joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451630
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x13c]
push edi
test eax, eax
jle 0x45167c
mov eax, dword [ebx + 0x140]
test eax, eax
jle 0x45167c
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
lea edi, [ebx + 0x150]
mov eax, dword [edi]
test eax, eax
je 0x451666
push eax
call ebp
test ax, ax
jl 0x451674
inc esi
add edi, 4
cmp esi, 6
jb 0x451658
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
mov ecx, ebx
call fcn.00451330
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x455220
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x455280
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x455280
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x455280
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x455280
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x455290
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x457130
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x4571d3
test eax, eax
jbe 0x4571d3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x4571d3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x45717e
xor esi, esi
jmp 0x457184
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x4571af
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00459080
add esi, eax
push esi
mov ebx, esi
call fcn.00459080
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x457190
pop ebp
test edi, edi
pop edi
jne 0x4571d3
test ebx, ebx
je 0x4571d3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.0045b500
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x457315
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x45742d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45742d
mov eax, dword [esi + 0x3c]
push eax
call fcn.0046c018
mov esi, eax
test esi, esi
je 0x45742d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x45742d
mov ecx, esi
call fcn.00457280
cmp edi, eax
jge 0x45742d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x4573b3
mov dword [esp + 0x34], 1
jmp 0x45740e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x45742d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00456880
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x46c9bb
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46c9f3
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046aa72
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046aa4a
jmp 0x46c9ff
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x46e0b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46e0f2
call fcn.00473ceb
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46e0f2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x46e0e9
xor eax, eax
jmp 0x46e0fa
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046e100
pop edi
pop esi
pop ebx
ret 4

Function at 0x47421b
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x474249
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x474267
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00474181
jmp 0x474267
mov eax, dword [esi + 0x14]
test eax, eax
je 0x474267
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00474181
test edi, edi
mov eax, edi
jne 0x474251
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401a78
Capabilities:
Move file

Disassembly:
mov eax, 0x4081a4
call fcn.00403e24
sub esp, 0x10
push ebx
push esi
push edi
xor edi, edi
push dword [ebp + 8]
push edi
call fcn.004019e1
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
push ebx
push edi
call fcn.004019e1
add esp, 0x10
cmp eax, 0x989680
mov dword [ebp - 0x14], eax
jg 0x401c79
push ebx
call fcn.004038d0
inc eax
push eax
call fcn.00403a40
mov esi, eax
push ebx
push esi
mov dword [ebp - 0x18], esi
call fcn.00403950
add esp, 0x10
push 0x40ba48
push esi
call fcn.004038d0
pop ecx
lea eax, [eax + esi - 3]
push eax
call fcn.00403950
pop ecx
pop ecx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x401c79
push 0x40
call fcn.00403a40
pop ecx
mov dword [ebp - 0x1c], eax
cmp eax, edi
mov dword [ebp - 4], edi
mov ebx, 0x80
je 0x401b23
push 1
mov ecx, eax
push dword [0x409138]
push ebx
push dword [ebp + 8]
call fcn.0040292a
mov esi, eax
jmp 0x401b25
xor esi, esi
or dword [ebp - 4], 0xffffffff
push 0x3c
call fcn.00403a40
pop ecx
mov dword [ebp - 0x1c], eax
push 1
cmp eax, edi
pop ecx
mov dword [ebp - 4], ecx
je 0x401b52
push ecx
mov ecx, eax
push dword [0x409138]
push ebx
push dword [ebp + 0xc]
call fcn.00402806
mov edi, eax
push dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
call fcn.00401908
test al, al
pop ecx
je 0x401b8e
push 2
push 0xfffffffffffffff8
pop eax
mov ecx, esi
sub eax, dword [0x40ba50]
push eax
call fcn.00402ad6
lea eax, [ebp - 0x10]
push 4
push eax
mov ecx, esi
call fcn.00402a95
push 0
push 0
mov ecx, esi
call fcn.00402ad6
mov eax, dword [ebp - 0x10]
inc eax
push eax
call fcn.00403a40
pop ecx
mov dword [ebp + 8], eax
push dword [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00402a95
push dword [ebp - 0x10]
mov ecx, edi
push dword [ebp + 8]
call fcn.00402a52
push dword [ebp + 8]
call fcn.004038b6
pop ecx
mov ecx, esi
call fcn.004028d0
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.00403a40
pop ecx
mov dword [ebp + 8], eax
push dword [0x409138]
mov ecx, esi
push ebx
push dword [ebp - 0x18]
call fcn.004029f4
push dword [ebp - 0x14]
mov ecx, esi
push dword [ebp + 8]
call fcn.00402a95
push dword [ebp - 0x14]
mov ecx, edi
push dword [ebp + 8]
call fcn.00402a52
mov ecx, esi
call fcn.004028d0
push dword [ebp + 8]
call fcn.004038b6
pop ecx
lea eax, [ebp - 0x10]
push 4
push eax
mov ecx, edi
call fcn.00402a52
lea eax, [ebp - 0x14]
push 4
push eax
mov ecx, edi
call fcn.00402a52
push dword [0x40ba50]
mov ecx, edi
push dword [0x40ba40]
call fcn.00402a52
mov ecx, edi
call fcn.004028d0
test esi, esi
je 0x401c54
mov eax, dword [esi]
push 1
mov eax, dword [eax + 4]
lea ecx, [eax + esi]
mov eax, dword [eax + esi]
call dword [eax]
test edi, edi
je 0x401c67
mov eax, dword [edi]
push 1
mov eax, dword [eax + 4]
lea ecx, [eax + edi]
mov eax, dword [eax + edi]
call dword [eax]
push dword [ebp - 0x18]
call fcn.00401c88
push dword [ebp - 0x18]
call fcn.004038b6
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x401c88
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0x20
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
ret

Function at 0x401c9f
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, 0x1f4
push edi
call fcn.00403a40
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push esi
call fcn.00403950
cmp byte [esi], 0x22
pop ecx
pop ecx
jne 0x401ce5
push esi
call fcn.004038d0
dec eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
call fcn.00401e26
push eax
push esi
call fcn.00403950
add esp, 0x14
xor eax, eax
cmp byte [eax + esi], 0x22
jne 0x401cf1
and byte [eax + esi], 0
inc eax
cmp eax, edi
jl 0x401ce7
push esi
xor edi, edi
call fcn.004038d0
dec eax
pop ecx
dec eax
test eax, eax
jle 0x401d36
mov al, byte [edi + esi]
cmp al, 0x65
je 0x401d10
cmp al, 0x45
jne 0x401d28
mov al, byte [edi + esi + 1]
cmp al, 0x78
je 0x401d1c
cmp al, 0x58
jne 0x401d28
mov al, byte [edi + esi + 2]
cmp al, 0x65
je 0x401d36
cmp al, 0x45
je 0x401d36
push esi
inc edi
call fcn.004038d0
dec eax
pop ecx
dec eax
cmp edi, eax
jl 0x401d05
push esi
call fcn.004038d0
dec eax
pop ecx
dec eax
cmp edi, eax
jl 0x401d5a
push esi
push dword [ebp + 8]
call fcn.00403950
push esi
push dword [ebp + 0xc]
call fcn.00403950
add esp, 0x10
jmp 0x401d7f
lea eax, [ebp - 4]
add edi, 3
push eax
push esi
mov dword [ebp - 4], edi
call fcn.00401e83
push eax
push dword [ebp + 8]
call fcn.00403950
push esi
push dword [ebp + 0xc]
call fcn.00403950
add esp, 0x18
push esi
call fcn.004038b6
pop ecx
pop edi
pop esi
leave
ret
Function at 0x4063f5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40b528
cmp edx, dword [eax]
je 0x406417
add eax, 8
inc ecx
cmp eax, 0x40b5b8
jl 0x406408
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40b528]
jne 0x406545
mov eax, dword [0x40ba78]
cmp eax, 1
je 0x40651f
test eax, eax
jne 0x406448
cmp dword [0x40b1d4], 1
je 0x40651f
cmp edx, 0xfc
je 0x406545
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40647f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00403950
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004038d0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4064c2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004038d0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40957c
push edi
call fcn.004078c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00403950
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00403960
lea eax, [ebp - 0xa0]
push 0x40955c
push eax
call fcn.00403960
push dword [esi + 0x40b52c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00403960
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00407836
add esp, 0x2c
pop edi
jmp 0x406545
lea eax, [ebp + 8]
lea esi, [esi + 0x40b52c]
push 0
push eax
push dword [esi]
call fcn.004038d0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4013cf
Capabilities:
Encode data using xor

Disassembly:
jmp 0x411f5d
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jbe 0x412080
push ebx
push ebp
push edi
mov edi, dword [esp + 0x14]
mov ebx, str.Soviet_aristo_baristo
mov ebp, 0x4f9448
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
sub byte [esi + edi], 0x78
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0xee
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x6a
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
xor byte [esi + edi], 0x98
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x67
push ebx
push ebp
call fcn.00403490
add esp, 0x44
push eax
call fcn.004013b6
xor byte [esi + edi], 0xd8
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x97
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0xf4
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
xor byte [esi + edi], 0xe1
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
xor byte [esi + edi], 0x72
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x3b
add esp, 0x40
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x28
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0xca
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x32
add esp, 0x24
inc esi
cmp esi, dword [esp + 0x18]
jb 0x411f7b
pop edi
pop ebp
pop ebx
pop esi
ret

Function at 0x402946
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x412674
sub esp, 0x20
mov eax, dword [0x4f7024]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebp, ebp
push edi
mov eax, dword [esi + 0x3c]
mov edi, dword [eax + esi + 0x78]
add edi, esi
mov ebx, dword [edi + 0x20]
mov eax, dword [edi + 0x18]
add ebx, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4126f3
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
add eax, esi
push eax
call fcn.00401e2e
push str.Hardline
push 0x4f9530
call fcn.00402d60
push eax
call fcn.00406082
lea eax, [esp + 0x20]
push 0x36c
push eax
call fcn.00402cc5
add esp, 0x14
cmp eax, dword [esp + 0x38]
je 0x41270d
lea ecx, [esp + 0x14]
add ebx, 4
call fcn.00402982
inc ebp
cmp ebp, dword [esp + 0x10]
jb 0x4126a5
xor edi, edi
mov ecx, dword [esp + 0x2c]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00403030
add esp, 0x20
ret 8
mov eax, dword [edi + 0x24]
lea eax, [eax + ebp*2]
movzx ecx, word [eax + esi]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x14]
call fcn.00402982
jmp 0x4126f5
Function at 0x402cc5
Capabilities:
Encode data using xor

Disassembly:
jmp 0x41280c
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
lea ebp, [esi + 0x10]
mov edi, dword [ebp]
mov ebx, edi
xor ebx, dword [esp + 0x1c]
cmp dword [esi + 0x14], 0x10
mov dword [esp + 0x10], ebp
jb 0x412831
mov esi, dword [esi]
mov dword [esp + 0x18], esi
push esi
shr edi, 2
push edi
push str._x_and__p
call fcn.0040221b
add esp, 0xc
test edi, edi
je 0x41288c
mov ebp, esi
mov esi, edi
push 4
lea eax, [esp + 0x20]
push ebp
push eax
call fcn.00405669
imul ecx, dword [esp + 0x28], 0x5bd1e995
add esp, 0xc
imul ebx, ebx, 0x5bd1e995
add ebp, 4
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul eax, eax, 0x5bd1e995
xor ebx, eax
mov dword [esp + 0x1c], eax
sub esi, 1
jne 0x41284b
mov esi, dword [esp + 0x18]
mov ebp, dword [esp + 0x10]
mov eax, dword [ebp]
xor ecx, ecx
and eax, 3
sub eax, 1
je 0x4128b5
sub eax, 1
je 0x4128ab
sub eax, 1
jne 0x4128c3
movsx ecx, byte [esi + edi*4 + 2]
shl ecx, 0x10
movsx eax, byte [esi + edi*4 + 1]
shl eax, 8
xor ecx, eax
movsx eax, byte [esi + edi*4]
xor eax, ecx
imul eax, eax, 0x5bd1e995
xor ebx, eax
mov eax, ebx
shr eax, 0xd
xor eax, ebx
imul ecx, eax, 0x5bd1e995
pop edi
pop esi
pop ebp
pop ebx
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop ecx
ret

Function at 0x4035cb
Capabilities:
Terminate process

Disassembly:
jmp 0x450339
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45034a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405880
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x4036f2
Capabilities:
Query environment variable

Disassembly:
jmp 0x4993a1
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4993b2
pop esi
ret
push ebx
push edi
push esi
call fcn.00499288
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403f71
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4993da
push ebx
push esi
push edi
call fcn.00405669
add esp, 0xc
push 0
call fcn.004061cc
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x405731
Capabilities:
Parse pe header

Disassembly:
jmp 0x43f602
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x43f641
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43f641
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43f641
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x43f641
cmp dword [ecx + 0x74], 0xe
jbe 0x43f641
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x49062c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00401dac
mov eax, dword [0x4f7024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00405dda
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x49066e
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4907ca
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00405f2e
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x4faae8]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00403247
mov ecx, dword [esi*4 + 0x4faae8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x4907c3
cmp eax, dword [edi + ecx + 0x24]
jne 0x4907c3
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4907c3
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00403247
add esp, 0x14
test edx, edx
jl 0x4907c3
jg 0x490739
test eax, eax
jb 0x4907c3
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4907c3
jl 0x490753
cmp dword [ebp - 0x1008], eax
ja 0x4907c3
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x490771
test ebx, ebx
je 0x4907aa
cmp ecx, edi
jae 0x4907aa
mov al, byte [ecx]
cmp al, 0xd
jne 0x49078b
lea eax, [edi - 1]
cmp ecx, eax
jae 0x490797
cmp byte [ecx + 1], 0xa
jne 0x490797
inc ecx
jmp 0x490797
movzx eax, al
movsx eax, byte [eax + 0x4f7340]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x490771
cmp edx, ebx
jne 0x490771
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4907c8
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00403030
leave
ret
Function at 0x490f09
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4faae8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x490f49
cmp byte [ebx], 0xa
jne 0x490f49
or byte [eax + edi + 0x28], 4
jmp 0x490f4e
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x49104c
mov al, byte [edx]
cmp al, 0x1a
je 0x49102e
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x490f7d
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x490fa2
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x490fac
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x490f5f
jmp 0x49104c
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x491029
cmp dword [ebp - 0xc], 0
je 0x491029
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x4faae8]
test byte [eax + edi + 0x28], 0x48
je 0x491003
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x490fee
mov byte [esi], dl
jmp 0x490fff
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4faae8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x49104c
cmp byte [ebp - 1], 0xa
jne 0x491012
cmp esi, ebx
jne 0x491012
mov byte [esi], 0xa
jmp 0x49104b
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00401947
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x49104c
mov byte [esi], 0xd
jmp 0x49104b
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x4faae8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x491048
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x49104c
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret