_strlen
cmp byte [esi + eax + 1], 0
lea esi, [esi + eax + 1]
pop ecx
jne 0x42be39
jmp 0x42be2d
lea eax, [esi + edi + 1]
jmp 0x42be2f

Function at 0x42be6c
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ecx
and dword [esp], 0
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push edi
push ebp
call esi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
push edi
call esi
or esi, 0xffffffff
mov ebx, eax
cmp dword [esp + 0x18], esi
jne 0x42beb4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby187g.exc_rb_w32_map_errno
pop ecx
mov edi, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], edi
mov eax, esi
jmp 0x42bf22
call sym.ruby187g.exc_rb_w32_enter_critical
cmp ebx, esi
je 0x42becd
test bl, 1
je 0x42becd
and ebx, 0xfffffffe
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileA]
push edi
push ebp
call ebx
test eax, eax
jne 0x42bf0e
mov dword [esp + 0x10], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
sub eax, 0x50
je 0x42bef1
sub eax, 0x67
jne 0x42bf44
call sym.ruby187g.exc_rb_w32_osid
cmp eax, 2
jne 0x42bf28
push 1
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x42bf44
and dword [esp + 0x10], 0
push dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call sym.ruby187g.exc_rb_w32_leave_critical
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x42bf3a
call esi
cmp eax, 2
jne 0x42bf44
push edi
push ebp
call ebx
test eax, eax
je 0x42bf28
jmp 0x42bf09
call esi
push eax
call sym.ruby187g.exc_rb_w32_map_errno
pop ecx
mov esi, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], esi
jmp 0x42bf19
Function at 0x42c0c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x24
push 0
push esi
call sub.MSVCRT.dll_memset
mov edi, dword [ebp + 8]
push 0x4834d4
push edi
mov word [esi + 8], 1
call sub.MSVCRT.dll__mbspbrk
add esp, 0x14
test eax, eax
je 0x42c105
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 2
jmp 0x42c1a1
lea eax, [ebp - 0x140]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x42c16a
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
push dword [ebp - 0x140]
call fcn.0042c22e
mov word [esi + 6], ax
lea eax, [ebp - 0x134]
push eax
call fcn.0042c211
mov dword [esi + 0x18], eax
lea eax, [ebp - 0x12c]
push eax
call fcn.0042c211
mov dword [esi + 0x1c], eax
lea eax, [ebp - 0x13c]
push eax
call fcn.0042c211
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x120]
add esp, 0x14
mov dword [esi + 0x14], eax
jmp 0x42c1b3
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42c191
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby187g.exc_rb_w32_map_errno
pop ecx
mov esi, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], esi
jmp 0x42c1a1
test bl, 0x10
je 0x42c1a6
push edi
call fcn.0042c2db
test eax, eax
pop ecx
je 0x42c1a6
or eax, 0xffffffff
jmp 0x42c20c
push edi
push ebx
call fcn.0042c22e
pop ecx
mov word [esi + 6], ax
pop ecx
mov eax, dword [sym.imp.MSVCRT.dll___mb_cur_max]
cmp dword [eax], 1
jle 0x42c1d0
movsx eax, byte [edi]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__isctype]
pop ecx
pop ecx
jmp 0x42c1e4
mov ecx, dword [sym.imp.MSVCRT.dll__pctype]
movsx eax, byte [edi]
mov ecx, dword [ecx]
mov ax, word [ecx + eax*2]
and eax, 0x103
test eax, eax
je 0x42c1fe
cmp byte [edi + 1], 0x3a
jne 0x42c1fe
movsx eax, byte [edi]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
sub eax, 0x41
jmp 0x42c205
call dword [sym.imp.MSVCRT.dll__getdrive]
dec eax
mov dword [esi + 0x10], eax
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42c40a
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
call sym.ruby187g.exc_rb_w32_osid
cmp eax, 2
jne 0x42c421
call fcn.0042c480
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
ret
cmp dword [0x483208], 0xffffffff
jne 0x42c435
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x483208], eax
push ebx
push esi
push edi
push dword [0x483208]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov esi, 0x483204
mov ebx, eax
push esi
call edi
test eax, eax
jle 0x42c46e
test ebx, ebx
jne 0x42c46e
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
jmp 0x42c452
inc ebx
push ebx
push dword [0x483208]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
ret
Function at 0x42c4a4
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
call sym.ruby187g.exc_rb_w32_osid
cmp eax, 2
jne 0x42c4bb
call fcn.0042c480
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
ret
push 0x483204
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push dword [0x483208]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
dec eax
push eax
push dword [0x483208]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
ret

Function at 0x42c4ee
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5b4
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push eax
mov dword [ebp - 4], eax
call esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x49549c]
jne 0x42c522
xor eax, eax
jmp 0x42c67c
push ebx
push edi
call sym.ruby187g.exc_rb_w32_interrupted
call sym.ruby187g.exc_rb_w32_enter_critical
push dword [0x495498]
mov ebx, dword [sym.imp.KERNEL32.dll_SuspendThread]
call ebx
push dword [0x495498]
call esi
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0x2cc
lea eax, [ebp - 0x2e8]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x2e8]
mov dword [ebp - 0x2e8], 0x1000f
push eax
push dword [0x495498]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov eax, dword [0x495da0]
mov ecx, 0xb3
lea esi, [ebp - 0x2e8]
lea edi, [ebp - 0x5b4]
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
cmp eax, ecx
jne 0x42c5b0
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x495da0], eax
jmp 0x42c5b7
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [0x495da0]
lea eax, [ebp - 0x1c]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call fcn.0042c67f
push eax
lea eax, [ebp - 0x2e8]
push eax
call fcn.0042c6a0
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadContext]
add esp, 0x18
lea eax, [ebp - 0x2e8]
mov dword [ebp - 0x2e8], 0x10001
push eax
push dword [0x495498]
call esi
push dword [0x495498]
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
call edi
call sym.ruby187g.exc_rb_w32_leave_critical
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xffffffffffffffff
push dword [0x495da0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0x14], 0
jne 0x42c66b
call sym.ruby187g.exc_rb_w32_enter_critical
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x10], 0
je 0x42c62f
push dword [0x495498]
call ebx
lea eax, [ebp - 0x5b4]
mov dword [ebp - 0x5b4], 0x1000f
push eax
push dword [0x495498]
call esi
push dword [0x495498]
call edi
call sym.ruby187g.exc_rb_w32_leave_critical
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 1
pop eax
pop edi
pop ebx
pop esi
leave
ret
Function at 0x42c871
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], esi
call sym.ruby187g.exc_rb_w32_enter_critical
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push esi
push eax
push 0x42c9c1
push esi
push esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
cmp ebx, esi
je 0x42c958
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call edi
cmp dword [ebp - 0x20], esi
je 0x42c8c8
push 0xffffffffffffffff
push ebx
call fcn.0042c3bf
pop ecx
test eax, eax
pop ecx
je 0x42c8f6
push dword [ebp + 0x18]
mov dword [ebp - 4], 1
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x42c8f6
push esi
call edi
lea eax, [ebp - 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], esi
pop edi
je 0x42c94d
push 0x1c
lea eax, [ebp - 0x3c]
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x3c]
push 0x1c
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x42c93f
push 0x8000
push esi
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 4
jmp 0x42c958
call dword [sym.imp.MSVCRT.dll__errno]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
call sym.ruby187g.exc_rb_w32_leave_critical
cmp ebx, esi
jne 0x42c972
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.failed_to_launch_waiter_thread:_d
call sym.ruby187g.exc_rb_fatal
cmp dword [ebp - 4], esi
je 0x42c9ba
cmp dword [sym.ruby187g.exc_rb_prohibit_interrupt], esi
jne 0x42c9ad
cmp dword [sym.ruby187g.exc_rb_thread_critical], esi
jne 0x42c9ad
cmp dword [sym.ruby187g.exc_rb_thread_pending], esi
jne 0x42c99e
mov eax, dword [sym.ruby187g.exc_rb_thread_tick]
dec dword [sym.ruby187g.exc_rb_thread_tick]
test eax, eax
jg 0x42c9ad
mov dword [sym.ruby187g.exc_rb_thread_tick], 0x1f4
call sym.ruby187g.exc_rb_thread_schedule
cmp dword [sym.ruby187g.exc_rb_trap_pending], esi
je 0x42c9ba
call sym.ruby187g.exc_rb_trap_exec
mov eax, dword [ebp - 8]
pop esi
pop ebx
leave
ret
Function at 0x42c9f0
Capabilities:
Query environment variable

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov esi, eax
xor ebx, ebx
mov edi, esi
mov al, byte [esi]
test al, al
je 0x42ca1b
cmp al, 0x3d
je 0x42ca0c
inc ebx
push edi
call sub.MSVCRT.dll_strlen
lea edi, [edi + eax + 1]
pop ecx
mov al, byte [edi]
jmp 0x42ca03
lea eax, [ebx*4 + 4]
mov ebx, dword [sym.imp.MSVCRT.dll_malloc]
push eax
call ebx
cmp byte [esi], 0
mov ebp, eax
pop ecx
mov dword [esp + 0x10], ebp
mov edi, esi
je 0x42ca6f
cmp byte [edi], 0x3d
je 0x42ca5d
push edi
call sub.MSVCRT.dll_strlen
inc eax
push eax
call ebx
pop ecx
mov dword [ebp], eax
test eax, eax
pop ecx
je 0x42ca6f
push edi
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
add ebp, 4
pop ecx
push edi
call sub.MSVCRT.dll_strlen
cmp byte [edi + eax + 1], 0
lea edi, [edi + eax + 1]
pop ecx
jne 0x42ca39
and dword [ebp], 0
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x42cc04
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__get_osfhandle]
push eax
call fcn.0042acdb
pop ecx
test eax, eax
pop ecx
jne 0x42cc30
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
pop ebp
ret
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sym.ruby187g.exc_rb_w32_recv
add esp, 0x10
pop ebp
ret
Function at 0x42cc86
Capabilities:
Check if file exists
Get file attributes
Set file attributes
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
lea eax, [ebp - 0x34]
push edi
push eax
push dword [ebp + 8]
xor edi, edi
call sym.ruby187g.exc_rb_w32_stat
pop ecx
test eax, eax
pop ecx
jne 0x42cccc
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 8]
cmp esi, edi
push eax
je 0x42ccd4
push dword [esi]
call fcn.0042cda8
pop ecx
test eax, eax
pop ecx
jne 0x42cccc
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
call fcn.0042cda8
pop ecx
test eax, eax
pop ecx
je 0x42cce6
or eax, 0xffffffff
jmp 0x42cda4
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push ebx
call sym.ruby187g.exc_rb_w32_enter_critical
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42cd0d
test bl, 1
je 0x42cd0d
and al, 0xfe
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call sym.ruby187g.exc_rb_w32_osid
dec eax
neg eax
sbb eax, eax
and eax, 0x2000000
push eax
push 3
push edi
push edi
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42cd53
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby187g.exc_rb_w32_map_errno
pop ecx
mov esi, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], esi
or edi, 0xffffffff
jmp 0x42cd88
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x42cd81
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby187g.exc_rb_w32_map_errno
pop ecx
mov edi, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], edi
or edi, 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0xffffffff
je 0x42cd9c
test bl, 1
je 0x42cd9c
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call sym.ruby187g.exc_rb_w32_leave_critical
mov eax, edi
pop ebx
pop edi
pop esi
leave
ret

Function at 0x42ce84
Capabilities:
Create directory
Delete directory

Disassembly:
push esi
or esi, 0xffffffff
call sym.ruby187g.exc_rb_w32_enter_critical
push 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x42ceb5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.MSVCRT.dll__chmod]
pop ecx
cmp eax, esi
pop ecx
je 0x42ced0
xor esi, esi
jmp 0x42ceda
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby187g.exc_rb_w32_map_errno
pop ecx
mov edi, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], edi
pop edi
jmp 0x42ceda
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
call sym.ruby187g.exc_rb_w32_leave_critical
mov eax, esi
pop esi
ret
Function at 0x42cee3
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
push ebx
push ebp
push esi
push edi
xor ebp, ebp
call sym.ruby187g.exc_rb_w32_enter_critical
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42cf11
test bl, 1
je 0x42cf11
and al, 0xfe
push eax
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x42cf43
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby187g.exc_rb_w32_map_errno
pop ecx
mov ebp, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], ebp
or ebp, 0xffffffff
cmp ebx, ebp
je 0x42cf43
test bl, 1
je 0x42cf43
push ebx
push esi
call edi
call sym.ruby187g.exc_rb_w32_leave_critical
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret

Function at 0x42cf4f
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebx
push ebp
push esi
push edi
xor ebp, ebp
call sym.ruby187g.exc_rb_w32_enter_critical
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42cf7d
test bl, 1
je 0x42cf7d
and al, 0xfe
push eax
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x42cfaf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby187g.exc_rb_w32_map_errno
pop ecx
mov ebp, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], ebp
or ebp, 0xffffffff
cmp ebx, ebp
je 0x42cfaf
test bl, 1
je 0x42cfaf
push ebx
push esi
call edi
call sym.ruby187g.exc_rb_w32_leave_critical
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret
Function at 0x42d8fc
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx + 4]
test eax, eax
jg 0x42d90a
xor eax, eax
ret
cmp eax, dword [esp + 8]
jle 0x42d914
mov eax, dword [esp + 8]
push ecx
push eax
push 1
push dword [esp + 0x10]
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
ret
Function at 0x42ee0e
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x404
push ebx
push ebp
push esi
mov esi, dword [eax]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ebx, sym.ruby187g.exc_rb_trap_immediate
mov eax, dword [esi + 4]
test eax, eax
jle 0x42ee83
mov ecx, dword [esi]
mov edx, 0x400
cmp eax, edx
jbe 0x42ee3d
mov eax, edx
movsx edx, byte [ecx]
cmp edx, dword [esp + 0x41c]
jne 0x42ef42
lea edx, [eax - 1]
test edx, edx
je 0x42ee65
movsx ebp, byte [ecx + 1]
inc ecx
cmp ebp, dword [esp + 0x41c]
jne 0x42ee65
dec edx
jne 0x42ee54
sub eax, edx
push esi
push eax
lea eax, [esp + 0x1c]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
test eax, eax
je 0x42ef29
jmp 0x42ee29
push esi
call dword [sym.imp.MSVCRT.dll__fileno]
push eax
call sym.ruby187g.exc_rb_thread_wait_fd
push dword [esp + 0x420]
call sym.ruby187g.exc_rb_io_check_closed
push esi
call dword [sym.imp.MSVCRT.dll_clearerr]
add esp, 0x10
push 1
push ebx
call edi
push esi
mov ebp, eax
call sym.ruby187g.exc_rb_w32_getc
pop ecx
mov dword [esp + 0x10], eax
push ebp
push ebx
call edi
call dword [sym.imp.MSVCRT.dll__errno]
mov ebp, dword [eax]
xor eax, eax
cmp dword [sym.ruby187g.exc_rb_prohibit_interrupt], eax
jne 0x42eefc
cmp dword [sym.ruby187g.exc_rb_thread_critical], eax
jne 0x42eefc
cmp dword [sym.ruby187g.exc_rb_thread_pending], eax
jne 0x42eeed
mov eax, dword [sym.ruby187g.exc_rb_thread_tick]
dec dword [sym.ruby187g.exc_rb_thread_tick]
test eax, eax
jg 0x42eefc
mov dword [sym.ruby187g.exc_rb_thread_tick], 0x1f4
call sym.ruby187g.exc_rb_thread_schedule
cmp dword [sym.ruby187g.exc_rb_trap_pending], 0
je 0x42ef0a
call sym.ruby187g.exc_rb_trap_exec
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], ebp
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x41c]
jne 0x42ef38
cmp eax, 0xffffffff
je 0x42ef47
jmp 0x42ee29
mov eax, dword [esp + 0x418]
push dword [eax + 0x14]
call sym.ruby187g.exc_rb_sys_fail
push esi
push eax
call dword [sym.imp.MSVCRT.dll_ungetc]
pop ecx
pop ecx
push 2
pop eax
jmp 0x42ef49
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x404
ret
Function at 0x44468c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov cl, byte [esi]
movsx eax, cl
cmp eax, 0x30
jg 0x44478c
cmp eax, 0x2e
jge 0x4447ad
cmp eax, 0x27
jg 0x4446fa
cmp eax, 0x26
jge 0x4447ad
cmp eax, 0x21
jl 0x4446ce
cmp eax, 0x22
jle 0x4447ad
cmp eax, 0x24
je 0x4447ad
cmp cl, 0x80
jae 0x444802
mov eax, dword [sym.imp.MSVCRT.dll___mb_cur_max]
mov edi, dword [sym.imp.MSVCRT.dll__isctype]
cmp dword [eax], 1
jle 0x4447b0
movzx eax, cl
push 4
push eax
call edi
pop ecx
pop ecx
jmp 0x4447c1
cmp eax, 0x2a
jl 0x4446ce
cmp eax, 0x2c
jle 0x4447ad
cmp eax, 0x2d
jne 0x4446ce
mov cl, byte [esi + 1]
inc esi
movzx eax, cl
mov edx, eax
xor edx, 0x80
sub edx, 0x80
cmp edx, 0xffffffff
je 0x4447f9
cmp cl, 0x80
jae 0x444760
mov ecx, dword [sym.imp.MSVCRT.dll___mb_cur_max]
cmp dword [ecx], 1
jle 0x44474b
push 0x107
push eax
call dword [sym.imp.MSVCRT.dll__isctype]
pop ecx
pop ecx
jmp 0x44475c
mov ecx, dword [sym.imp.MSVCRT.dll__pctype]
mov ecx, dword [ecx]
mov ax, word [ecx + eax*2]
and eax, 0x107
test eax, eax
jne 0x444779
mov al, byte [esi]
cmp al, 0x5f
je 0x444779
mov ecx, dword [sym.ruby187g.exc_re_mbctab]
movzx eax, al
cmp byte [eax + ecx], 0
je 0x4447f9
movzx eax, byte [esi]
mov ecx, dword [sym.ruby187g.exc_re_mbctab]
movzx eax, byte [eax + ecx]
lea esi, [esi + eax + 1]
jmp 0x4447f9
cmp eax, 0x3a
jl 0x4446ce
cmp eax, 0x40
jle 0x4447ad
cmp eax, 0x5c
je 0x4447ad
cmp eax, 0x60
je 0x4447ad
cmp eax, 0x7e
jne 0x4446ce
inc esi
jmp 0x4447f9
movzx eax, cl
mov ecx, dword [sym.imp.MSVCRT.dll__pctype]
mov ecx, dword [ecx]
mov al, byte [ecx + eax*2]
and eax, 4
test eax, eax
je 0x444802
mov al, byte [esi + 1]
inc esi
cmp al, 0x80
jae 0x4447f9
mov ecx, dword [sym.imp.MSVCRT.dll___mb_cur_max]
cmp dword [ecx], 1
jle 0x4447e4
movzx eax, al
push 4
push eax
call edi
pop ecx
pop ecx
jmp 0x4447f5
mov ecx, dword [sym.imp.MSVCRT.dll__pctype]
movzx eax, al
mov ecx, dword [ecx]
mov al, byte [ecx + eax*2]
and eax, 4
test eax, eax
jne 0x4447c5
xor eax, eax
cmp byte [esi], al
sete al
jmp 0x444804
xor eax, eax
pop edi
pop esi
ret

Function at 0x44671a
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [sym.ruby187g.exc_rb_curr_thread]
push esi
push edi
mov edi, dword [0x495e84]
test edi, edi
je 0x446763
mov eax, dword [ecx + 0x84]
mov edx, 0x4000
mov esi, eax
and esi, edx
je 0x446746
cmp dword [sym.ruby187g.exc_ruby_safe_level], 4
jl 0x446763
test esi, esi
je 0x446750
push edi
call sym.ruby187g.exc_rb_exc_jump
or eax, edx
mov dword [ecx + 0x84], eax
push dword [0x495e84]
call sym.ruby187g.exc_rb_exc_raise
mov eax, dword [sym.imp.MSVCRT.dll__iob]
push str._FATAL__failed_to_allocate_memory_n
add eax, 0x40
push eax
call dword [sym.imp.MSVCRT.dll_fprintf]
pop ecx
pop ecx
push 1
call dword [sym.imp.MSVCRT.dll_exit]
Function at 0x446781
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
test esi, esi
jge 0x44679c
push str.negative_allocation_size__or_too_big_
push dword [sym.ruby187g.exc_rb_eNoMemError]
call sym.ruby187g.exc_rb_raise
jne 0x4467a1
push 1
pop esi
cmp dword [sym.ruby187g.exc_ruby_gc_stress], 0
jne 0x4467b9
mov eax, dword [0x496eac]
add eax, esi
cmp eax, dword [0x48630c]
jbe 0x4467be
call fcn.00447091
call sym.ruby187g.exc_rb_w32_enter_critical
mov ebx, dword [sym.imp.MSVCRT.dll_malloc]
push esi
call ebx
pop ecx
mov edi, eax
call sym.ruby187g.exc_rb_w32_leave_critical
test edi, edi
jne 0x4467f6
call fcn.00447091
call sym.ruby187g.exc_rb_w32_enter_critical
push esi
call ebx
pop ecx
mov edi, eax
call sym.ruby187g.exc_rb_w32_leave_critical
test edi, edi
jne 0x4467f6
jmp sym.ruby187g.exc_rb_memerror
add dword [0x496eac], esi
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x4468b1
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [esp + 4], 0
je 0x4468cd
call sym.ruby187g.exc_rb_w32_enter_critical
push dword [esp + 4]
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
jmp sym.ruby187g.exc_rb_w32_leave_critical
ret