joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48ba90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x48bb7f
sub esp, 0x54
mov eax, dword [0x6ee74c]
mov dword [esp], eax
call fcn.004889f0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x50], ecx
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x3c], ecx
mov dword [esp], eax
mov dword [esp + 4], 8
mov eax, dword [esp + 0x58]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0
call fcn.0043f240
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x48bb5b
xor eax, eax
mov ecx, eax
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], eax
add esp, 0x54
ret
mov dword [esp + 0x38], eax
lea eax, [0x6c0470]
mov dword [esp], eax
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
call fcn.0040c180
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
jmp 0x48bb4f
call fcn.0044a520
jmp fcn.0048ba90

Function at 0x48bff0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x48c0fc
sub esp, 0x4c
mov eax, dword [0x6ee7a0]
mov dword [esp], eax
call fcn.004889f0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x3c], ecx
mov dword [esp], eax
mov dword [esp + 4], 9
mov eax, dword [esp + 0x50]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x28], eax
call fcn.0043f240
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
cmp eax, 0xffffffff
jne 0x48c0f6
test ecx, ecx
je 0x48c0e8
cmp ecx, 0x3e5
jne 0x48c0c4
mov eax, dword [0x6ea7c8]
mov ecx, dword [0x6ea7cc]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x4c
ret
mov dword [esp + 0x38], ecx
lea eax, [0x6c0470]
mov dword [esp], eax
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
call fcn.0040c180
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
jmp 0x48c0b8
lea ecx, [0x6084f8]
lea eax, [0x6c0470]
jmp 0x48c0b8
xor ecx, ecx
mov eax, ecx
jmp 0x48c0b8
call fcn.0044a520
jmp fcn.0048bff0
Function at 0x4d1910
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4d1b2d
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x4d19c7
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
cmp ecx, 0xe
jne 0x4d1a40
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x4d19a8
cmp ecx, 0xf
jne 0x4d1ab9
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x4d19a8
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
jmp 0x4d19a8
call fcn.0044a520
jmp fcn.004d1910
Function at 0x521110
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5212cc
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x521139
mov byte [esp + 0xc], 0
ret
lea ecx, [eax - 0x61]
cmp cl, 0x19
jbe 0x521133
lea ecx, [eax - 0x30]
cmp cl, 9
jbe 0x521133
mov ecx, dword [esp + 8]
cmp ecx, 3
jne 0x5212be
cmp al, 0x2c
ja 0x52129b
lea edx, [eax - 0x21]
cmp dl, 1
ja 0x52116d
mov byte [esp + 0xc], 0
ret
cmp al, 0x24
je 0x521167
lea edx, [eax - 0x26]
cmp dl, 6
jbe 0x521167
cmp al, 0x2f
ja 0x521261
cmp al, 0x26
ja 0x521239
cmp al, 0x24
jne 0x52122e
cmp ecx, 2
jg 0x5211e4
cmp ecx, 1
je 0x5211d9
cmp ecx, 2
jne 0x5211d3
cmp al, 0x2f
jne 0x5211b3
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x3b
jne 0x5211bf
mov eax, 1
jmp 0x5211ae
cmp al, 0x2c
jne 0x5211cb
mov eax, 1
jmp 0x5211ae
cmp al, 0x3f
sete al
jmp 0x5211ae
mov byte [esp + 0xc], 1
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x521218
cmp al, 0x40
jne 0x5211f8
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x2f
jne 0x521204
mov eax, 1
jmp 0x5211f3
cmp al, 0x3f
jne 0x521210
mov eax, 1
jmp 0x5211f3
cmp al, 0x3a
sete al
jmp 0x5211f3
cmp ecx, 6
je 0x521228
cmp ecx, 7
jne 0x5211d3
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x26
je 0x521195
jmp 0x5211d3
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x521195
lea edx, [eax - 0x2d]
cmp dl, 1
ja 0x521253
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
je 0x521195
jmp 0x5211d3
cmp al, 0x3d
ja 0x521280
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x521195
cmp al, 0x3d
je 0x521195
jmp 0x5211d3
lea edx, [eax - 0x3f]
cmp dl, 1
jbe 0x521195
cmp al, 0x5f
je 0x52124d
cmp al, 0x7e
je 0x52124d
jmp 0x5211d3
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x521167
cmp al, 0x5b
je 0x521167
cmp al, 0x5d
je 0x521167
jmp 0x52117a
cmp ecx, 4
je 0x521156
jmp 0x52117a
call fcn.0044a520
jmp fcn.00521110
Function at 0x55c750
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x55c8e5
sub esp, 0x74
mov eax, dword [esp + 0x78]
test eax, eax
je 0x55c8de
mov ecx, dword [eax]
lea eax, [0x5ce240]
mov dword [esp], eax
mov dword [esp + 4], ecx
sar ecx, 0x1f
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.004065c0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x40], eax
lea edi, [esp + 0x44]
xor eax, eax
call fcn.0044c134
lea eax, [0x5ce240]
mov dword [esp], eax
mov ecx, dword [esp + 0x78]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x44]
mov dword [esp + 8], ecx
call fcn.004079d0
jmp 0x55c7df
lea eax, [esp + 0x44]
mov dword [esp], eax
call fcn.00407e00
mov eax, dword [esp + 0x44]
test eax, eax
je 0x55c8d2
mov ecx, dword [esp + 0x48]
mov edx, dword [eax + 4]
mov dword [esp + 0x30], edx
mov ebx, dword [ecx + 8]
mov dword [esp + 0x2c], ebx
mov ebp, dword [ecx + 4]
mov dword [esp + 0x28], ebp
mov eax, dword [eax]
mov dword [esp + 0x3c], eax
mov ecx, dword [ecx]
mov dword [esp + 0x38], ecx
lea esi, [0x5a5c80]
mov dword [esp], esi
mov dword [esp + 4], ebp
mov dword [esp + 8], ebp
call fcn.00438ab0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x24], edx
lea ebx, [0x5a5c80]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x18], ebp
call fcn.0040f270
lea eax, [0x5ce240]
mov dword [esp], eax
mov ecx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0xc], edx
call fcn.0040a7c0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 8], ecx
mov ecx, dword [0x7016d0]
test ecx, ecx
jne 0x55c8bd
mov ecx, dword [esp + 0x34]
mov dword [eax], ecx
jmp 0x55c7d3
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call fcn.0040ef10
jmp 0x55c7d3
mov eax, dword [esp + 0x40]
mov dword [esp + 0x7c], eax
add esp, 0x74
ret
xor ecx, ecx
jmp 0x55c777
call fcn.0044a520
jmp fcn.0055c750
Function at 0x55d2f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x55d485
sub esp, 0x74
mov eax, dword [esp + 0x78]
test eax, eax
je 0x55d47e
mov ecx, dword [eax]
lea eax, [0x5ce240]
mov dword [esp], eax
mov dword [esp + 4], ecx
sar ecx, 0x1f
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.004065c0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x40], eax
lea edi, [esp + 0x44]
xor eax, eax
call fcn.0044c134
lea eax, [0x5ce240]
mov dword [esp], eax
mov ecx, dword [esp + 0x78]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x44]
mov dword [esp + 8], ecx
call fcn.004079d0
jmp 0x55d37f
lea eax, [esp + 0x44]
mov dword [esp], eax
call fcn.00407e00
mov eax, dword [esp + 0x44]
test eax, eax
je 0x55d472
mov ecx, dword [esp + 0x48]
mov edx, dword [eax + 4]
mov dword [esp + 0x30], edx
mov ebx, dword [ecx + 8]
mov dword [esp + 0x2c], ebx
mov ebp, dword [ecx + 4]
mov dword [esp + 0x28], ebp
mov eax, dword [eax]
mov dword [esp + 0x3c], eax
mov ecx, dword [ecx]
mov dword [esp + 0x38], ecx
lea esi, [0x5a5c80]
mov dword [esp], esi
mov dword [esp + 4], ebp
mov dword [esp + 8], ebp
call fcn.00438ab0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x24], edx
lea ebx, [0x5a5c80]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x18], ebp
call fcn.0040f270
lea eax, [0x5ce240]
mov dword [esp], eax
mov ecx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0xc], edx
call fcn.0040a7c0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 8], ecx
mov ecx, dword [0x7016d0]
test ecx, ecx
jne 0x55d45d
mov ecx, dword [esp + 0x34]
mov dword [eax], ecx
jmp 0x55d373
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call fcn.0040ef10
jmp 0x55d373
mov eax, dword [esp + 0x40]
mov dword [esp + 0x7c], eax
add esp, 0x74
ret
xor ecx, ecx
jmp 0x55d317
call fcn.0044a520
jmp fcn.0055d2f0
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x412d00
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x412ea6
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x3b
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xf8
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x8c
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xe3
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xb9
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 6
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x10
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x9f
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x4b
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x8e
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x42
add esp, 0x40
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x5f
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x89
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x8a
add esp, 0x30
inc esi
cmp esi, edi
jb 0x412d20
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x451ba9
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x451bba
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405907
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49b052
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49b063
pop esi
ret
push ebx
push edi
push esi
call fcn.0049af39
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fda
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49b08b
push ebx
push esi
push edi
call fcn.004056fa
add esp, 0xc
push 0
call fcn.00406244
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x4039ae
Capabilities:
Terminate process

Disassembly:
jmp 0x455c29
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x455c3a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00406014
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x403ae4
Capabilities:
Query environment variable

Disassembly:
jmp 0x4ab3b2
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4ab3c3
pop esi
ret
push ebx
push edi
push esi
call fcn.004ab299
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0040444e
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4ab3eb
push ebx
push esi
push edi
call fcn.00405dd5
add esp, 0xc
push 0
call fcn.00406a6e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x405eb1
Capabilities:
Parse pe header

Disassembly:
jmp 0x4449e9
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x444a28
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x444a28
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x444a28
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x444a28
cmp dword [ecx + 0x74], 0xe
jbe 0x444a28
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4a1f6e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00401ef6
mov eax, dword [0x4de034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004065fa
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4a1fb0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4a210c
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0040677b
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x4e1e90]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.004035a8
mov ecx, dword [esi*4 + 0x4e1e90]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x4a2105
cmp eax, dword [edi + ecx + 0x24]
jne 0x4a2105
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a2105
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004035a8
add esp, 0x14
test edx, edx
jl 0x4a2105
jg 0x4a207b
test eax, eax
jb 0x4a2105
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4a2105
jl 0x4a2095
cmp dword [ebp - 0x1008], eax
ja 0x4a2105
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4a20b3
test ebx, ebx
je 0x4a20ec
cmp ecx, edi
jae 0x4a20ec
mov al, byte [ecx]
cmp al, 0xd
jne 0x4a20cd
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4a20d9
cmp byte [ecx + 1], 0xa
jne 0x4a20d9
inc ecx
jmp 0x4a20d9
movzx eax, al
movsx eax, byte [eax + 0x4de360]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4a20b3
cmp edx, ebx
jne 0x4a20b3
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4a210a
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040335a
leave
ret
Function at 0x4a284b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4e1e90]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4a288b
cmp byte [ebx], 0xa
jne 0x4a288b
or byte [eax + edi + 0x28], 4
jmp 0x4a2890
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x4a298e
mov al, byte [edx]
cmp al, 0x1a
je 0x4a2970
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x4a28bf
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4a28e4
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x4a28ee
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x4a28a1
jmp 0x4a298e
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a296b
cmp dword [ebp - 0xc], 0
je 0x4a296b
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x4e1e90]
test byte [eax + edi + 0x28], 0x48
je 0x4a2945
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4a2930
mov byte [esi], dl
jmp 0x4a2941
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4e1e90]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4a298e
cmp byte [ebp - 1], 0xa
jne 0x4a2954
cmp esi, ebx
jne 0x4a2954
mov byte [esi], 0xa
jmp 0x4a298d
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00401a19
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4a298e
mov byte [esi], 0xd
jmp 0x4a298d
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x4e1e90]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4a298a
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4a298e
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4a29ea
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x4e1e90]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4a2a2d
cmp word [esi], dx
jne 0x4a2a2d
or byte [edi + eax + 0x28], 4
jmp 0x4a2a32
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x4a2b85
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4a2b65
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4a2a74
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4a2aaa
cmp eax, edx
jae 0x4a2ab6
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4a2a4c
jmp 0x4a2b85
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a2b61
cmp dword [ebp - 0x14], 0
je 0x4a2b61
mov eax, dword [ebx*4 + 0x4e1e90]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4a2b39
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x4a2b02
mov word [esi], cx
jmp 0x4a2b35
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x4e1e90]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x4e1e90]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x4e1e90]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x4a2b85
pop ebx
cmp word [ebp - 4], bx
jne 0x4a2b4a
cmp esi, dword [ebp + 0xc]
jne 0x4a2b4a
mov word [esi], bx
jmp 0x4a2b82
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00401a19
add esp, 0x10
cmp word [ebp - 4], bx
je 0x4a2b85
push 0xd
jmp 0x4a2b7e
mov ecx, dword [ebx*4 + 0x4e1e90]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4a2b7c
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4a2b85
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret