joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ee20
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d79b
mov eax, dword fs:[0]
push eax
sub esp, 0x490
mov eax, dword [0x457b80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x480], eax
mov eax, dword [ebp + 0x14]
push str._s_
mov dword [ebp - 0x47c], eax
lea eax, [ebp - 0x210]
push 0x200
push eax
call fcn.00410080
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.00410680
add esp, 0x18
cmp dword [ebp - 0x214], 7
lea ecx, [ebp - 0x478]
lea eax, [ebp - 0x228]
mov dword [ebp - 4], 0
cmova eax, dword [ebp - 0x228]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40efe3
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
nop word [eax + eax]
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x49c]
push eax
call fcn.004107c0
add esp, 8
cmp byte [ebp - 0x484], 0
mov byte [ebp - 4], 1
jne 0x40ef0a
push edi
push str.ERROR:_file_folder_name_containing_invalid_UTF_16_found_in_folder__s
push str.filesystem
push 0
call fcn.0040d490
add esp, 0x10
jmp 0x40ef42
cmp dword [ebp - 0x488], 0xf
lea ecx, [ebp - 0x49c]
push dword [ebp - 0x47c]
cmova ecx, dword [ebp - 0x49c]
mov eax, dword [ebp - 0x478]
push dword [ebp + 0x10]
shr eax, 4
and eax, 1
push eax
push ecx
call dword [ebp - 0x480]
add esp, 0x10
test eax, eax
jne 0x40ef9d
cmp byte [ebp - 0x484], 0
mov byte [ebp - 4], 0
je 0x40ef89
mov ecx, dword [ebp - 0x488]
cmp ecx, 0xf
jbe 0x40ef89
mov edx, dword [ebp - 0x49c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40ef7f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f03b
push ecx
push edx
call fcn.00411449
add esp, 8
lea eax, [ebp - 0x478]
push eax
push esi
call ebx
test eax, eax
jne 0x40eed0
jmp 0x40efdc
cmp byte [ebp - 0x484], 0
je 0x40efdc
mov ecx, dword [ebp - 0x488]
cmp ecx, 0xf
jbe 0x40efdc
mov edx, dword [ebp - 0x49c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40efd2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f03b
push ecx
push edx
call fcn.00411449
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x214]
cmp ecx, 7
jbe 0x40f01f
mov edx, dword [ebp - 0x228]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f015
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f040
push ecx
push edx
call fcn.00411449
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041139d
mov esp, ebp
pop ebp
ret
call fcn.00418631
call fcn.00418631
int3
Function at 0x40f3f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x457b80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00410680
add esp, 8
lea eax, [ebp - 0x1c]
cmp dword [ebp - 8], 7
cmova eax, dword [ebp - 0x1c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40f43b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40f43b
or esi, 0xffffffff
jmp 0x40f43d
xor esi, esi
mov ecx, dword [ebp - 8]
cmp ecx, 7
jbe 0x40f473
mov edx, dword [ebp - 0x1c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f469
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f484
push ecx
push edx
call fcn.00411449
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041139d
mov esp, ebp
pop ebp
ret
call fcn.00418631
int3

Function at 0x40f490
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x457b80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x1ff
push eax
lea eax, [ebp - 0x204]
mov byte [ebp - 0x204], 0
push eax
call fcn.00419d20
lea eax, [ebp - 0x204]
add esp, 0xc
lea edx, [eax + 1]
nop dword [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40f4d0
push ebx
sub eax, edx
push esi
push edi
test eax, eax
jle 0x40f514
dec eax
lea esi, [ebp - 0x204]
add esi, eax
mov cl, byte [esi]
and cl, 0xc0
cmp cl, 0x80
jne 0x40f4f7
test eax, eax
jne 0x40f4e0
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], esi
push eax
call fcn.004103a0
add esp, 4
cmp eax, 0xffffffff
jne 0x40f514
mov byte [esi], 0
cmp byte [ebp - 0x203], 0
mov esi, 1
je 0x40f5c7
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov al, byte [ebp + esi - 0x204]
cmp al, 0x2f
je 0x40f541
cmp al, 0x5c
jne 0x40f5b8
cmp byte [ebp + esi - 0x203], 0
je 0x40f5b8
cmp byte [ebp + esi - 0x205], 0x3a
je 0x40f5b8
cmp esi, 0x200
jae 0x40f5f9
lea eax, [ebp - 0x204]
mov byte [ebp + esi - 0x204], 0
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00410680
add esp, 8
lea eax, [ebp - 0x21c]
cmp dword [ebp - 0x208], 7
cmova eax, dword [ebp - 0x21c]
push 0
push eax
call ebx
test eax, eax
jne 0x40f5a5
call edi
cmp eax, 0xb7
jne 0x40f5da
lea ecx, [ebp - 0x21c]
call fcn.00408a50
mov byte [ebp + esi - 0x204], 0x2f
inc esi
cmp byte [ebp + esi - 0x204], 0
jne 0x40f532
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041139d
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x21c]
call fcn.00408a50
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041139d
mov esp, ebp
pop ebp
ret
call fcn.004112c0
int3
Function at 0x40f600
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x457b80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00410680
add esp, 8
lea eax, [ebp - 0x1c]
cmp dword [ebp - 8], 7
cmova eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 8]
neg eax
sbb esi, esi
cmp ecx, 7
jbe 0x40f66d
mov edx, dword [ebp - 0x1c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f663
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f67f
push ecx
push edx
call fcn.00411449
add esp, 8
mov ecx, dword [ebp - 4]
lea eax, [esi + 1]
xor ecx, ebp
pop esi
call fcn.0041139d
mov esp, ebp
pop ebp
ret
call fcn.00418631
int3

Function at 0x40f690
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x457b80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00410680
add esp, 8
lea eax, [ebp - 0x1c]
cmp dword [ebp - 8], 7
cmova eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp - 8]
neg eax
sbb esi, esi
neg esi
cmp ecx, 7
jbe 0x40f6ff
mov edx, dword [ebp - 0x1c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f6f5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f711
push ecx
push edx
call fcn.00411449
add esp, 8
mov ecx, dword [ebp - 4]
lea eax, [esi - 1]
xor ecx, ebp
pop esi
call fcn.0041139d
mov esp, ebp
pop ebp
ret
call fcn.00418631
int3
Function at 0x40f720
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d82d
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x457b80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00410680
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push esi
push eax
call fcn.00410680
add esp, 0x10
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 7
lea eax, [ebp - 0x40]
cmova ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 7
push 3
cmova eax, dword [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 0x14]
neg eax
sbb esi, esi
cmp ecx, 7
jbe 0x40f7c7
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f7bd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f82e
push ecx
push edx
call fcn.00411449
add esp, 8
mov ecx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp ecx, 7
jbe 0x40f811
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f807
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f82e
push ecx
push edx
call fcn.00411449
add esp, 8
lea eax, [esi + 1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041139d
mov esp, ebp
pop ebp
ret
call fcn.00418631
int3

Function at 0x40f970
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040f9d0
add esp, 8
mov esi, eax
test byte [ebp + 0xc], 8
je 0x40f9c6
test esi, esi
je 0x40f9c6
push esi
push 3
lea eax, [ebp - 4]
push 1
push eax
call fcn.0041b416
add esp, 0x10
cmp eax, 3
jne 0x40f9b7
cmp byte [ebp - 4], 0xef
jne 0x40f9b7
cmp byte [ebp - 3], 0xbb
jne 0x40f9b7
cmp byte [ebp - 2], 0xbf
je 0x40f9c4
push 0
push 0
push esi
call fcn.0041b7b9
add esp, 0xc
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40fb70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.0041b416
add esp, 0x10
pop ebp
ret
Function at 0x40fb90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 2
push 0
push ebx
call fcn.0041b7b9
push ebx
call fcn.0041be18
push 0
push 0
push ebx
mov esi, eax
call fcn.0041b7b9
mov eax, 0x400
test esi, esi
cmovs esi, eax
lea edi, [esi + 1]
push edi
call fcn.00414829
push dword [ebp + 8]
mov ebx, eax
push edi
push 1
push ebx
call fcn.0041b416
add esp, 0x30
mov dword [ebp - 4], eax
cmp eax, esi
jae 0x40fbf0
lea ecx, [eax + 1]
push ecx
push ebx
call fcn.00418728
mov esi, dword [ebp - 4]
jmp 0x40fc50
jbe 0x40fc55
lea edi, [eax + eax]
mov esi, eax
push edi
push ebx
call fcn.00418728
push dword [ebp + 8]
mov ebx, eax
mov eax, esi
push eax
push 1
lea ecx, [eax + ebx]
push ecx
call fcn.0041b416
add esp, 0x18
test eax, eax
je 0x40fc46
add esi, eax
cmp esi, edi
jne 0x40fc2c
add edi, edi
push edi
push ebx
call fcn.00418728
add esp, 8
mov ebx, eax
push dword [ebp + 8]
mov eax, edi
sub eax, esi
push eax
lea eax, [ebx + esi]
push 1
push eax
call fcn.0041b416
add esp, 0x10
test eax, eax
jne 0x40fc18
lea eax, [esi + 1]
push eax
push ebx
call fcn.00418728
mov ebx, eax
add esp, 8
mov eax, dword [ebp + 0xc]
mov byte [ebx + esi], 0
pop edi
mov dword [eax], ebx
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40fc70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 2
push 0
push ebx
call fcn.0041b7b9
push ebx
call fcn.0041be18
push 0
push 0
push ebx
mov esi, eax
call fcn.0041b7b9
mov eax, 0x400
test esi, esi
cmovs esi, eax
lea edi, [esi + 1]
push edi
call fcn.00414829
push dword [ebp + 8]
mov ebx, eax
push edi
push 1
push ebx
call fcn.0041b416
add esp, 0x30
mov dword [ebp - 4], eax
cmp eax, esi
jae 0x40fcd0
lea ecx, [eax + 1]
push ecx
push ebx
call fcn.00418728
mov esi, dword [ebp - 4]
jmp 0x40fd30
jbe 0x40fd35
lea edi, [eax + eax]
mov esi, eax
push edi
push ebx
call fcn.00418728
push dword [ebp + 8]
mov ebx, eax
mov eax, esi
push eax
push 1
lea ecx, [eax + ebx]
push ecx
call fcn.0041b416
add esp, 0x18
test eax, eax
je 0x40fd26
add esi, eax
cmp esi, edi
jne 0x40fd0c
add edi, edi
push edi
push ebx
call fcn.00418728
add esp, 8
mov ebx, eax
push dword [ebp + 8]
mov eax, edi
sub eax, esi
push eax
lea eax, [ebx + esi]
push 1
push eax
call fcn.0041b416
add esp, 0x10
test eax, eax
jne 0x40fcf8
lea eax, [esi + 1]
push eax
push ebx
call fcn.00418728
mov ebx, eax
add esp, 8
xor eax, eax
mov byte [ebx + esi], 0
test esi, esi
je 0x40fd4b
nop
cmp byte [eax + ebx], 0
je 0x40fd54
inc eax
cmp eax, esi
jb 0x40fd40
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call fcn.0041480e
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410540
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push 8
call fcn.00414829
mov ecx, dword [ebp + 8]
add esp, 4
mov dword [eax], ecx
mov ecx, dword [ebp + 0xc]
push 0
push 0
push eax
push 0x4105a0
push 0
push 0
mov dword [eax + 4], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
push str.CreateThread_failure
setne cl
movzx ecx, cl
push ecx
push 0x330
push str.D:_acactuscactus_src_base_system.cpp
call fcn.0040e9b0
add esp, 0x10
mov eax, esi
pop esi
pop ebp
ret

Function at 0x4121a6
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4121e5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4121e5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4121e5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4121e5
cmp dword [ecx + 0x74], 0xe
jbe 0x4121e5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x41bc11
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00411480
mov eax, dword [0x457b80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0041b216
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41bc53
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41bdaf
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004114b0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x45f6c8]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.004182d0
mov ecx, dword [esi*4 + 0x45f6c8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x41bda8
cmp eax, dword [ecx + edi + 0x24]
jne 0x41bda8
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41bda8
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004182d0
add esp, 0x14
test edx, edx
jl 0x41bda8
jg 0x41bd1e
test eax, eax
jb 0x41bda8
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41bda8
jl 0x41bd38
cmp dword [ebp - 0x1008], eax
ja 0x41bda8
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41bd56
test ebx, ebx
je 0x41bd8f
cmp ecx, edi
jae 0x41bd8f
mov al, byte [ecx]
cmp al, 0xd
jne 0x41bd70
lea eax, [edi - 1]
cmp ecx, eax
jae 0x41bd7c
cmp byte [ecx + 1], 0xa
jne 0x41bd7c
inc ecx
jmp 0x41bd7c
movzx eax, al
movsx eax, byte [eax + 0x457d50]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41bd56
cmp edx, ebx
jne 0x41bd56
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x41bdad
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0041139d
leave
ret
Function at 0x41f9ef
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x45f6c8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41fa2f
cmp byte [ebx], 0xa
jne 0x41fa2f
or byte [edi + eax + 0x28], 4
jmp 0x41fa34
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x41fb33
mov dl, byte [eax]
cmp dl, 0x1a
je 0x41fb16
inc eax
cmp dl, 0xd
je 0x41fa60
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x41fa86
cmp eax, ecx
jae 0x41fa94
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x41fa48
jmp 0x41fb33
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41fb11
cmp dword [ebp - 0x10], 0
je 0x41fb11
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x45f6c8]
test byte [eax + edi + 0x28], 0x48
je 0x41faeb
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x41fad6
mov byte [esi], dl
jmp 0x41fae7
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x45f6c8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x41fb33
cmp byte [ebp - 1], 0xa
jne 0x41fafa
cmp esi, ebx
jne 0x41fafa
mov byte [esi], 0xa
jmp 0x41fb32
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004182ee
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x41fb33
mov byte [esi], 0xd
jmp 0x41fb32
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x45f6c8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41fb30
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41fb33
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41fb3c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x45f6c8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41fb82
cmp word [ebx], dx
jne 0x41fb82
or byte [eax + edi + 0x28], 4
jmp 0x41fb87
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x41fcea
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x41fcca
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x41fbc8
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41fbfe
cmp eax, edx
jae 0x41fc0c
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x41fba3
jmp 0x41fcea
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41fcc5
cmp dword [ebp - 0x18], 0
je 0x41fcc5
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x45f6c8]
test byte [eax + edi + 0x28], 0x48
je 0x41fc9b
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x41fc5f
mov word [esi], cx
jmp 0x41fc96
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x45f6c8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x45f6c8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x45f6c8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x41fcea
pop eax
cmp word [ebp - 4], ax
jne 0x41fcab
cmp esi, ebx
jne 0x41fcab
mov word [esi], ax
jmp 0x41fce7
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004182ee
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x41fcea
push 0xd
pop eax
jmp 0x41fca6
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x45f6c8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x41fce4
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x41fcea
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x42306f
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x451098
push 0x451090
push str.FlsAlloc
push 0x1f
call fcn.00422f2e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4230a3
push dword [ebp + 8]
mov ecx, esi
call dword [0x42e1f4]
call esi
jmp 0x4230a9
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4230ed
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4510a8
push 0x4510a0
push str.FlsGetValue
push 0x21
call fcn.00422f2e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x423124
push dword [ebp + 8]
mov ecx, esi
call dword [0x42e1f4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x42312c
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4510b0
push 0x4510a8
push str.FlsSetValue
push 0x22
call fcn.00422f2e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x423166
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42e1f4]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x427593
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x427630
push ebx
push esi
call fcn.0042755c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00422c99
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4275dd
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42762f
push edi
push eax
call fcn.00420f69
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4275fd
call fcn.00420f2f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42762e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00422c99
add esp, 0x20
test eax, eax
jne 0x42761c
push edi
call fcn.00420f2f
jmp 0x427624
push ebx
call fcn.00420f2f
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x427633
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x427644
pop esi
ret
push ebx
push edi
push esi
call fcn.0042755c
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00420f69
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x42766c
push ebx
push esi
push edi
call fcn.00412ad0
add esp, 0xc
push 0
call fcn.00420f2f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x427dc6
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004278e1

Function at 0x42cfd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42cffd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42cffd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret