joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419e92
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x419ed9
call fcn.0041d070
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x419ed9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x419ef5
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00419a0c
mov esi, eax
test edi, edi
je 0x419ef3
test ebx, ebx
je 0x419ef3
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41b00f
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [0x4594f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x11c], eax
mov esi, ecx
lea eax, [ebp - 0x120]
jne 0x41b0ad
push 0x44886c
push 4
push eax
call fcn.00432c64
push eax
call fcn.00411520
add esp, 0x10
push ebx
push edi
call fcn.00431b25
mov edi, dword [eax]
call fcn.00431b25
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.0042fda2
add esp, 0x18
mov dword [ebp - 0x11c], eax
call fcn.00431b25
cmp dword [eax], ebx
je 0x41b0c4
call fcn.00431b25
push dword [eax]
call fcn.00414930
pop ecx
jmp 0x41b0cb
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x41b055
jmp 0x41b152
call fcn.00431b25
mov dword [eax], edi
cmp dword [ebp - 0x11c], 0xffffffff
je 0x41b14e
cmp dword [ebp - 0x11c], esi
jae 0x41b14e
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x15c]
push ebx
push eax
mov dword [ebp - 0x160], 0x40
call fcn.00431e40
add esp, 0xc
push str.KERNEL32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
je 0x41b13d
push str.FindActCtxSectionStringA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x41b13d
lea ecx, [ebp - 0x160]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x41b13d
push ebx
push ebx
push esi
jmp 0x41b146
push ebx
push ebx
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x41b150
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0042f79c
leave
ret
Function at 0x41bd57
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x41bd9f
call fcn.0041d070
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x41bd9f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x41bde2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x41bdcb
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x41bdcb
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x41bddf
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x42f79c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4594f0]
jne 0x42f7a6
repz ret
jmp fcn.0043400f
Function at 0x43dbc8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00434ac7
and dword [ebp - 4], 0
cmp dword [0x45db64], 0
mov ebx, eax
jne 0x43dc79
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x43dd2a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x44b6c0
push edi
call esi
test eax, eax
je 0x43dd2a
push eax
call fcn.00434a55
mov dword [esp], 0x44b6b0
push edi
mov dword [0x45db64], eax
call esi
push eax
call fcn.00434a55
mov dword [esp], 0x44b69c
push edi
mov dword [0x45db68], eax
call esi
push eax
call fcn.00434a55
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x45db6c], eax
call esi
push eax
call fcn.00434a55
pop ecx
mov dword [0x45db74], eax
test eax, eax
je 0x43dc79
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00434a55
pop ecx
mov dword [0x45db70], eax
mov eax, dword [0x45db70]
cmp eax, ebx
je 0x43dcd1
cmp dword [0x45db74], ebx
je 0x43dcd1
push eax
call fcn.00434ad0
push dword [0x45db74]
mov esi, eax
call fcn.00434ad0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x43dcd1
test edi, edi
je 0x43dcd1
call esi
test eax, eax
je 0x43dcc8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43dcc8
test byte [ebp - 0xc], 1
jne 0x43dcd1
or dword [ebp + 0x10], 0x200000
jmp 0x43dd0a
mov eax, dword [0x45db68]
cmp eax, ebx
je 0x43dd0a
push eax
call fcn.00434ad0
pop ecx
test eax, eax
je 0x43dd0a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x43dd0a
mov eax, dword [0x45db6c]
cmp eax, ebx
je 0x43dd0a
push eax
call fcn.00434ad0
pop ecx
test eax, eax
je 0x43dd0a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45db64]
call fcn.00434ad0
pop ecx
test eax, eax
je 0x43dd2a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43dd2c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x9058f7
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x905944
pushfd
mov word [esp], ax
mov dword [esp], esi
pushfd
xchg dword [esp + 0xc], eax
call 0x905926
lea ecx, [ecx]
cdq
clc
or edi, dword [eax + 0x66e24b28]
mov dword [esp + 1], ebp
mov word [esp], dx
call fcn.009058cb
sbb eax, 0x2de8
add byte [ecx - 0x76f3db94], cl
je 0x905956
or byte [eax - 0x77], ah
jl 0x90595b
and al, 0x8d
and al, 0x24
jmp 0x90595f
jmp 0x9058fc
adc al, 0xc2
sbb byte [eax], al
pushfd
jmp 0x9058a7

Function at 0x905917
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x905944
pushfd
mov word [esp], ax
mov dword [esp], esi
pushfd
xchg dword [esp + 0xc], eax
call 0x905926
lea ecx, [ecx]
cdq
clc
or edi, dword [eax + 0x66e24b28]
mov dword [esp + 1], ebp
mov word [esp], dx
call fcn.009058cb
sbb eax, 0x2de8
add byte [ecx - 0x76f3db94], cl
je 0x905956
or byte [eax - 0x77], ah
jl 0x90595b
and al, 0x8d
and al, 0x24
jmp 0x90595f
jmp 0x9058fc
adc al, 0xc2
sbb byte [eax], al
pushfd
jmp 0x9058a7

Function at 0x905926
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x905944
pushfd
mov word [esp], ax
mov dword [esp], esi
pushfd
xchg dword [esp + 0xc], eax
call 0x905926
lea ecx, [ecx]
cdq
clc
or edi, dword [eax + 0x66e24b28]
mov dword [esp + 1], ebp
mov word [esp], dx
call fcn.009058cb
sbb eax, 0x2de8
add byte [ecx - 0x76f3db94], cl
je 0x905956
or byte [eax - 0x77], ah
jl 0x90595b
and al, 0x8d
and al, 0x24
jmp 0x90595f
jmp 0x9058fc
adc al, 0xc2
sbb byte [eax], al
pushfd
jmp 0x9058a7

Function at 0x914e52
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
call fcn.00914e1b
push word [esp]
mov word [esp + 2], si
push dword [esp + 1]
jmp 0x914e85
push sp
lea esp, [esp + 2]
push eax
mov ebx, esp
mov ax, word [esp]
xchg al, bh
jmp 0x9156d7
lea esp, [esp + 2]
mov dword [esp + 3], ebx
setne bh
mov bl, 0x54
lea ebx, [ebx*4]
mov bh, 0x86
jmp 0x914e6f
lea eax, [esp - 0x30d]
mov ebx, ecx
lea eax, [ebp - 0xa1f4]
push edi
call fcn.009152f7
Function at 0x915e24
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x915d97
jmp 0x8f9c26
lea esp, [esp + 4]
jmp 0x8f9c49
jmp 0x914ecc
call fcn.00915dd3
outsb dx, byte [esi]
jns 0x915df7
mov ebx, 0xc563bd2e
push 0x4c
rcr dh, cl
xlatb
wait
pop es
xchg edi, eax
add dword [edx + 0x5566153a], edi
lea esp, [esp + 2]
jmp 0x933b86
out 0x77, eax
adc ah, cl
push eax
lcall 0xeb49, 0x7e17e4f5
lea ebp, ss:[edi + 0x570a]
mov ebp, dword [esp]
mov edi, dword [esp]
mov edi, 0xebc922eb
call fcn.00915e24
push ds
imul ecx, dword [eax - 0x2117bdd5], 0xfffffff
bswap ebp
mov dword [esp], ebx
jmp 0x93388e
pop edi
mov esi, esp
jmp 0x933920
call fcn.00933885
mov cl, 0x2a
mov eax, 0xd1e82adf
dec edi
fistp qword [edx - 0x629d1ab7]
in al, dx
inc esi
pop word [esp]
lea esp, [esp + 2]
jmp 0x9338a4
push sp
lea esp, [esp + 2]
jmp 0x9338ad
je 0x93382e
inc edx
inc esi
jmp 0x93380b
mov cl, byte [esi]
mov edi, dword [esp]
movzx eax, byte [edx]
jmp 0x9338eb
lea esp, [esp + 0x20]
jmp 0x93380b
sub eax, edi
jmp 0x933936
movzx edi, cl
sub esp, 0x1f
mov word [esp + 0x14], ax
add esp, 0x17
jmp 0x9338d5
pushfd
xchg word [esp + 1], si
pop word [esp]
lea esp, [esp + 2]
mov esi, eax
jmp 0x9338cc
pop esi
call fcn.009339fc
jns 0x933980
mov ebx, 0x97330192
ror cl, cl
pop ecx
add eax, dword [esi - 0x2a]
or eax, 0x648def9c
and al, 8
lea esp, [esp + 8]
je 0x933859
jne 0x93382e
or eax, 0xffffffff
ret
lea esp, [esp + 4]
inc eax
jmp 0x933c50
mov dword [esp + 0x20], esi
push ebx
bswap esi
mov si, 0x2f86
mov dword [esp + 0x20], edi
jmp 0x93390e
push cx
pushal
mov dword [esp + 7], edi
push dword [esp + 0x1c]
lea esp, [esp + 2]
jmp 0x933a71
ret
Function at 0xac32bd
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf di, sp
setb dl
mov dword [esp + 3], esi
rdtsc
sub esp, 0x15
jmp 0xac32c3
pop eax
push word [esp + 9]
push word [esp + 0xb]
btr bp, sp
jmp 0xac3290
mov byte [esp + 2], cl
jmp 0xac32a6
cmc
rdtsc
push dword [esp + 0xe]
pop word [esp + 0x14]
setge dl
push dword [esp + 7]
jmp 0xac3327
mov ecx, eax
bsf ecx, ebx
lea edi, [ecx*4]
xchg dword [esp + 0x28], ecx
jmp 0xac3301
mov ax, di
ror ebp, 6
lea edx, [edx + ebp]
pop dword [esp + 0x19]
pushfd
bsr bx, sp
jmp 0xac333b
xor ax, di
push dword [esp + 0x1b]
bsr si, dx
cld
xchg edx, esi
mov ebx, dword [esp + 0x19]
jmp 0xac32d8
push word [esp + 0x18]
mov edi, ecx
cpuid
lea eax, [eax + ebp]
pop eax
sub esp, 8
jmp 0xac3376
lea ebp, [edx*4]
add esp, 0
xchg dword [esp + 5], esi
jmp 0xac33b0
mov byte [esp + 0x23], ah
xchg word [esp + 0x11], dx
mov ecx, 0x3de80baa
add esp, 0x28
cpuid
jmp 0xac3360
xchg dx, bp
stc
push word [esp + 1]
push dword [esp + 5]
jmp 0xac33cf
lea eax, [ebx*4]
not dx
xchg word [esp + 1], cx
pop dword [esp + 2]
mov si, sp
lea ecx, [eax*4]
jmp 0xac339a
mov ebp, 0x1d1d1154
mov edx, dword [esp + 0xa]
add bl, 0x69
cld
pop word [esp + 8]
xchg byte [esp + 1], bl
jmp 0xac35f8
xchg dword [esp + 1], ecx
mov edi, dword [esp + 0x12]
lea esi, [eax + ebx]
push dword [esp + 4]
jmp 0xac349f
mov cl, byte [esp + 0x11]
mov word [esp + 0xc], ax
push word [esp + 0xb]
rdtsc
mov word [esp + 6], cx
xchg ch, cl
jmp 0xac3405
mov eax, esi
xchg byte [esp + 4], dl
not di
std
mov bl, byte [esp + 4]
sub esp, 0xd
jmp 0xac341b
mov word [esp + 0x13], si
lea eax, [0xd4e37687]
xchg word [esp + 4], si
jmp 0xac3484
mov word [esp + 6], dx
not dh
xchg word [esp + 3], si
xchg word [esp + 5], di
rdtsc
lea eax, [esi - 0x85db]
jmp 0xac3453
xchg cl, bl
push word [esp + 0x16]
cld
and ebp, ebp
call fcn.00ac34cb
add al, 0x8d
sbb eax, 0x9c329764
out dx, eax
mul cl
and byte [ebx - 0x76], ah
je 0xac34c6
mov dh, byte [esp + 0xd]
mov byte [esp + 0x17], bl
or eax, 0x17245c88
neg ah
mov dx, word [esp + 0x14]
std
not bh
jmp 0xac3469
invalid
std
xchg byte [esp + 5], bl
rdtsc
pop word [esp]
pop dword [esp]
mov esi, esp
jmp 0xac3440
Function at 0xac35ab
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [edi*4]
jmp 0xac35d0
xchg byte [esp + 0xc], bl
sub esp, 0x17
xchg ch, dl
rcr cl, cl
mov eax, ebp
mov dword [esp + 0xf], edx
jmp 0xac3623
rdtsc
lea esi, [ebp + ebp]
std
mov cl, byte [esp + 0xf]
mov esi, esp
jmp 0xac3854
rdtsc
mov si, ax
not ebp
lea eax, [eax - 0x54c]
xchg word [esp + 0x1b], bx
bts ebx, ecx
jmp 0xac360d
mov dl, 0xb2
mov ch, 0xd5
shl ah, 4
cpuid
neg ch
call fcn.00ac379f
clc
cld
mov word [esp + 6], dx
xchg dh, cl
mov ch, byte [esp + 3]
jmp 0xac3df9
push dword [esp + 0x1a]
mov esi, 0x393f0c31
sub esp, 0x1d
lea esp, [esp + 0x47]
xchg dx, bp
bswap ecx
jmp 0xac380f
push dword [esp + 4]
clc
mov dl, bh
pop dword [esp]
mov ecx, 0x81c237de
jmp 0xac3d40
push eax
mov byte [esp + 1], bl
lea edi, [ebp - 0x6d]
rdtsc
sub esp, 1
xchg ebp, ecx
jmp 0xac386b
add esp, 5
neg dl
push word [esp + 5]
lea ebx, [edi*4]
not esi
lea esp, [esp + 0xa]
jmp 0xac3881
setl bh
xchg dword [esp], ebp
mov word [esp + 4], bp
mov dx, word [esp + 4]
jmp 0xac3907
bt esi, ebp
not dx
cmp dl, 0x8d
mov eax, esi
bswap edi
rdtsc
jmp 0xac38b7
xchg word [esp], bp
lea edx, [eax*4]
mov ebp, 0x23f47ceb
not di
pushfd
mov si, 0x3095
jmp 0xac38cd
bswap ecx
mov edi, dword [esp + 6]
mov byte [esp + 2], ah
push dword [esp + 1]
call fcn.00ac396b
and bl, byte [ebp - 0x54]
mov edi, 0x1247486
xchg byte [esp + 1], dh
cld
mov eax, dword [esp + 3]
setl al
rcl ah, cl
pop word [esp]
jmp 0xac38ed
cmc
add esp, 1
mov bp, 0x9282
sbb bl, al
stc
neg ecx
jmp 0xac391e
xchg di, ax
setb dl
mov dword [esp], esp
mov dh, byte [esp + 3]
mov ch, bh
lea ecx, [edx + edx]
jmp 0xac39b3
bsf si, sp
cpuid
xchg dword [esp + 9], esi
mov word [esp + 0xe], dx
bsf esi, ebx
pop dword [esp + 7]
jmp 0xac389e

Function at 0xac3c42
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xac3c93
btr ecx, esi
xchg byte [esp + 0xb], bl
mov cx, word [esp + 0xd]
std
mov word [esp + 9], sp
or si, di
jmp 0xac3c7d
push edx
lea ebp, [esi - 0x98]
push word [esp + 1]
xchg bh, cl
bsr ebp, esp
jmp 0xac3c44

Function at 0xac3f63
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bx, di
jmp 0xac3f6c
neg esi
pop ebx
lea edi, [ecx*4]
rcl cl, 2
bts ebx, esi
add esp, 4
jmp 0xac3fd2
mov di, word [esp + 2]
neg dx
mov cx, word [esp + 8]
sbb bp, 0xeef6
jmp 0xac3fa4
sub esp, 0x14
bsr di, sp
mov bh, dh
setg dh
lea ecx, [eax - 0xc726]
pop ebp
jmp 0xac3fba

Function at 0xac8a9a
Capabilities:
Access peb ldr_data
Packed with generic packer

Disassembly:
call fcn.00ac811b
lea esp, [esp + 0x28]
jmp 0xac8ad1
pushal
mov dword [esp + 0x28], edi
jmp 0xac8a84
push eax
jmp 0xac8116
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0xac8aa1
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0xac8ab7
Function at 0x403ddd
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x403e1c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x403e1c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x403e1c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x403e1c
cmp dword [ecx + 0x74], 0xe
jbe 0x403e1c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40fe31
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41f520
push 0x41f518
push str.FlsAlloc
push 0x1f
call fcn.0040fd4d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40fe65
push dword [ebp + 8]
mov ecx, esi
call dword [0x41d120]
call esi
jmp 0x40fe6b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40feaf
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41f530
push 0x41f528
push str.FlsGetValue
push 0x21
call fcn.0040fd4d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40fee6
push dword [ebp + 8]
mov ecx, esi
call dword [0x41d120]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40feee
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41f538
push 0x41f530
push str.FlsSetValue
push 0x22
call fcn.0040fd4d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ff28
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x41d120]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x41360b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x425fa8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41364b
cmp byte [ebx], 0xa
jne 0x41364b
or byte [edi + eax + 0x28], 4
jmp 0x413650
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x41374f
mov dl, byte [eax]
cmp dl, 0x1a
je 0x413732
inc eax
cmp dl, 0xd
je 0x41367c
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x4136a2
cmp eax, ecx
jae 0x4136b0
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x413664
jmp 0x41374f
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41372d
cmp dword [ebp - 0x10], 0
je 0x41372d
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x425fa8]
test byte [eax + edi + 0x28], 0x48
je 0x413707
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4136f2
mov byte [esi], dl
jmp 0x413703
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x425fa8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x41374f
cmp byte [ebp - 1], 0xa
jne 0x413716
cmp esi, ebx
jne 0x413716
mov byte [esi], 0xa
jmp 0x41374e
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041909b
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x41374f
mov byte [esi], 0xd
jmp 0x41374e
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x425fa8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41374c
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41374f
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x413758
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x425fa8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41379e
cmp word [ebx], dx
jne 0x41379e
or byte [eax + edi + 0x28], 4
jmp 0x4137a3
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x413906
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x4138e6
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x4137e4
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41381a
cmp eax, edx
jae 0x413828
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x4137bf
jmp 0x413906
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4138e1
cmp dword [ebp - 0x18], 0
je 0x4138e1
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x425fa8]
test byte [eax + edi + 0x28], 0x48
je 0x4138b7
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x41387b
mov word [esi], cx
jmp 0x4138b2
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x425fa8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x425fa8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x425fa8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x413906
pop eax
cmp word [ebp - 4], ax
jne 0x4138c7
cmp esi, ebx
jne 0x4138c7
mov word [esi], ax
jmp 0x413903
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041909b
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x413906
push 0xd
pop eax
jmp 0x4138c2
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x425fa8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x413900
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x413906
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41518c
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x415229
push ebx
push esi
call fcn.00415155
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00410f12
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4151d6
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x415228
push edi
push eax
call fcn.00410e34
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4151f6
call fcn.0040fbfa
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x415227
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00410f12
add esp, 0x20
test eax, eax
jne 0x415215
push edi
call fcn.0040fbfa
jmp 0x41521d
push ebx
call fcn.0040fbfa
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret