joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1e0ac7f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax + 8]
and dword [ebx + 0x14], 0
mov eax, esi
shl eax, 2
push edi
push eax
mov dword [ebp - 4], esi
call sym.python27.dll_PyObject_Malloc
mov edx, eax
pop ecx
mov dword [ebp - 8], edx
test edx, edx
jne 0x1e0ac839
push str.no_mem_to_build_parser_accelerators_n
call dword [sym.imp.MSVCR90.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_fprintf]
pop ecx
pop ecx
push 1
call dword [sym.imp.MSVCR90.dll_exit]
test esi, esi
jle 0x1e0ac846
mov ecx, esi
or eax, 0xffffffff
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, dword [ebx]
mov esi, dword [ebx + 4]
dec eax
mov dword [ebp - 0x10], eax
js 0x1e0ac93c
movsx eax, word [esi]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0xc]
mov edx, dword [ecx + eax*8]
movzx ecx, word [esi + 2]
mov edi, 0x80
cmp cx, di
jl 0x1e0ac880
push str.XXX_too_many_states__n
call dword [sym.imp.MSVCR90.dll_printf]
pop ecx
jmp 0x1e0ac92d
cmp edx, 0x100
jl 0x1e0ac910
mov ecx, dword [ebp + 8]
mov eax, edx
call fcn.1e0ac9bc
add edx, 0xffffff00
cmp edx, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
jl 0x1e0ac8ad
push str.XXX_too_high_nonterminal_number__n
jmp 0x1e0ac874
xor eax, eax
cmp dword [ecx + 8], eax
mov dword [ebp - 0xc], eax
jle 0x1e0ac92d
mov edi, dword [ebp - 0x14]
mov edi, dword [edi + 0x14]
xor edx, edx
mov ecx, eax
and ecx, 7
inc edx
shl edx, cl
mov ecx, eax
shr ecx, 3
movsx ecx, byte [ecx + edi]
test ecx, edx
je 0x1e0ac902
mov ecx, dword [ebp - 8]
lea edi, [ecx + eax*4]
cmp dword [edi], 0xffffffff
je 0x1e0ac8ee
push str.XXX_ambiguity__n
call dword [sym.imp.MSVCR90.dll_printf]
mov eax, dword [ebp - 0xc]
pop ecx
movsx edx, word [esi + 2]
mov ecx, dword [ebp - 0x18]
shl ecx, 8
or ecx, edx
or ecx, 0x80
mov dword [edi], ecx
mov ecx, dword [ebp + 8]
inc eax
cmp eax, dword [ecx + 8]
mov dword [ebp - 0xc], eax
jl 0x1e0ac8b7
jmp 0x1e0ac92d
test eax, eax
jne 0x1e0ac91d
mov dword [ebx + 0x14], 1
jmp 0x1e0ac92d
jl 0x1e0ac92d
cmp eax, dword [ebp - 4]
jge 0x1e0ac92d
mov edx, dword [ebp - 8]
movsx ecx, cx
mov dword [edx + eax*4], ecx
add esi, 4
dec dword [ebp - 0x10]
jns 0x1e0ac855
mov edx, dword [ebp - 8]
xor esi, esi
cmp dword [ebp - 4], esi
jle 0x1e0ac95d
mov eax, dword [ebp - 4]
shl eax, 2
lea eax, [eax + edx - 4]
cmp dword [eax], 0xffffffff
jne 0x1e0ac95d
dec dword [ebp - 4]
sub eax, 4
cmp dword [ebp - 4], esi
jg 0x1e0ac94d
mov edi, dword [ebp - 4]
test edi, edi
jle 0x1e0ac9b1
cmp dword [edx + esi*4], 0xffffffff
jne 0x1e0ac96f
inc esi
cmp esi, edi
jl 0x1e0ac964
cmp esi, edi
jge 0x1e0ac9b1
mov eax, edi
sub eax, esi
shl eax, 2
push eax
call sym.python27.dll_PyObject_Malloc
pop ecx
mov dword [ebx + 0x10], eax
test eax, eax
jne 0x1e0ac992
push str.no_mem_to_add_parser_accelerators_n
jmp 0x1e0ac81f
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], edi
xor eax, eax
mov edx, dword [ebp - 8]
mov edx, dword [edx + esi*4]
mov ecx, dword [ebx + 0x10]
mov dword [eax + ecx], edx
add eax, 4
inc esi
cmp esi, edi
jl 0x1e0ac99a
mov edx, dword [ebp - 8]
push edx
call sym.python27.dll_PyObject_Free
pop ecx
pop edi
pop esi
leave
ret
Function at 0x1e0b198b
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push str.PATH
call dword [sym.imp.MSVCR90.dll_getenv]
pop ecx
mov ebx, eax
call sym.python27.dll_Py_GetProgramName
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [esp + 0x10], eax
mov eax, dword [0x1e212cbc]
mov ebp, 0x100
test eax, eax
je 0x1e0b19d4
push ebp
push 0x1e2114e0
push eax
call esi
test eax, eax
jne 0x1e0b19d4
mov byte [0x1e2114e0], al
push ebp
mov edi, 0x1e2115e8
push edi
push 0
call esi
test eax, eax
jne 0x1e0b1a94
mov esi, dword [esp + 0x10]
test esi, esi
je 0x1e0b19f3
cmp byte [esi], al
jne 0x1e0b19ff
mov dword [esp + 0x10], str.python
mov esi, dword [esp + 0x10]
push 0x5c
push esi
call dword [sym.imp.MSVCR90.dll_strchr]
pop ecx
pop ecx
test eax, eax
jne 0x1e0b1a88
push 0x2f
push esi
call dword [sym.imp.MSVCR90.dll_strchr]
pop ecx
pop ecx
test eax, eax
jne 0x1e0b1a88
test ebx, ebx
je 0x1e0b1a7f
push 0x3b
push ebx
call dword [sym.imp.MSVCR90.dll_strchr]
pop ecx
pop ecx
mov dword [esp + 0x14], eax
test eax, eax
je 0x1e0b1a54
mov esi, eax
sub esi, ebx
cmp esi, ebp
jbe 0x1e0b1a3e
mov esi, ebp
push esi
push ebx
push edi
call dword [sym.imp.MSVCR90.dll_strncpy]
mov byte [esi + 0x1e2115e8], 0
mov esi, dword [esp + 0x1c]
jmp 0x1e0b1a5d
push ebp
push ebx
push edi
call dword [sym.imp.MSVCR90.dll_strncpy]
add esp, 0xc
push esi
push edi
call fcn.1e0b160d
push edi
call fcn.1e0b157c
add esp, 0xc
test eax, eax
jne 0x1e0b1a94
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x1e0b1a7f
inc ebx
jmp 0x1e0b1a21
mov byte [0x1e2115e8], 0
jmp 0x1e0b1a94
push ebp
push esi
push edi
call dword [sym.imp.MSVCR90.dll_strncpy]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1e0b1f67
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, 0x1e212cac
mov eax, esi
push edi
mov byte [ebp - 1], 0
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1e0b1f7d
sub eax, ecx
mov ecx, eax
mov eax, dword [ebp + 8]
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1e0b1f8e
sub eax, edi
lea edi, [eax + ecx + 0x25]
mov eax, edi
call fcn.1e0e6710
mov ebx, esp
lea eax, [ebp - 1]
push eax
push dword [ebp + 8]
push esi
push str.SoftwarePythonPythonCore_sModules_s_s
push edi
push ebx
call sym.python27.dll_PyOS_snprintf
mov edi, dword [ebp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
add esp, 0x18
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 8], edi
push ebx
push 0x80000001
call esi
test eax, eax
je 0x1e0b1ff4
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 8], edi
push ebx
push 0x80000002
call esi
test eax, eax
je 0x1e0b1ff4
xor eax, eax
jmp 0x1e0b2056
mov esi, dword [0x1e212d38]
mov edi, dword [esi]
test edi, edi
je 0x1e0b1ff0
mov ecx, dword [ebp - 8]
mov eax, edi
lea ebx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1e0b2008
sub eax, ebx
cmp ecx, eax
jbe 0x1e0b2031
push eax
sub ecx, eax
mov eax, dword [ebp + 0x10]
lea eax, [ecx + eax - 1]
push edi
push eax
call dword [sym.imp.MSVCR90.dll__strnicmp]
add esp, 0xc
test eax, eax
je 0x1e0b203a
mov ecx, dword [ebp - 8]
add esi, 0xc
mov edi, dword [esi]
test edi, edi
jne 0x1e0b2003
cmp dword [esi], 0
je 0x1e0b1ff0
push dword [esi + 4]
push dword [ebp + 0x10]
call dword [sym.imp.MSVCR90.dll_fopen]
pop ecx
pop ecx
test eax, eax
je 0x1e0b2056
mov ecx, dword [ebp + 0xc]
mov dword [ecx], esi
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1e0baeb0
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x1e0baec6
push str.PyEval_AcquireThread:_NULL_new_thread_state
call sym.python27.dll_Py_FatalError
add esp, 4
mov eax, dword [0x1e212d0c]
push 1
push eax
call sym.python27.dll_PyThread_acquire_lock
push esi
call sym.python27.dll_PyThreadState_Swap
add esp, 0xc
pop esi
test eax, eax
je 0x1e0baeee
mov dword [esp + 4], str.PyEval_AcquireThread:_non_NULL_old_thread_state
jmp sym.python27.dll_Py_FatalError
ret
Function at 0x1e0c9bef
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
or dword [esi + 0x14], 0xffffffff
push ebx
lea ebx, [eax + ecx]
xor ecx, ecx
mov dword [ebp - 8], ecx
mov byte [esi], cl
mov dword [esi + 4], ecx
mov byte [esi + 8], cl
mov dword [esi + 0x10], ecx
mov cl, byte [ebp + 8]
mov byte [esi + 0x18], cl
push edi
mov ecx, ebx
lea edi, [esi + 0xc]
or dword [edi], 0xffffffff
sub ecx, eax
cmp ecx, 2
mov dword [ebp - 4], eax
mov byte [esi + 1], dl
jl 0x1e0c9c47
mov dl, byte [eax + 1]
cmp dl, 0x3c
jl 0x1e0c9c47
cmp dl, 0x3e
jle 0x1e0c9c3b
cmp dl, 0x5e
jne 0x1e0c9c47
mov byte [esi + 1], dl
mov cl, byte [eax]
mov byte [esi], cl
add eax, 2
jmp 0x1e0c9c61
cmp ecx, 1
jl 0x1e0c9c6b
mov cl, byte [eax]
cmp cl, 0x3c
jl 0x1e0c9c6b
cmp cl, 0x3e
jle 0x1e0c9c5d
cmp cl, 0x5e
jne 0x1e0c9c6b
mov byte [esi + 1], cl
inc eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], 1
mov ecx, ebx
sub ecx, eax
cmp ecx, 1
jl 0x1e0c9c8e
mov dl, byte [eax]
movsx ecx, dl
sub ecx, 0x20
je 0x1e0c9c87
sub ecx, 0xb
je 0x1e0c9c87
dec ecx
dec ecx
jne 0x1e0c9c8e
inc eax
mov byte [esi + 8], dl
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, ebx
sub edx, eax
inc ecx
cmp edx, ecx
jl 0x1e0c9ca5
cmp byte [eax], 0x23
jne 0x1e0c9ca5
inc eax
mov dword [esi + 4], ecx
mov dword [ebp - 4], eax
cmp byte [esi], 0
jne 0x1e0c9cc8
mov edx, ebx
sub edx, eax
cmp edx, ecx
jl 0x1e0c9cc8
cmp byte [eax], 0x30
jne 0x1e0c9cc8
cmp dword [ebp - 8], 0
mov byte [esi], 0x30
jne 0x1e0c9cc4
mov byte [esi + 1], 0x3d
inc eax
mov dword [ebp - 4], eax
push edi
push ebx
lea ecx, [ebp - 4]
call fcn.1e0c9b6f
pop ecx
pop ecx
cmp eax, 0xffffffff
jne 0x1e0c9ce0
xor eax, eax
jmp 0x1e0c9d7e
test eax, eax
jne 0x1e0c9ce7
or dword [edi], 0xffffffff
mov eax, dword [ebp - 4]
mov ecx, ebx
sub ecx, eax
je 0x1e0c9cfd
cmp byte [eax], 0x2c
jne 0x1e0c9cfd
mov dword [esi + 0x10], 1
inc eax
mov ecx, ebx
sub ecx, eax
je 0x1e0c9d3b
cmp byte [eax], 0x2e
jne 0x1e0c9d3b
inc eax
mov dword [ebp - 4], eax
lea eax, [esi + 0x14]
push eax
push ebx
lea ecx, [ebp - 4]
call fcn.1e0c9b6f
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x1e0c9cd9
test eax, eax
jne 0x1e0c9d38
push str.Format_specifier_missing_precision
push dword [sym.python27.dll_PyExc_ValueError]
call sym.python27.dll_PyErr_Format
pop ecx
pop ecx
jmp 0x1e0c9cd9
mov eax, dword [ebp - 4]
sub ebx, eax
cmp ebx, 1
jle 0x1e0c9d49
push str.Invalid_conversion_specification
jmp 0x1e0c9d29
jne 0x1e0c9d50
mov al, byte [eax]
mov byte [esi + 0x18], al
cmp dword [esi + 0x10], 0
je 0x1e0c9d7b
mov al, byte [esi + 0x18]
test al, al
je 0x1e0c9d7b
cmp al, 0x25
je 0x1e0c9d7b
cmp al, 0x44
jle 0x1e0c9d71
cmp al, 0x47
jle 0x1e0c9d7b
cmp al, 0x63
jle 0x1e0c9d71
cmp al, 0x67
jle 0x1e0c9d7b
call fcn.1e0c9b57
jmp 0x1e0c9cd9
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret
Function at 0x1e0cabb0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
or dword [edi + 0xc], 0xffffffff
or dword [edi + 0x14], 0xffffffff
push ebx
push esi
xor edx, edx
lea ebx, [eax + ecx*2]
xor ecx, ecx
push 0x3c
mov word [edi], dx
pop edx
mov dword [ebp - 8], ecx
mov dword [edi + 4], ecx
mov dword [edi + 0x10], ecx
push 0x73
pop ecx
mov word [edi + 0x18], cx
mov ecx, ebx
sub ecx, eax
mov word [edi + 2], dx
xor edx, edx
sar ecx, 1
cmp ecx, 2
mov dword [ebp - 4], eax
mov word [edi + 8], dx
jl 0x1e0cac19
movzx edx, word [eax + 2]
movzx esi, dx
cmp esi, 0x3c
jl 0x1e0cac19
cmp esi, 0x3e
jle 0x1e0cac0a
cmp esi, 0x5e
jne 0x1e0cac19
mov cx, word [eax]
mov word [edi + 2], dx
mov word [edi], cx
add eax, 4
jmp 0x1e0cac3a
cmp ecx, 1
jl 0x1e0cac44
movzx ecx, word [eax]
movzx edx, cx
cmp edx, 0x3c
jl 0x1e0cac44
cmp edx, 0x3e
jle 0x1e0cac33
cmp edx, 0x5e
jne 0x1e0cac44
mov word [edi + 2], cx
add eax, 2
mov dword [ebp - 4], eax
mov dword [ebp - 8], 1
mov ecx, ebx
sub ecx, eax
push 2
and ecx, 0xfffffffe
pop esi
cmp ecx, esi
jl 0x1e0cac6f
movzx edx, word [eax]
movzx ecx, dx
sub ecx, 0x20
je 0x1e0cac66
sub ecx, 0xb
je 0x1e0cac66
sub ecx, esi
jne 0x1e0cac6f
add eax, esi
mov word [edi + 8], dx
mov dword [ebp - 4], eax
mov ecx, ebx
sub ecx, eax
and ecx, 0xfffffffe
cmp ecx, esi
jl 0x1e0cac8c
cmp word [eax], 0x23
jne 0x1e0cac8c
add eax, esi
mov dword [edi + 4], 1
mov dword [ebp - 4], eax
cmp word [edi], 0
jne 0x1e0cacbb
mov ecx, ebx
sub ecx, eax
and ecx, 0xfffffffe
cmp ecx, esi
jl 0x1e0cacbb
cmp word [eax], 0x30
jne 0x1e0cacbb
cmp dword [ebp - 8], 0
push 0x30
pop ecx
mov word [edi], cx
jne 0x1e0cacb6
push 0x3d
pop ecx
mov word [edi + 2], cx
add eax, esi
mov dword [ebp - 4], eax
lea eax, [edi + 0xc]
push eax
push ebx
lea esi, [ebp - 4]
call fcn.1e0cab3d
pop ecx
pop ecx
cmp eax, 0xffffffff
jne 0x1e0cacd6
xor eax, eax
jmp 0x1e0cad92
test eax, eax
jne 0x1e0cacde
or dword [edi + 0xc], 0xffffffff
mov eax, dword [ebp - 4]
mov ecx, ebx
sub ecx, eax
test ecx, 0xfffffffe
je 0x1e0cacfc
cmp word [eax], 0x2c
jne 0x1e0cacfc
inc eax
mov dword [edi + 0x10], 1
inc eax
mov ecx, ebx
sub ecx, eax
test ecx, 0xfffffffe
je 0x1e0cad42
cmp word [eax], 0x2e
jne 0x1e0cad42
inc eax
inc eax
mov dword [ebp - 4], eax
lea eax, [edi + 0x14]
push eax
push ebx
lea esi, [ebp - 4]
call fcn.1e0cab3d
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x1e0caccf
test eax, eax
jne 0x1e0cad3f
push str.Format_specifier_missing_precision
push dword [sym.python27.dll_PyExc_ValueError]
call sym.python27.dll_PyErr_Format
pop ecx
pop ecx
jmp 0x1e0caccf
mov eax, dword [ebp - 4]
sub ebx, eax
sar ebx, 1
cmp ebx, 1
jle 0x1e0cad52
push str.Invalid_conversion_specification
jmp 0x1e0cad30
jne 0x1e0cad5b
mov ax, word [eax]
mov word [edi + 0x18], ax
cmp dword [edi + 0x10], 0
je 0x1e0cad8f
movzx eax, word [edi + 0x18]
movzx ecx, ax
test ecx, ecx
je 0x1e0cad8f
cmp ecx, 0x25
je 0x1e0cad8f
cmp ecx, 0x44
jle 0x1e0cad85
cmp ecx, 0x47
jle 0x1e0cad8f
cmp ecx, 0x63
jle 0x1e0cad85
cmp ecx, 0x67
jle 0x1e0cad8f
call fcn.1e0cab11
jmp 0x1e0caccf
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret
Function at 0x1e0ceda9
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
cmp dword [sym.python27.dll_Py_IgnoreEnvironmentFlag], 0
jne 0x1e0cedd0
push str.PYTHONCASEOK
call dword [sym.imp.MSVCR90.dll_getenv]
pop ecx
test eax, eax
je 0x1e0cedd0
xor eax, eax
inc eax
leave
ret
lea eax, [ebp - 0x144]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x1e0cee02
push dword [ebp + 8]
push dword [ebp + 0x10]
push str.Cant_find_file_for_module__.100s_n_filename__.300s_
push dword [sym.python27.dll_PyExc_NameError]
call sym.python27.dll_PyErr_Format
add esp, 0x10
xor eax, eax
leave
ret
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp + 0xc]
lea eax, [ebp - 0x118]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.MSVCR90.dll_strncmp]
add esp, 0xc
neg eax
sbb eax, eax
inc eax
leave
ret

Function at 0x1e0d09ef
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi]
push edi
mov edi, ecx
test eax, eax
je 0x1e0d0a3e
push eax
push dword [esp + 0x10]
push 1
push edi
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
jmp 0x1e0d0a44
mov eax, dword [esi]
test eax, eax
je 0x1e0d0a22
push eax
movsx eax, byte [edi]
push eax
call dword [sym.imp.MSVCR90.dll_putc]
pop ecx
jmp 0x1e0d0a3c
mov eax, dword [esi + 0x10]
cmp eax, dword [esi + 0x14]
je 0x1e0d0a33
mov cl, byte [edi]
mov byte [eax], cl
inc dword [esi + 0x10]
jmp 0x1e0d0a3d
movsx eax, byte [edi]
push eax
call fcn.1e0d098a
pop ecx
inc edi
dec dword [esp + 0xc]
jns 0x1e0d0a0e
pop edi
pop esi
ret

Function at 0x1e0d1605
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x1e0d1621
push eax
push edi
push 1
push dword [esp + 0x14]
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x10
pop edi
ret
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 0x14]
sub eax, ecx
cmp eax, edi
jge 0x1e0d162f
mov edi, eax
push edi
push ecx
push dword [esp + 0x10]
call sub.MSVCR90.dll_memcpy
add dword [esi + 0x10], edi
add esp, 0xc
mov eax, edi
pop edi
ret

Function at 0x1e0d22b8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
push dword [ebp + 8]
call fcn.1e0d228d
mov edi, eax
lea eax, [edi - 1]
pop ecx
cmp eax, 0x3ffff
ja 0x1e0d230f
cmp edi, 0x7fffffff
ja 0x1e0d230f
push edi
call dword [sym.imp.MSVCR90.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x1e0d230f
push dword [ebp + 8]
push edi
push 1
push esi
call dword [sym.imp.MSVCR90.dll_fread]
push eax
push esi
call sym.python27.dll_PyMarshal_ReadObjectFromString
push esi
mov edi, eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 0x1c
mov eax, edi
jmp 0x1e0d2318
push dword [ebp + 8]
call sym.python27.dll_PyMarshal_ReadObjectFromFile
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1e0e0168
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 5
mov edi, 0x1e1a9e50
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x1e0e01ef
mov esi, dword [ebp + 0xc]
push 5
mov edi, 0x1e1a9e88
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x1e0e01ef
xor edi, edi
cmp dword [ebp + 0x10], edi
je 0x1e0e01eb
call sym.python27.dll_PyImport_GetMagicNumber
push dword [ebp + 8]
mov esi, eax
and esi, 0xffff
call dword [sym.imp.MSVCR90.dll_ftell]
pop ecx
test eax, eax
jne 0x1e0e01e7
push dword [ebp + 8]
lea eax, [ebp - 4]
push 2
push 1
push eax
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x10
cmp eax, 2
jne 0x1e0e01dd
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 4]
shl eax, 8
or eax, ecx
cmp eax, esi
jne 0x1e0e01dd
inc edi
push dword [ebp + 8]
call dword [sym.imp.MSVCR90.dll_rewind]
pop ecx
mov eax, edi
jmp 0x1e0e01f2
xor eax, eax
jmp 0x1e0e01f2
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x1e0e1301
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.MSVCR90.dll___iob_func]
push edi
push ebx
push str.Fatal_Python_error:__s_n
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_fprintf]
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_fflush]
mov eax, ebx
add esp, 0x10
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1e0e1336
sub eax, ecx
mov esi, eax
lea eax, [esi + esi + 2]
call fcn.1e0e6710
mov edi, esp
xor eax, eax
movsx cx, byte [eax + ebx]
mov word [edi + eax*2], cx
inc eax
cmp eax, esi
jbe 0x1e0e134e
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.Fatal_Python_error:
call esi
push edi
call esi
push 0x1e1ae770
call esi
call dword [sym.imp.MSVCR90.dll_abort]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1e0e56be
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [0x1e21268c], ebx
jne 0x1e0e56d4
call sym.python27.dll_PyThread_init_thread
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 8
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
jne 0x1e0e56f1
or eax, 0xffffffff
jmp 0x1e0e573c
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
lea eax, [ebp - 4]
push eax
push ebx
push esi
push 0x1e0e5698
push dword [0x1e212e94]
push ebx
call dword [sym.imp.MSVCR90.dll__beginthreadex]
add esp, 0x18
cmp eax, ebx
jne 0x1e0e5732
call dword [sym.imp.MSVCR90.dll__errno]
or dword [ebp - 4], 0xffffffff
push esi
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1e0e5739
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1e0e581b
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
ret
Function at 0x10002b96
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x10002ba5
pop dword [ebp - 0x14]
mov eax, 0x4a4438d4
sub eax, 0x3a440d2f
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x92c8dd7d
add dword [ebp - 0x24], 0xbb8967ce
mov dword [ebp - 0x20], 0x9d60aa71
sub dword [ebp - 0x20], 0x6b2d5e2c
mov dword [ebp - 0x1c], 0x77cacd0a
add dword [ebp - 0x1c], 0xd4817724
mov dword [ebp - 0x18], 0x2f6573b5
add dword [ebp - 0x18], 0xd09a8c4b
lea eax, [ebp - 0x24]
push eax
mov eax, 0x69d1f301
add eax, 0xa62edd3b
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x8ba5da67
sub dword [ebp - 0x24], 0x17337111
mov dword [ebp - 0x20], 0x47eb10d2
sub dword [ebp - 0x20], 0x67eaf5d
mov dword [ebp - 0x1c], 0x21b801f2
add dword [ebp - 0x1c], 0x41b76a7a
mov dword [ebp - 0x18], 0xc6a2245b
add dword [ebp - 0x18], 0x395ddba5
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xec148071
add eax, 0x23ec4ff7
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3c40a
push 0
call eax
mov ecx, 0x5b9e
xor edx, edx
add edx, eax
mov ebx, 0xee901e76
add ebx, 0x2171338a
add ebx, dword [ebp - 0x14]
mov edi, 0xb4442c5c
add edi, 0xc46e3350
xor dword [ebp - 0x10], ebx
mov esi, dword [ebx]
sub dword [ebp - 8], ebx
sub esi, edi
mov dword [edx], esi
xor dword [ebp - 0x10], 0x1c622731
add edx, 0x3f4036c
sub edx, 0x3f40368
add ebx, 0x5ae1776c
sub ebx, 0x5ae17768
loop 0x10002cc3
add eax, 0x3aa17ac0
sub eax, 0x3aa01975
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xc6982b1a
sub ecx, 0xb6982b1a
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x4039ad
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x40c090]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x40
lea eax, [ebp - 0x84]
push eax
push 0x4012ec
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x4039de
xor al, al
jmp 0x403a0d
movzx eax, word [ebp - 0x84]
lea edx, [ebp - 0x84]
test eax, eax
je 0x403a0b
mov ecx, dword [0x40c8b8]
and eax, 0x1f
lea edx, [edx + 2]
bts ecx, eax
movzx eax, word [edx]
test eax, eax
jne 0x4039f5
mov dword [0x40c8b8], ecx
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409600
leave
ret
Function at 0x405a02
Capabilities:
Print debug messages
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x870
mov eax, dword [0x40c090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x86c], edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
mov edi, eax
cmp dword [0x40c0c4], 0xffffffff
jne 0x405ad5
lea eax, [ebp - 0x868]
mov dword [0x40c0c4], ebx
push eax
push ecx
push ecx
mov edx, 0x4014f8
mov dword [ebp - 0x868], ebx
call fcn.00402f5e
add esp, 0xc
test eax, eax
jne 0x405ad5
lea eax, [ebp - 0x858]
mov dword [ebp - 0x860], 0x28
mov dword [ebp - 0x864], eax
lea eax, [ebp - 0x870]
push eax
lea eax, [ebp - 0x858]
mov dword [ebp - 0x870], 0x50
push eax
push ebx
push ebx
push 0x401554
push dword [ebp - 0x868]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405ab4
mov eax, dword [ebp - 0x864]
mov eax, dword [eax]
and eax, 3
mov dword [0x40c0c4], eax
push dword [ebp - 0x868]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x860], 0x28
jle 0x405ad5
push dword [ebp - 0x864]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x40c914], ebx
je 0x405b7b
cmp dword [ebp - 0x86c], ebx
je 0x405b7b
mov eax, 0x20006
mov dword [ebp - 0x868], ebx
cmp byte [0x40cd9a], bl
jne 0x405b0d
cmp byte [0x40cab5], bl
je 0x405b0d
mov eax, 0x20106
push ebx
lea ecx, [ebp - 0x868]
push ecx
push ebx
push eax
push ebx
push ebx
push ebx
push 0x401560
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x405b7b
push 4
lea eax, [ebp - 0x86c]
push eax
push 4
push ebx
push 0x4015d0
push dword [ebp - 0x868]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push ebx
push 0x4015e4
push dword [ebp - 0x868]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x868]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test dword [0x40c0c4], 3
je 0x405bea
push 0x802
lea eax, [ebp - 0x808]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x808]
push esi
cmp dword [ebp - 0x86c], ebx
je 0x405bc6
push dword [ebp - 0x86c]
push 0x401608
push 0x401
push eax
call fcn.00402e35
add esp, 0x14
jmp 0x405bd9
push 0x40162c
push 0x401
push eax
call fcn.00402e35
add esp, 0x10
test eax, eax
js 0x405bea
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409600
leave
ret