joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c460
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4221c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push esi
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x54]
cmp dword [eax + 0x44], 0
je 0x40c493
mov ecx, dword [ebp - 0x54]
movzx edx, byte [ecx + 0x49]
test edx, edx
jne 0x40c49f
mov al, 1
jmp 0x40c642
mov dword [ebp - 0x10], 8
call fcn.0040a290
push eax
mov eax, dword [ebp - 0x54]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x54]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x38], eax
call fcn.0040a290
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x38]
push ecx
lea edx, [ebp - 0x3c]
push edx
call fcn.0040a270
add esp, 8
movzx eax, al
test eax, eax
je 0x40c4e2
xor al, al
jmp 0x40c642
push 0
push 8
lea ecx, [ebp - 0x30]
call fcn.0040b910
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x40]
push edx
lea ecx, [ebp - 0x30]
call fcn.0040bae0
mov ecx, eax
call fcn.0040c770
mov esi, eax
lea ecx, [ebp - 0x30]
call fcn.0040af80
add esi, eax
push esi
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040bae0
mov ecx, eax
call fcn.0040c770
push eax
mov ecx, dword [ebp - 0x54]
add ecx, 0x4c
push ecx
mov edx, dword [ebp - 0x54]
mov ecx, dword [edx + 0x44]
call fcn.0040d2f0
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x40c55d
cmp dword [ebp - 0x58], 1
je 0x40c564
cmp dword [ebp - 0x58], 3
je 0x40c5fe
jmp 0x40c616
mov eax, dword [ebp - 0x54]
mov byte [eax + 0x49], 0
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x30]
call fcn.0040bae0
mov ecx, eax
call fcn.0040c770
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x34], edx
je 0x40c5c7
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax + 0x54]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 1
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040bae0
mov ecx, eax
call fcn.0040c770
push eax
call fcn.004122ee
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0x40c5c7
mov byte [ebp - 0x4d], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0040a0a0
mov al, byte [ebp - 0x4d]
jmp 0x40c642
mov ecx, dword [ebp - 0x54]
movzx edx, byte [ecx + 0x49]
test edx, edx
jne 0x40c5ea
mov byte [ebp - 0x4e], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0040a0a0
mov al, byte [ebp - 0x4e]
jmp 0x40c642
cmp dword [ebp - 0x34], 0
jne 0x40c5fc
push 0
push 8
lea ecx, [ebp - 0x30]
call fcn.0040b980
jmp 0x40c62e
mov byte [ebp - 0x4f], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0040a0a0
mov al, byte [ebp - 0x4f]
jmp 0x40c642
mov byte [ebp - 0x50], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0040a0a0
mov al, byte [ebp - 0x50]
jmp 0x40c642
jmp 0x40c4f5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x412f3a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42c1cc]
jne 0x412f44
repz ret
jmp fcn.0041ab92
Function at 0x41e72c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42c1cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00416547
and dword [ebp - 0x14], 0
cmp dword [0x430524], 0
mov dword [ebp - 0x18], eax
jne 0x41e7df
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41e887
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41e887
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x430524], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x430528], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x43052c], eax
call edi
push eax
call esi
mov dword [0x430534], eax
test eax, eax
je 0x41e7df
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x430530], eax
mov eax, dword [0x430530]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41e838
cmp dword [0x430534], ecx
je 0x41e838
push eax
call esi
push dword [0x430534]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41e838
test ebx, ebx
je 0x41e838
call edi
test eax, eax
je 0x41e82f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41e82f
test byte [ebp - 8], 1
jne 0x41e838
or dword [ebp + 0x10], 0x200000
jmp 0x41e86b
mov eax, dword [0x430528]
cmp eax, dword [ebp - 0x18]
je 0x41e86b
push eax
call esi
test eax, eax
je 0x41e86b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41e86b
mov eax, dword [0x43052c]
cmp eax, dword [ebp - 0x18]
je 0x41e86b
push eax
call esi
test eax, eax
je 0x41e86b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x430524]
call esi
test eax, eax
je 0x41e887
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41e889
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00412f3a
leave
ret
Function at 0x10002468
Capabilities:
Compress data via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
push 0x1016bc5c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
jne 0x10002491
push str.Load_dll_error__n
call fcn.10002a69
pop ecx
xor eax, eax
jmp 0x10002522
push str.RtlDecompressBuffer
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
test eax, eax
jne 0x100024af
push str.Load_function_error__n
call fcn.10002a69
pop ecx
and dword [ebp - 4], 0
push ebx
push esi
mov ebx, 0x1000
push ebx
jmp 0x100024f2
push ebx
push 0
push esi
call fcn.10138d80
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push esi
push 2
call dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp ebx, ecx
jae 0x1000250c
test esi, esi
je 0x100024ef
push esi
call fcn.10002ac2
pop ecx
mov ecx, dword [ebp - 4]
mov ebx, ecx
push ecx
call fcn.10002ab9
mov esi, eax
pop ecx
test esi, esi
jne 0x100024bd
push str.new_memory_error__n
call fcn.10002a69
pop ecx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
push edi
mov dword [eax], esi
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
pop esi
inc eax
pop ebx
pop edi
leave
ret
Function at 0x1014dc09
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10197068
push 0x10197060
push 0x10194b74
push 0x1f
call fcn.1014da88
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1014dc3d
push dword [ebp + 8]
mov ecx, esi
call dword [0x1016b940]
call esi
jmp 0x1014dc43
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1014dc87
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10197078
push 0x10197070
push 0x10194b98
push 0x21
call fcn.1014da88
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1014dcbe
push dword [ebp + 8]
mov ecx, esi
call dword [0x1016b940]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1014dcc6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10197080
push 0x10197078
push 0x10194bac
push 0x22
call fcn.1014da88
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1014dd00
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1016b940]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x56d923
Capabilities:
Encode data using xor

Disassembly:
call 0x98aecb5a
push edi
call dword [esi]
push ss
out 0xe3, al
xlatb
add byte [eax + 0x37], ah
xor dl, bh
or eax, dword [edi - 0x5b5209bd]
invalid
Function at 0x10005110
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 5
push esi
mov dword [esp + 0x18], 0
call edi
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 8]
push edx
push eax
sub ecx, esi
push 5
sub ecx, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], ecx
call edi
pop edi
pop esi
pop ecx
ret 8

Function at 0x1000b146
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x80
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x18]
mov ecx, edi
call fcn.10012160
mov ecx, edi
call fcn.100121a0
test al, al
je 0x1000b20f
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebx, 0x10
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0xc]
lea edi, [ecx + eax*8]
cmp dword [edi], 0
jne 0x1000b1f4
lea edx, [esp + 0x10]
push str.init.ini
push edx
call fcn.1000b060
mov ecx, dword [eax + 0x18]
add esp, 8
cmp ecx, ebx
jb 0x1000b19c
mov eax, dword [eax + 4]
jmp 0x1000b19f
add eax, 4
mov ecx, dword [esi + 0x1c]
push eax
push 0x1f4
lea eax, [esp + 0x34]
push eax
push str.NULL
push ecx
push str.CVAR
call ebp
cmp dword [esp + 0x28], ebx
jb 0x1000b1cd
mov edx, dword [esp + 0x14]
push edx
call fcn.10016dfd
add esp, 4
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.10018106
mov ecx, dword [edi + 4]
fstp dword [ecx]
add esp, 4
lea edi, [esi + 0x18]
mov ecx, edi
call fcn.100121c0
mov ecx, edi
call fcn.100121a0
test al, al
jne 0x1000b170
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x80
ret

Function at 0x1000b510
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10027206
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea ecx, [esi + 0x18]
mov dword [esp + 0x14], ebx
call fcn.10012d80
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x4c], 0xf
mov dword [esi + 0x48], ebx
mov ecx, esi
mov byte [esi + 0x38], bl
call fcn.10008880
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x10012e70
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 0x100
lea eax, [esp + 0x10c]
push eax
push ecx
lea edx, [esp + 8]
push edx
call fcn.100183be
add esp, 0xc
xor eax, eax
xor edx, edx
mov cl, byte [esp + edx]
test cl, cl
je 0x10013105
cmp cl, 0x61
je 0x100130f5
cmp cl, 0x41
je 0x100130f5
cmp cl, 0x62
je 0x100130f5
cmp cl, 0x42
je 0x100130f5
cmp cl, 0x38
je 0x100130f5
cmp cl, 0x63
je 0x100130f5
cmp cl, 0x43
je 0x100130f5
cmp cl, 0x64
je 0x100130f5
cmp cl, 0x44
je 0x100130f5
cmp cl, 0x65
je 0x100130f5
cmp cl, 0x45
je 0x100130f5
cmp cl, 0x66
je 0x100130f5
cmp cl, 0x46
je 0x100130f5
cmp cl, 0x67
je 0x100130f5
cmp cl, 0x47
je 0x100130f5
cmp cl, 0x68
je 0x100130f5
cmp cl, 0x48
je 0x100130f5
cmp cl, 0x6a
je 0x100130f5
cmp cl, 0x4a
je 0x100130f5
cmp cl, 0x6b
je 0x100130f5
cmp cl, 0x4b
je 0x100130f5
cmp cl, 0x6c
je 0x100130f5
cmp cl, 0x4c
je 0x100130f5
cmp cl, 0x6e
je 0x100130f5
cmp cl, 0x4e
je 0x100130f5
cmp cl, 0x6f
je 0x100130f5
cmp cl, 0x4f
je 0x100130f5
cmp cl, 0x30
je 0x100130f5
cmp cl, 0x70
je 0x100130f5
cmp cl, 0x50
je 0x100130f5
cmp cl, 0x72
je 0x100130f5
cmp cl, 0x52
je 0x100130f5
cmp cl, 0x73
je 0x100130f5
cmp cl, 0x53
je 0x100130f5
cmp cl, 0x35
je 0x100130f5
cmp cl, 0x75
je 0x100130f5
cmp cl, 0x55
je 0x100130f5
cmp cl, 0x76
je 0x100130f5
cmp cl, 0x56
je 0x100130f5
cmp cl, 0x78
je 0x100130f5
cmp cl, 0x58
je 0x100130f5
cmp cl, 0x79
je 0x100130f5
cmp cl, 0x59
je 0x100130f5
cmp cl, 0x7a
je 0x100130f5
cmp cl, 0x5a
je 0x100130f5
cmp cl, 0x32
je 0x100130f5
cmp cl, 0x33
je 0x100130f5
cmp cl, 0x34
je 0x100130f5
cmp cl, 0x36
je 0x100130f5
cmp cl, 0x37
je 0x100130f5
cmp cl, 0x39
je 0x100130f5
cmp cl, 0x2d
je 0x100130f5
cmp cl, 0x5f
je 0x100130f5
cmp cl, 0x6d
je 0x100130f0
cmp cl, 0x4d
je 0x100130f0
cmp cl, 0x71
je 0x100130f0
cmp cl, 0x51
je 0x100130f0
cmp cl, 0x77
je 0x100130f0
cmp cl, 0x57
je 0x100130f0
cmp cl, 0x2b
je 0x100130f0
cmp cl, 0x69
je 0x100130eb
cmp cl, 0x49
je 0x100130eb
cmp cl, 0x31
je 0x100130eb
cmp cl, 0x74
je 0x100130eb
cmp cl, 0x54
je 0x100130eb
cmp cl, 0x2e
je 0x100130eb
cmp cl, 0x2c
je 0x100130eb
cmp cl, 0x3a
je 0x100130eb
cmp cl, 0x21
je 0x100130eb
cmp cl, 0x2f
je 0x100130eb
cmp cl, 0x28
je 0x100130eb
cmp cl, 0x29
je 0x100130eb
cmp cl, 0x5b
je 0x100130eb
cmp cl, 0x5d
je 0x100130eb
cmp cl, 0x20
jne 0x100130f8
add eax, 4
jmp 0x100130f8
add eax, 5
jmp 0x100130f8
add eax, 7
jmp 0x100130f8
add eax, 6
inc edx
cmp edx, 0x100
jb 0x10012e94
add esp, 0x100
ret
Function at 0x10018415
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x10018505
mov eax, 0x94
call fcn.1001f290
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1001857a
mov ecx, dword [esi + 0x10]
mov dword [0x100588ac], ecx
mov eax, dword [esi + 4]
mov dword [0x100588b8], eax
mov edx, dword [esi + 8]
mov dword [0x100588bc], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x100588b0], esi
je 0x10018480
or esi, 0x8000
mov dword [0x100588b0], esi
shl eax, 8
add eax, edx
push 1
mov dword [0x100588b4], eax
call fcn.1001be0d
test eax, eax
pop ecx
je 0x1001857a
call fcn.1001a9e2
test eax, eax
jne 0x100184ad
call fcn.1001be5e
jmp 0x1001857a
call fcn.1001f200
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x1005a0f8], eax
call fcn.1001f0de
mov dword [0x10058730], eax
call fcn.1001ebbf
test eax, eax
jl 0x100184fe
call fcn.1001f03c
test eax, eax
jl 0x100184f9
call fcn.1001ee09
test eax, eax
jl 0x100184f9
push 0
call fcn.1001b28f
test eax, eax
pop ecx
jne 0x100184f9
inc dword [0x1005872c]
jmp 0x1001858b
call fcn.1001edbd
call fcn.1001a7cb
jmp 0x100184a3
test eax, eax
jne 0x10018535
cmp dword [0x1005872c], eax
jle 0x1001857a
dec dword [0x1005872c]
cmp dword [0x100588e8], eax
jne 0x10018524
call fcn.1001b3cd
call fcn.1001edbd
call fcn.1001a7cb
call fcn.1001be5e
jmp 0x1001858b
cmp eax, 2
jne 0x1001857e
push 0x8c
push 1
call fcn.1001eb04
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x1001857a
push esi
push dword [0x10030268]
call dword [0x1005874c]
test eax, eax
push esi
je 0x10018574
call fcn.1001a7e8
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x1001858b
call fcn.10017899
pop ecx
xor eax, eax
jmp 0x1001858e
cmp eax, 3
jne 0x1001858b
push 0
call fcn.1001a9b3
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc

Function at 0x1001b2f9
Capabilities:
Terminate process

Disassembly:
push 8
push 0x100292f0
call fcn.1001aea0
push 8
call fcn.1001ae6e
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x100588ec], esi
jne 0x1001b32d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x100588e8], esi
mov al, byte [ebp + 0x10]
mov byte [0x100588e4], al
cmp dword [ebp + 0xc], edi
jne 0x1001b377
cmp dword [0x1005a0f0], edi
je 0x1001b367
mov eax, dword [0x1005a0ec]
sub eax, 4
mov dword [0x1005a0ec], eax
cmp eax, dword [0x1005a0f0]
jb 0x1001b367
mov eax, dword [eax]
cmp eax, edi
je 0x1001b348
call eax
jmp 0x1001b348
push 0x1002f05c
mov eax, 0x1002f054
call fcn.1001b277
pop ecx
push 0x1002f068
mov eax, 0x1002f060
call fcn.1001b277
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x1001b3a8
cmp dword [ebp + 0x10], edi
jne 0x1001b3b6
mov dword [0x100588ec], esi
push dword [ebp + 8]
call fcn.1001b235
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x1001b3b5
push 8
call fcn.1001adb9
pop ecx
ret
call fcn.1001aedb
ret
Function at 0x1001cb8c
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x10030264]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x1001cbbd
xor eax, eax
jmp 0x1001cd46
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x10058fa0]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x1001cbf9
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.10020860
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x1001ccd4
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x1001cd12
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x1001cc5d
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x1001cc4e
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x1001cc2e
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1001cc9d
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x1001cca6
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x1001cc1f
jmp 0x1001cca8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x1001cd41
cmp dword [ebp - 0x6c], edi
je 0x1001cd12
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x1001cd07
call fcn.1001d509
mov dword [eax], 9
call fcn.1001d512
mov dword [eax], esi
jmp 0x1001cd3c
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1001ccfc
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x1001cca8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x1001cca8
push dword [ebp - 0x6c]
call fcn.1001d51b
pop ecx
jmp 0x1001cd3c
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x1001cd2a
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x1001cd2a
xor eax, eax
jmp 0x1001cd44
call fcn.1001d509
mov dword [eax], 0x1c
call fcn.1001d512
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x1001cd44
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.1001fb68
add ebp, 0x3a0
leave
ret
Function at 0x1001f44c
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x10030264]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x10030a28]
je 0x1001f481
inc eax
cmp eax, 0x13
jb 0x1001f472
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x10030a28]
jne 0x1001f5a7
mov eax, dword [0x10058738]
cmp eax, 1
je 0x1001f57f
cmp eax, edx
jne 0x1001f4b1
cmp dword [0x1005873c], 1
je 0x1001f57f
cmp ecx, 0xfc
je 0x1001f5a7
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1001f4e7
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.1001ab90
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.1001ac90
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1001f51b
mov eax, edi
push eax
call fcn.1001ac90
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x10029a20
push edi
call fcn.10017770
add esp, 0x10
push edi
call fcn.1001ac90
push dword [esi + 0x10030a2c]
mov ebx, eax
call fcn.1001ac90
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.1001f290
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.1001ab90
push edi
push ebx
call fcn.1001aba0
push 0x10029a00
push ebx
call fcn.1001aba0
push dword [esi + 0x10030a2c]
push ebx
call fcn.1001aba0
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.10022f74
add esp, 0x2c
jmp 0x1001f5a7
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x10030a2c]
push dword [esi]
call fcn.1001ac90
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.1001fb68
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x10020d1b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x10020eef
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x10058fa0]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x10020eef
test cl, 0x48
je 0x10020d86
cmp byte [eax + 5], 0xa
je 0x10020d86
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10020dd8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x10020dc0
call fcn.1001d509
mov dword [eax], 9
call fcn.1001d512
mov dword [eax], esi
jmp 0x10020dd0
cmp eax, 0x6d
je 0x10020eef
push eax
call fcn.1001d51b
pop ecx
or eax, 0xffffffff
jmp 0x10020ef1
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x10020eea
test eax, eax
je 0x10020dff
cmp byte [ebx], 0xa
jne 0x10020dff
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x10020e08
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x10020ee4
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x10020ed4
cmp al, 0xd
je 0x10020e3a
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x10020ec6
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x10020e54
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x10020e4f
add dword [ebp + 0x10], 2
jmp 0x10020ea8
mov dword [ebp + 0x10], eax
jmp 0x10020ec2
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10020e7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10020ec2
cmp dword [ebp - 0xc], 0
je 0x10020ec2
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x10020e9d
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x10020ea8
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x10020ec5
cmp ebx, dword [ebp + 0xc]
jne 0x10020ead
cmp byte [ebp - 1], 0xa
jne 0x10020ead
mov byte [ebx], 0xa
jmp 0x10020ec5
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1001d58e
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x10020ec6
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x10020e1e
jmp 0x10020ee4
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x10020ee4
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x10020ef1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret