joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43bfa3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
sar ecx, 6
imul edi, eax, 0x30
mov dword [ebp - 8], ecx
push 0xa
mov eax, dword [ecx*4 + 0x45b7e0]
pop ebx
mov edx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp + 0xc]
test esi, esi
je 0x43bfe7
cmp word [edx], bx
jne 0x43bfe7
or byte [edi + eax + 0x28], 4
jmp 0x43bfec
and byte [edi + eax + 0x28], 0xfb
lea eax, [edx + esi*2]
mov ebx, edx
mov dword [ebp - 0xc], eax
mov esi, edx
cmp edx, eax
jae 0x43c140
mov dword [ebp - 0x10], 0xd
movzx eax, word [ebx]
cmp eax, 0x1a
je 0x43c120
cmp ax, word [ebp - 0x10]
je 0x43c025
mov word [esi], ax
add esi, 2
add ebx, 2
jmp 0x43c115
lea eax, [ebx + 2]
cmp eax, dword [ebp - 0xc]
jae 0x43c04b
push 0xa
pop ecx
cmp word [eax], cx
jne 0x43c03b
push ecx
pop eax
push 4
jmp 0x43c040
push 0xd
pop eax
push 2
mov word [esi], ax
pop eax
add ebx, eax
jmp 0x43c10f
push 0
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43c106
cmp dword [ebp - 0x18], 0
je 0x43c106
mov ecx, dword [ebp - 8]
push 0xa
mov eax, dword [ecx*4 + 0x45b7e0]
test byte [edi + eax + 0x28], 0x48
pop eax
je 0x43c0d2
mov dx, word [ebp - 4]
cmp dx, ax
jne 0x43c096
mov word [esi], ax
jmp 0x43c0ca
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ecx*4 + 0x45b7e0]
mov word [ebp - 0x20], dx
push 0xa
mov byte [edi + eax + 0x2a], dl
mov ecx, dword [ecx*4 + 0x45b7e0]
mov al, byte [ebp - 0x1f]
pop edx
mov byte [edi + ecx + 0x2b], al
mov ecx, dword [ebp - 8]
mov eax, dword [ecx*4 + 0x45b7e0]
mov byte [edi + eax + 0x2c], dl
mov edx, dword [ebp + 0xc]
add esi, 2
jmp 0x43c115
cmp word [ebp - 4], ax
jne 0x43c0e7
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x43c0e7
mov word [esi], ax
add esi, 2
jmp 0x43c115
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0044313b
mov edx, dword [ebp + 0xc]
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x43c112
jmp 0x43c109
mov edx, dword [ebp + 0xc]
push 0xd
pop eax
mov word [esi], ax
add esi, 2
mov ecx, dword [ebp - 8]
cmp ebx, dword [ebp - 0xc]
jb 0x43c005
jmp 0x43c140
mov ecx, dword [ecx*4 + 0x45b7e0]
mov al, byte [edi + ecx + 0x28]
test al, 0x40
jne 0x43c137
or al, 2
mov byte [edi + ecx + 0x28], al
jmp 0x43c140
mov cx, word [ebx]
mov word [esi], cx
add esi, 2
sub esi, edx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43c94a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043c7c7

Function at 0x43f9d1
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043f673
Function at 0x100012ef
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x10044746
call fcn.10043f7c
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [edi], eax
mov eax, dword [ebp + 0x10]
lea esi, [edi + 8]
mov dword [edi + 4], eax
call fcn.100023a9
xor ebx, ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x40], ebx
lea esi, [edi + 0x48]
mov dword [edi + 0x44], ebx
call fcn.100023a9
mov dword [edi + 0x64], ebx
mov dword [edi + 0x6c], ebx
mov dword [edi + 0x70], ebx
mov dword [edi + 0x74], ebx
mov ecx, dword [ebp - 0xc]
lea eax, [edi + 0x78]
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov byte [edi + 0x88], bl
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x100047c8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10044e04
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
xor esi, esi
push edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
lea eax, [esp + 0x18]
push eax
push dword [ebp + 0xc]
mov dword [esp + 0x3c], esi
call fcn.1001a9b3
lea eax, [esp + 0x18]
push eax
push esi
push esi
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ebp + 8]
add eax, 0xc
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
call fcn.1001b4b4
add esp, 0x1c
cmp eax, esi
mov dword [esp + 0xc], eax
je 0x100048b8
test byte [eax + 4], 0x20
mov ebx, dword [eax + 0x40]
jne 0x1000485d
push dword [esp + 0x14]
lea esi, [ebx + 0x44]
push dword [esp + 0x14]
lea edi, [esp + 0x18]
call fcn.1000541e
push ebx
call fcn.1001bb21
pop ecx
jmp 0x100048ae
lea esi, [eax + 8]
push str.xml:lang
call fcn.1000562d
test al, al
pop ecx
je 0x10004875
xor dword [ebx + 4], 0x40
jmp 0x1000488b
push str.rdf:type
call fcn.1000562d
test al, al
pop ecx
je 0x1000488b
xor dword [ebx + 4], 0x80
push dword [esp + 0x14]
lea esi, [ebx + 0x54]
push dword [esp + 0x14]
lea edi, [esp + 0x18]
call fcn.1000541e
mov eax, esi
call fcn.10002498
test eax, eax
jne 0x100048ae
xor dword [ebx + 4], 0x10
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
push 1
call dword [eax]
lea esi, [esp + 0x18]
call fcn.10002ad1
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000c5eb
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100448ff
push eax
mov dword fs:[0], esp
sub esp, 0xc
cmp dword [ebp + 8], 0
push esi
push edi
mov edi, ecx
je 0x1000c632
push 0x67
pop eax
mov dword [esp + 8], eax
push 0x1004fa80
lea eax, [esp + 0xc]
mov ecx, str.No_options_are_defined_yet
push eax
mov dword [esp + 0x14], ecx
call fcn.10035956
push 0x74
call fcn.10019e50
mov esi, eax
pop ecx
mov dword [esp + 8], esi
and dword [esp + 0x1c], 0
test esi, esi
je 0x1000c652
call fcn.1000a076
mov esi, eax
jmp 0x1000c654
xor esi, esi
or dword [esp + 0x1c], 0xffffffff
mov eax, dword [edi + 0x10]
push 0xffffffffffffffff
mov dword [esi + 0x10], eax
push 0
lea eax, [edi + 0x14]
push eax
lea ecx, [esi + 0x14]
call fcn.1000296d
push 0xffffffffffffffff
push 0
lea eax, [edi + 0x30]
push eax
lea ecx, [esi + 0x30]
call fcn.1000296d
lea eax, [esi + 0xc]
push eax
add edi, 0xc
push edi
call fcn.1001b7a4
pop ecx
pop ecx
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1000d914
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
push esi
mov dword [ebp - 4], 0x10057a88
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x18], eax
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x1c]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.1000d8d4
add esp, 8
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
push 0x104
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx + eax*2]
test edx, edx
je 0x1000d9b9
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x1000d9a0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax + edx*2 - 2]
cmp ecx, 0x5c
je 0x1000d9e6
xor edx, edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov word [ecx + eax*2], dx
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
jmp 0x1000d9bf
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
movzx edx, word [ecx + eax*2]
test edx, edx
je 0x1000da23
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
mov dx, word [esi + edx*2]
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
jmp 0x1000d9ed
push 0x44
lea edx, [ebp - 0x7c]
push edx
call fcn.1000d8d4
add esp, 8
push 0x10
lea eax, [ebp - 0x38]
push eax
call fcn.1000d8d4
add esp, 8
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x38]
push ecx
lea edx, [ebp - 0x7c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x18]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x38]
push ecx
call dword [ebp - 0x28]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x100306e1
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x10035d67
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100571cc]
jne 0x10035d71
repz ret
jmp fcn.1003cf3c

Function at 0x1003e46c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.10036a75
xor ebx, ebx
cmp dword [0x10059424], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x1003e541
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x1003e4ac
xor eax, eax
jmp 0x1003e605
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x1003e4a5
push eax
call fcn.10036a12
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10059424], eax
call esi
push eax
call fcn.10036a12
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10059428], eax
call esi
push eax
call fcn.10036a12
mov dword [0x1005942c], eax
lea eax, [ebp - 8]
push eax
call fcn.100382ef
test eax, eax
pop ecx
pop ecx
je 0x1003e50f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10031562
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x1003e541
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.10036a12
cmp eax, ebx
pop ecx
mov dword [0x10059434], eax
je 0x1003e541
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10036a12
pop ecx
mov dword [0x10059430], eax
mov eax, dword [0x10059430]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x1003e5ba
cmp dword [0x10059434], esi
je 0x1003e5ba
push eax
call fcn.10036a7e
pop ecx
call eax
cmp eax, ebx
je 0x1003e587
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x10059434]
call fcn.10036a7e
pop ecx
call eax
test eax, eax
je 0x1003e587
test byte [ebp - 0x18], 1
jne 0x1003e5ba
lea eax, [ebp - 0xc]
push eax
call fcn.10038326
test eax, eax
pop ecx
je 0x1003e5a2
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10031562
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x1003e5b1
or dword [ebp + 0x10], 0x200000
jmp 0x1003e5eb
or dword [ebp + 0x10], 0x40000
jmp 0x1003e5eb
mov eax, dword [0x10059428]
cmp eax, esi
je 0x1003e5eb
push eax
call fcn.10036a7e
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1003e5eb
mov eax, dword [0x1005942c]
cmp eax, esi
je 0x1003e5eb
push dword [ebp - 4]
push eax
call fcn.10036a7e
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x10059424]
call fcn.10036a7e
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x40bdb9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40bdc8
pop dword [ebp - 0x3c]
mov eax, 0x40bdc8
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xee7b7bc8
sub dword [ebp - 0x4c], 0xa029367d
mov dword [ebp - 0x48], 0xcf570b80
add dword [ebp - 0x48], 0x62dc40c5
mov dword [ebp - 0x44], 0x465023a4
add dword [ebp - 0x44], 0x5fc208a
mov dword [ebp - 0x40], 0xf43d828
add dword [ebp - 0x40], 0xf0bc27d8
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x3c306d9f
add dword [ebp - 0x4c], 0x3841fbb7
mov dword [ebp - 0x48], 0xfe369a03
sub dword [ebp - 0x48], 0xbcca388e
mov dword [ebp - 0x44], 0xe75e158b
add dword [ebp - 0x44], 0x7c1156e1
mov dword [ebp - 0x40], 0x57f8cedf
add dword [ebp - 0x40], 0xa8073121
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x687644bb
sub eax, 0x6835746f
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3f476
push 0
call eax
mov ecx, 0xbd4a7168
sub ecx, 0xbd4a125f
mov edi, eax
mov esi, 0x41b000
add esi, dword [ebp - 0x3c]
mov ebx, 0x9304a45d
xor dword [ebp - 0x2c], 0xb4b1fea
mov edx, dword [esi]
sub edx, ebx
xor dword [ebp - 0x20], 0xdf1d2cce
mov dword [edi], edx
sub dword [ebp - 4], ebx
add edi, 0x34a9728
sub edi, 0x34a9724
add esi, 4
loop 0x40bed4
add eax, 0x16ef7
mov ebx, eax
add eax, 0xe280cb8e
add eax, 0x1d7f3477
mov ecx, 0x5e5b5245
add ecx, 0xa1e4adbb
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x426e7f
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x14
push dword [0x53749c]
push dword [0x515004]
call dword [sym.imp.KERNEL32.DLL_GetConsoleScreenBufferInfo]
mov eax, 0
mov dword [ebp - 0xc], 0
mov eax, dword [0x53749c]
mov eax, dword [eax]
and eax, 0xffff
mov dword [ebp - 0x18], eax
mov eax, dword [0x53749c]
mov eax, dword [eax]
shr eax, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
cmp eax, 0
je 0x426f0e
cmp eax, 1
je 0x426f45
cmp eax, 2
je 0x426f6e
cmp eax, 4
je 0x426f89
cmp eax, 5
je 0x426fbd
cmp eax, 3
je 0x426fe5
call fcn.00426f05
mov eax, dword [0x53749c]
mov eax, dword [eax + 4]
shr eax, 0x10
mov edx, eax
mov eax, dword [ebp - 0x18]
imul edx
mov dword [ebp - 0x10], eax
mov eax, 0
mov dword [ebp - 0x14], 0
jmp 0x427007
mov eax, dword [ebp - 0x18]
push edx
mov edx, dword [ebp - 0x1c]
imul edx
pop edx
mov dword [ebp - 0x10], eax
mov eax, 0
mov dword [ebp - 0x14], 0
jmp 0x427007
mov eax, dword [0x53749c]
mov eax, dword [eax]
and eax, 0xffff
push eax
mov eax, dword [0x53749c]
mov eax, dword [eax + 4]
and eax, 0xffff
pop edx
xchg edx, eax
sub eax, edx
mov dword [ebp - 0x10], eax
mov eax, dword [0x53749c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
jmp 0x427007
mov eax, dword [0x53749c]
mov eax, dword [eax + 4]
and eax, 0xffff
mov dword [ebp - 0x10], eax
mov eax, dword [0x53749c]
mov eax, dword [eax + 4]
and eax, 0xffff0000
mov dword [ebp - 0x14], eax
jmp 0x427007
mov eax, dword [0x53749c]
mov eax, dword [eax]
and eax, 0xffff
mov dword [ebp - 0x10], eax
mov eax, dword [0x53749c]
mov eax, dword [eax + 4]
and eax, 0xffff0000
mov dword [ebp - 0x14], eax

Function at 0x427398
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x4273cf
cmp eax, 2
je 0x4273ff
cmp eax, 4
je 0x42742f
call fcn.004273c6
mov eax, dword [ebp + 8]
mov al, byte [eax + 2]
cmp al, 0x5b
je 0x427416
mov eax, 0
jmp 0x427d69
mov eax, dword [ebp + 8]
add eax, 4
mov dword [ebp + 8], eax
mov eax, 4
mov dword [ebp - 0x10], 4
jmp 0x42745d
mov eax, dword [ebp + 8]
mov al, byte [eax + 4]
cmp al, 0x5b
je 0x427446
mov eax, 0
jmp 0x427d69
mov eax, dword [ebp + 8]
add eax, 8
mov dword [ebp + 8], eax
mov eax, 8
mov dword [ebp - 0x10], 8
Function at 0x4283ee
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xc
mov eax, dword [0x53748c]
cmp eax, 0
je 0x42843e
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
jmp 0x428428
and eax, 0xff
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
and eax, 0xff
push eax
call fcn.00427dd6
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0
jne 0x42840c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
sub eax, edx
mov dword [ebp - 0x10], eax
jmp 0x428471
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.DLL_strlen]
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, 0
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp + 8]
push dword [0x515004]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
xor eax, eax
push eax
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.0042bb24
mov eax, dword [ebp + 8]
leave
ret 4

Function at 0x4286a1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 8
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
shl eax, 1
push eax
call dword [sym.imp.MSVCRT.DLL_malloc]
add esp, 4
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
mov eax, dword [ebp - 0xc]
dec eax
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x4315d6
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x28
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
and eax, 0x1f
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x10]
pop eax
bsr eax, eax
mov edx, eax
mov eax, dword [ebp - 0x2c]
mov cl, dl
shl eax, cl
xchg edx, eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
add eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0x38
jne 0x43164f
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0xc]
cmp eax, 0
jl 0x43164f
jmp 0x431653
xor eax, eax
jmp 0x431656
xor eax, eax
inc eax
cmp eax, 0
je 0x43168e
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x10]
pop eax
bsr eax, eax
mov edx, eax
mov eax, dword [ebp - 0x28]
mov cl, dl
shl eax, cl
mov edx, eax
mov eax, dword [ebp - 0x14]
add eax, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x28]
shl eax, 2
mov dword [ebp - 0x28], eax
jmp 0x4316b6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x14]
sub eax, edx
push eax
push dword [ebp - 0x10]
pop eax
bsr eax, eax
pop edx
xchg edx, eax
mov cl, dl
sar eax, cl
shl eax, 2
mov dword [ebp - 0x28], eax
mov eax, dword [0x53d624]
mov dword [ebp - 0x20], eax
jmp 0x4317cc
Function at 0x439840
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [0x53d6d8]
cmp eax, edx
jle 0x439867
mov eax, dword [ebp - 0xc]
mov dword [0x53d6d8], eax
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp + 0xc], eax
mov eax, dword [0x53752c]
mov edx, eax
mov eax, dword [ebp - 0xc]
push edx
mov edx, 0xc
mov ecx, edx
imul ecx
pop edx
add eax, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
push eax
call dword [sym.imp.MSVCRT.DLL_strlen]
add esp, 4
dec eax
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], edx
mov eax, dword [0x540a00]
cmp eax, 0
je 0x4398e8
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
push eax
call fcn.0044c2fc
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
sub eax, 3
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
cmp eax, 0x3e
je 0x43996e
push 0
push dword [str._n_r_t__e]
push 3
push 0
push 0x3e
push 2
push 0
push 0x549db0
push 6
push 0
push dword [str._n_r_t__e]
push 3
push 0
push dword [ebp + 8]
push 2
push 0
push str._Found:
push 6
push 0
push dword [str._n_r_t__e]
push 3
push 0
push dword [ebp - 0xc]
push 2
push 0
push str._Datatype_Error:_invalid_actions_count_for_type:
push 6
push 0x6c
lea esi, [esp + 4]
push esi
push 9
call fcn.004219a8
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
mov eax, dword [ebp - 0xc]
shl eax, 8
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0
je 0x439990
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
cmp eax, 0xffffffff
jne 0x439990
jmp 0x439994
xor eax, eax
jmp 0x439997
xor eax, eax
inc eax
cmp eax, 0
je 0x4399c5
mov eax, dword [ebp - 0x14]
shl eax, 8
inc eax
push eax
mov eax, 0x3e
mov edx, dword [ebp + 8]
sub eax, edx
pop edx
xchg edx, eax
add eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [0x537530]
mov edi, dword [ebp - 0x18]
dec edi
mov eax, dword [eax + edi*4]
jmp 0x4399ca
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov edx, eax
mov eax, dword [0x537530]
mov edi, dword [ebp - 0x10]
dec edi
mov dword [eax + edi*4], edx
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
dec eax
mov dword [ebp + 8], eax
mov eax, 0
mov edx, dword [ebp + 8]
cmp eax, edx
jne 0x439978
leave
pop esi
pop ecx
pop ecx
pop ecx
add esp, ecx
push esi
ret