joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412950
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424228
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x42b39c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x10]
call fcn.00401380
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x14], 4
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x220]
and ecx, 0x40000000
je 0x4129c4
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x220]
and eax, 0x80000000
je 0x4129c4
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x14], 0xf001f
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 0x220], 0x1f01ff
jne 0x4129e1
mov dword [ebp - 0x18], 0x40
mov dword [ebp - 0x14], 0xf001f
push 0
push 0
push 3
push 0
push 1
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x220]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x42506c]
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xc], 0xffffffff
jne 0x412a2c
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004013a0
jmp 0x412b32
push 0
push 0
push 0
mov edx, dword [ebp - 0x18]
push edx
push 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0xc]
push ecx
call dword [0x425088]
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x10], 0xb7
je 0x412a60
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 0x10], 0
jne 0x412a86
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x10], 0
mov ecx, dword [ebp - 0x1c]
call fcn.00412890
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004013a0
jmp 0x412b32
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x10]
push edx
call dword [0x425084]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 4], 0
jne 0x412ac5
mov ecx, dword [ebp - 0x1c]
call fcn.00412890
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004013a0
jmp 0x412b32
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
add eax, dword [ecx + 0x3c]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x412af9
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
cmp dword [eax], 0x4550
je 0x412b1c
mov ecx, dword [ebp - 0x1c]
call fcn.00412890
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004013a0
jmp 0x412b32
mov edx, dword [ebp - 0x1c]
mov byte [edx + 0x14], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004013a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x423320
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x427950
sub eax, eax
test esi, esi
je 0x4233f8
sub eax, 1
test ecx, ecx
je 0x4233f6
test esi, 3
je 0x42335e
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x423343
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x4233dd
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x423368
mov ecx, edx
test ecx, ecx
je 0x4233f6
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x4233e3
not eax
mov dword [esp + 0x1c], eax
popal
ret
Function at 0x29ae058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.029ae1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x29ae07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x29ae06a
add dl, dl
jne 0x29ae089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x29ae0dc
xor eax, eax
add dl, dl
jne 0x29ae096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x29ae17d
add dl, dl
jne 0x29ae0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x29ae0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x29ae0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x29ae0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x29ae0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x29ae075
mov eax, 1
add dl, dl
jne 0x29ae0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x29ae0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x29ae0e1
sub eax, ebx
mov ebx, 1
jne 0x29ae128
mov ecx, 1
add dl, dl
jne 0x29ae10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x29ae119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x29ae105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x29ae075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x29ae13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x29ae14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x29ae136
cmp eax, 0x7d00
jae 0x29ae16d
cmp eax, 0x500
jb 0x29ae168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x29ae075
cmp eax, 0x7f
ja 0x29ae170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x29ae075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x29ae19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x29ae075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x404060
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c493
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x42a018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [0x41d020]
mov edx, eax
lea ecx, [ebp - 0xa0]
call fcn.00403fc0
mov edi, eax
mov dword [ebp - 4], 0
call dword [0x41d020]
mov edx, eax
lea ecx, [ebp - 0x88]
call fcn.00403ec0
push eax
mov edx, 0x42789c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x70]
call fcn.00406900
push 0x42788c
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
call fcn.00406970
push edi
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x40]
call fcn.00406b30
push 0x427880
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
call fcn.00406970
add esp, 0x10
lea ecx, [ebp - 0x40]
call fcn.00402d70
lea ecx, [ebp - 0x58]
call fcn.00402d70
lea ecx, [ebp - 0x70]
call fcn.00402d70
lea ecx, [ebp - 0x88]
call fcn.00402d70
lea ecx, [ebp - 0xa0]
call fcn.00402d70
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.00402d60
push eax
push 0x4278b0
push 0
push 0
call dword [0x41d15c]
push 0
call fcn.0040d1ef
int3
Function at 0x4061e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xc], 0
je 0x4061f2
xor eax, eax
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0xd
jb 0x4061e8
mov eax, ecx
ret

Function at 0x51fd84
Capabilities:
Encode data using xor

Disassembly:
pushfd
call fcn.0051a7ef
dec esi
inc byte [edx + 9]
iretd
pushfd
pushfd
push dword [esp + 8]
ret 0x54
pushfd
lea esp, [esp + 0x2c]
ja 0x51980f
jne 0x563325
pushfd
pushfd
pushal
pushf
pop word [esp + 0x26]
not dl
bt di, 5
clc
mov dl, byte [esi]
mov byte [esp + 4], al
ror dl, 1
mov byte [esp + 4], bh
inc dl
clc
push ebp
rol dl, 6
call fcn.005620d7
in al, 0x23
xor byte [eax + edi*2], 0xbf
test ecx, ecx
adc ch, bl
cli
add eax, 0x6fac75d1
mov ecx, 0xfa76a07c
js 0x51fdb7
add eax, dword [ebx + 0x2f]
jmp 0xd3f101a
pushal
pushal
pushfd
push dword [esp + 0x44]
jp 0x51f3cc
ret 0x48

Function at 0x56281f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esi, eax
mov word [esp], 0x849c
mov byte [esp], ch
sub ecx, ecx
sub esp, 0xfffffff4
cmp bl, 0xa2
test edx, edx
mov word [esp], cx
lea esp, [esp + 4]
je 0x56104d
and ecx, 0x321a2661
add edx, eax
shrd ecx, ebp, cl
rcl cx, cl
test sp, 0x7532
mov ecx, dword [esi + 0x7c]
stc
add ecx, edx
bt di, 0xb
cmc
stc
mov dword [esp], ecx
sar ecx, cl
btr ecx, edi
movsx cx, al
sub ch, 0x46
mov ecx, dword [ebp + 4]
clc
pushfd
mov word [esp], cx
cmp ecx, 0xffff
mov byte [esp], bl
lea esp, [esp + 4]
jbe 0x56072e
pushfd
shl si, cl
bsr si, si
mov edi, dword [edx + 0x24]
stc
bsr si, si
rol si, 6
add edi, eax
pushfd
movsx si, dl
mov esi, dword [edx + 0x20]
mov byte [esp + 4], 0x88
pushfd
jmp 0x515614
pushal
pushal
call fcn.0055a316
xlatb
pushfd
pop edi
and ebp, ebp
invalid
pushfd
mov dword [esp + 8], edx
lea ebp, [edx + 0x3d6c64c5]
shl eax, cl
lea ebp, [esp + 0x24]
shl ah, cl
stc
movzx ax, bl
mov eax, dword [ebp]
cmp bh, ah
test eax, eax
pushal
lea esp, [esp + 0x28]
je 0x56104d
setg dl
shl dx, cl
shl dl, 4
sal si, 0xe
mov esi, dword [eax + 0x3c]
bsr dx, bx
add esi, eax
mov dx, si
pushfd
mov edx, dword [esi + 0x78]
mov word [esp], dx
stc
jmp 0x523136
Function at 0x401000
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0xb8e06c
push eax
push dword fs:[0]
loopne 0x400fbc
add byte [eax + 0x64], dl
push dword [0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
adc ebx, dword [edi - 0x54]
xchg ebx, eax
neg dl
push cs
dec ecx
mov eax, 0x7fb97088
add ah, ah
aam 0xeb
jp 0x40109d
mov byte [eax - 0x47], dh
jg 0x401033
in al, 0xd4
jmp 0x4010af
test eax, 0xcf33638c
adc ch, bl
js 0x400fd0
sbb ch, ah
daa
stosd dword es:[edi], eax
mov dword [0x540fb128], eax
xchg edi, eax
inc ecx
and dword [esi + esi*8 - 0x78], ebp
rcr byte [eax - 0x2e], 0xa4
sti
push ss
scasd eax, dword es:[edi]
jne 0x40108b
jl 0x40102c
salc
pushal
jbe 0x401085
daa
xchg esp, eax
lcall 0xa4e8, 0x1020bb2d
push eax
in eax, dx
xor bl, ah
sti
bnd jg 0x401002
popal
lea ebp, [edx - 0x70bb56c6]
push ds
pop ss
cmp dword [eax + ebx*8 + 0x46], eax
and byte [eax - 0x702274c0], al
pop eax
test al, 0xc5
fisttp qword [edi + 0x3dc5a858]
lahf
mov ah, 0xc2
sub ecx, dword [0x6e1df55c]
cmp eax, 0x2bc2b49f
or eax, 0x6e1df55c
pop esp
cmc
sbb eax, 0x97530b6e
or edx, dword [ebx - 0x69]
in al, 0x34
sub dword [ebx], esp
jge 0x401055
ja 0x4010fe
fld xword [esi - 7]
or al, 0xb7
dec edx
mov ch, 0xfc
outsd dx, dword [esi]
jns 0x4010cd
fcom qword [eax - 0x69d98623]
retf 0x41f8
and ecx, eax
hlt
int1
push 0xffffffffffffffb7
dec edx
mul dword [esi - 0x69]
invalid
push edx
inc edi
aas
int1
lds esi, [eax - 0x386d9885]
out 0xf1, eax
xchg edx, eax
cmp al, 0x61
sahf
jmp 0xb6298785
Function at 0x61d6cc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x61f168
sub eax, eax
test esi, esi
je 0x61d7a4
sub eax, 1
test ecx, ecx
je 0x61d7a2
test esi, 3
je 0x61d70a
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x61d6ef
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x61d789
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x61d714
mov ecx, edx
test ecx, ecx
je 0x61d7a2
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x61d78f
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x61d7ac
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0061d82f
jae 0x61d7ba
xor ecx, ecx
call fcn.0061d82f
jae 0x61d7e9
xor eax, eax
call fcn.0061d82f
jae 0x61d7f9
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0061d82f
adc al, al
jae 0x61d7db
jne 0x61d825
stosb byte es:[edi], al
jmp 0x61d7bd
call fcn.0061d83b
sub ecx, ebx
jne 0x61d802
call fcn.0061d839
jmp 0x61d821
lodsb al, byte [esi]
shr eax, 1
je 0x61d84b
adc ecx, ecx
jmp 0x61d81e
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.0061d839
cmp eax, 0x7d00
jae 0x61d81e
cmp ah, 5
jae 0x61d81f
cmp eax, 0x7f
ja 0x61d820
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x61d7bd
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret
Function at 0x402970
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x447b60
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x45fa6c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 2
call fcn.004153a0
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x34]
push eax
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 3
call fcn.004157e0
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x38]
push edx
push eax
lea ecx, [esp + 0x14]
call fcn.004157e0
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x30]
push ecx
lea edx, [esp + 0x10]
push edx
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x48], esp
mov edi, esp
push eax
call fcn.00401610
add eax, 0x10
add esp, 4
mov ecx, esi
mov dword [edi], eax
call fcn.00402580
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], al
mov byte [esp + 0x28], 2
call fcn.004156e7
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0x28], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402a37
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
mov byte [esp + 0x28], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402a5c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402a84
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, byte [esp + 0x3c]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 0x10
Function at 0x412550
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x447d38
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x45fa6c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
lea ebx, [esi + 8]
push ebx
mov dword [esp + 0x1c], 0
call dword [0x44c240]
mov eax, dword [esi + 0x18]
push 0x44e5c0
push eax
call fcn.00434770
add esp, 8
mov dword [esi + 4], eax
test eax, eax
mov eax, dword [esp + 0x20]
je 0x412633
movzx ecx, word [esi + 0x14]
movzx edx, word [esi + 0x12]
push eax
movzx eax, word [esi + 0x10]
push ecx
movzx ecx, word [esi + 0xe]
push edx
movzx edx, word [esi + 0xa]
push eax
movzx eax, word [ebx]
push ecx
push edx
push eax
lea edi, [esi + 0x1c]
push 0x44e59c
push edi
call fcn.00404650
mov edi, dword [edi]
mov ecx, dword [esi + 4]
mov eax, dword [edi - 0xc]
push ecx
push eax
push 1
push edi
call fcn.0043450e
mov edx, dword [esi + 4]
push edx
call fcn.00434274
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
add esp, 0x38
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412619
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
add eax, 0xfffffff0
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412657
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x401630
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x34c
mov eax, dword [ebp + 8]
test eax, eax
je 0x401648
cmp byte [eax], 0
jne 0x401655
add esp, 0x34c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], eax
lea edx, [ebp - 0x128]
xor ebx, ebx
mov dword [esp], edx
call sym._strcpy
lea eax, [ebp - 0x128]
mov dword [esp], eax
call sym._strlen
cmp eax, 0x1000
jbe 0x40171d
cmp byte [ebp - 0x128], 0
je 0x4016b8
lea ebx, [ebp - 0x128]
mov dword [esp], ebx
call sym._strlen
movzx edx, byte [eax + ebp - 0x129]
cmp dl, 0x5c
je 0x4016b8
cmp dl, 0x2f
je 0x4016b8
mov edi, 0x5c
mov word [eax + ebp - 0x128], di
xor ebx, ebx
lea edi, [ebp - 0x348]
lea ecx, [ebp - 0x128]
lea esi, [esi]
lea edi, [edi]
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
mov eax, edx
and eax, 0x80808080
je 0x4016d0
and edx, 0x8080
jne 0x4016f6
shr eax, 0x10
add ecx, 2
add al, al
lea edx, [ebp - 0x128]
sbb ecx, 3
sub ecx, edx
cmp ecx, ebx
jle 0x4017f0
cmp byte [ebx + ebp - 0x128], 0x5c
lea esi, [ebx + 1]
je 0x401755
mov ebx, esi
jmp 0x4016c0
inc ebx
lea esi, [ebp - 0x128]
mov dword [esp], esi
call sym._strlen
cmp eax, ebx
jle 0x401682
movzx eax, byte [ebx + ebp - 0x128]
cmp al, 0x5c
sete dl
cmp al, 0x2f
sete cl
or dl, cl
je 0x40171c
mov cl, 0x5c
mov byte [ebx + ebp - 0x128], cl
inc ebx
jmp 0x40171d
mov dword [esp + 8], esi
lea ecx, [ebp - 0x238]
lea edx, [ebp - 0x128]
mov dword [esp], ecx
mov dword [esp + 4], edx
call sym._strncpy
xor eax, eax
lea edx, [ebp - 0x238]
mov byte [ebx + ebp - 0x237], al
xor ebx, ebx
mov dword [esp + 4], edx
mov dword [esp], edi
call sym._strcpy
mov dword [esp], edi
call sym._strlen
cmp eax, 0x1000
jbe 0x4017c9
mov dword [esp], edi
xor ebx, ebx
mov dword [esp + 4], ebx
call sym._access
test eax, eax
je 0x401718
lea eax, [ebp - 0x238]
mov ebx, esi
mov dword [esp], eax
call sym._mkdir
jmp 0x4016c0
inc ebx
mov dword [esp], edi
call sym._strlen
cmp eax, ebx
jle 0x40179d
movzx edx, byte [ebx + edi]
cmp dl, 0x5c
sete cl
cmp dl, 0x2f
sete al
or cl, al
je 0x4017c8
mov byte [ebx + edi], 0x5c
inc ebx
jmp 0x4017c9
mov dword [esp], edi
lea ecx, [ebp - 0x238]
xor ebx, ebx
mov dword [esp + 4], ecx
call sym._strcpy
mov dword [esp], edi
call sym._strlen
cmp eax, 0x1000
jbe 0x401835
mov dword [esp], edi
xor esi, esi
mov dword [esp + 4], esi
call sym._access
test eax, eax
sete bl
add esp, 0x34c
movzx eax, bl
pop ebx
pop esi
pop edi
pop ebp
ret
inc ebx
mov dword [esp], edi
call sym._strlen
cmp eax, ebx
jle 0x401813
movzx ecx, byte [ebx + edi]
cmp cl, 0x5c
sete dl
cmp cl, 0x2f
sete al
or dl, al
je 0x401834
mov byte [ebx + edi], 0x5c
inc ebx
jmp 0x401835
Function at 0x4042f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0xc], ebx
lea ebx, [ebp - 0x18]
mov dword [ebp - 4], edi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x44], sym.___gxx_personality_sj0
mov dword [ebp - 0x40], 0x51ff50
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], 0x404480
mov dword [ebp - 0x34], esp
mov dword [esp], ecx
call sym.__Unwind_SjLj_Register
mov dword [ebp - 0x60], 0
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
shr eax, 0x1f
or edx, dword [ebp + 0x10]
mov dword [ebp - 0x68], eax
jns 0x404364
lea ecx, [ebp - 0x5c]
mov dword [esp], ecx
call sym.__Unwind_SjLj_Unregister
mov eax, dword [ebp - 0x60]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x28], 0
mov edx, dword [ebp + 0xc]
lea edi, [ebp - 0x28]
mov dword [ebp - 0x24], 0xffffffff
mov ecx, 0x8000
mov eax, 1
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], edi
mov dword [ebp - 0x58], 1
call fcn.00404030
mov ebx, dword [ebp - 0x24]
test ebx, ebx
mov dword [ebp - 0x6c], ebx
js 0x4044f6
mov esi, dword [ebp - 0x6c]
shr esi, 0x1f
or esi, dword [ebp - 0x68]
jne 0x4044bf
mov edi, dword [ebp + 0x14]
test edi, edi
jle 0x4044bf
mov dword [ebp - 0x58], 1
mov edx, dword [ebp - 0x6c]
mov dword [esp], edx
call sym._filelength
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
add ebx, ecx
xor ecx, ecx
cmp ebx, eax
jg 0x4044c1
mov esi, dword [ebp - 0x64]
mov eax, dword [esi]
test eax, eax
jne 0x404543
mov dword [ebp - 0x58], 1
mov eax, dword [ebp + 0x14]
inc eax
mov dword [ebp - 0x74], eax
mov dword [esp], eax
call sym._malloc
mov edi, dword [ebp - 0x64]
xor ecx, ecx
test eax, eax
mov dword [edi], eax
je 0x4044c1
mov dword [esp], eax
mov edi, dword [ebp - 0x74]
xor esi, esi
mov dword [esp + 4], esi
mov dword [esp + 8], edi
call sym._memset
mov dword [ebp - 0x58], 1
mov ebx, dword [ebp + 0x10]
xor ecx, ecx
mov dword [esp + 8], ecx
mov edx, dword [ebp - 0x6c]
mov dword [esp + 4], ebx
mov dword [esp], edx
call sym._lseek
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x6c]
mov dword [esp + 8], ecx
mov ebx, dword [edx]
mov dword [esp], eax
mov dword [esp + 4], ebx
call sym._read
test eax, eax
jle 0x404474
mov esi, dword [ebp - 0x64]
mov dword [esi + 4], eax
mov ecx, 1
jmp 0x4044c1
xor ecx, ecx
mov eax, dword [ebp - 0x24]
movzx edi, cl
mov dword [ebp - 0x70], edi
test eax, eax
js 0x4044dd
mov dword [esp], eax
mov dword [ebp - 0x58], 0xffffffff
call sym._close
mov dword [ebp - 0x24], 0xffffffff
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x404521
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x60], eax
jmp 0x404349
mov dword [ebp - 0x24], 0xffffffff
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x404532
mov dword [ebp - 0x60], 0
jmp 0x404349
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x28], 0
jmp 0x4044eb
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x28], 0
jmp 0x404504
mov dword [esp], eax
call sym._free
jmp 0x4043f6