joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100abd00
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100c48e8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x100ef07c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x40]
mov edx, dword [eax + 0x14]
lea ecx, [esi + 0x40]
push 0xffffffffffffffff
mov dword [esp + 0x1c], ecx
call edx
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov dword [esi + 0x60], ebx
mov edi, dword [esi + 0x10]
cmp edi, dword [esi + 0x14]
jbe 0x100abd56
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov ecx, dword [esi + 4]
mov dword [esp + 0x1c], ecx
lea ecx, [ecx]
mov eax, dword [esi + 0x14]
mov dword [esp + 0x14], eax
cmp dword [esi + 0x10], eax
jbe 0x100abd76
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esi + 4]
test ecx, ecx
je 0x100abd81
cmp ecx, eax
je 0x100abd8b
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov ecx, dword [esp + 0x1c]
cmp edi, dword [esp + 0x14]
je 0x100abdfd
test ecx, ecx
jne 0x100abdf5
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x100abda8
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov edx, dword [ebp + 0x10]
mov ecx, dword [edi]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push edx
call eax
mov ebx, eax
cmp ebx, 0x2714
je 0x100abdfd
mov ecx, dword [esi + 0x60]
test ecx, ecx
jne 0x100abdfd
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x100abdf9
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x100abde9
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov ecx, dword [esp + 0x1c]
add edi, 4
jmp 0x100abd60
mov eax, dword [ecx]
jmp 0x100abd9d
mov eax, dword [eax]
jmp 0x100abdde
mov dword [esp + 0x30], 0xffffffff
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
call eax
mov eax, ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100bbcd0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x100c930a
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x100ef07c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebx + 4]
mov edx, dword [eax + 0x14]
lea edi, [ebx + 4]
push 0xffffffffffffffff
mov ecx, edi
mov dword [esp + 0x18], edi
call edx
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100bbd27
push esi
call fcn.100bbdc0
test eax, eax
jne 0x100bbd2d
push esi
call fcn.100bbeb0
mov eax, dword [ebx]
test eax, eax
je 0x100bbd43
push 0
call fcn.1008e2e0
add esp, 4
mov dword [ebx], 0
push esi
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
push 0xfde9
lea ecx, [esp + 0x10]
lea esi, [esp + 0x14]
mov byte [esp + 0x24], 1
call fcn.1001c030
push 0
push 6
mov byte [esp + 0x2c], 2
mov eax, dword [eax]
push ebx
push eax
call fcn.1008fd00
add esp, 0x14
lea ecx, [esp + 0x10]
mov esi, eax
call dword [sym.imp.mfc90u.dll_ATL::CStringT_char_class_StrTraitMFC_DLL_char_class_ATL::ChTraitsCRT_char_____::CStringT_char_class_StrTraitMF]
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
xor eax, eax
test esi, esi
sete al
mov dword [esp + 0x20], 0xffffffff
mov edx, dword [edi]
mov ecx, edi
mov esi, eax
mov eax, dword [edx + 0x1c]
call eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
Function at 0x100c09bd
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100ef07c]
jne 0x100c09c7
repz ret
jmp fcn.100c1043
Function at 0x405c59
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c624], 0
push esi
jne 0x405c90
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405c6a
mov dword [ecx*4 + 0x42c620], eax
inc ecx
cmp ecx, 0x100
jl 0x405c65
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405cc1
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c620]
xor eax, esi
inc ecx
dec edx
jne 0x405ca3
pop edi
not eax
pop esi
ret 0xc

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x40110b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x410004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x401158
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x3ff
push 0x400
push eax
call fcn.0040180f
lea eax, [ebp - 0x404]
push eax
call fcn.0040180f
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b66
leave
ret
Function at 0x401485
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8dc
mov eax, dword [0x410004]
xor eax, esp
mov dword [esp + 0x8d8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
mov dword [esp + 0x1c], eax
call dword [sym.imp.kernel32.dll_CreateJobObjectA]
mov ebx, eax
lea eax, [esp + 0x10]
push eax
push 0x70
lea eax, [esp + 0x78]
push eax
push 9
push ebx
call dword [sym.imp.kernel32.dll_QueryInformationJobObject]
test eax, eax
je 0x4014da
cmp dword [esp + 0x10], 0x70
jne 0x4014da
xor eax, eax
inc eax
jmp 0x4014dc
xor eax, eax
push str.Job_information_querying_failed
push eax
call fcn.0040180f
or dword [esp + 0x88], 0x3000
pop ecx
pop ecx
push 0x70
lea eax, [esp + 0x74]
push eax
push 9
push ebx
call dword [sym.imp.kernel32.dll_SetInformationJobObject]
push str.Job_information_setting_failed
push eax
call fcn.0040180f
push 0x44
pop esi
push esi
lea eax, [esp + 0x34]
push edi
push eax
call fcn.004063b0
add esp, 0x14
mov dword [esp + 0x28], esi
mov esi, dword [sym.imp.kernel32.dll_GetStdHandle]
push 0xfffffffffffffff6
call esi
push eax
lea eax, [esp + 0x64]
call fcn.0040180f
mov dword [esp], str.stdin_duplication_failed
push eax
call fcn.0040180f
pop ecx
pop ecx
push 0xfffffffffffffff5
call esi
push eax
lea eax, [esp + 0x68]
call fcn.0040180f
mov dword [esp], str.stdout_duplication_failed
push eax
call fcn.0040180f
pop ecx
pop ecx
push 0xfffffffffffffff4
call esi
push eax
lea eax, [esp + 0x6c]
call fcn.0040180f
mov dword [esp], str.stderr_duplication_failed
push eax
call fcn.0040180f
pop ecx
pop ecx
push 1
push 0x401465
mov dword [esp + 0x5c], 0x100
call dword [sym.imp.kernel32.dll_SetConsoleCtrlHandler]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x2c]
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push dword [esp + 0x34]
push edi
call dword [sym.imp.kernel32.dll_CreateProcessW]
cmp eax, edi
jne 0x4015f4
call dword [sym.imp.kernel32.dll_GetLastError]
push edi
mov ecx, 0x400
push ecx
lea edx, [esp + 0xe8]
push edx
push ecx
push eax
push edi
push 0x1000
call dword [sym.imp.kernel32.dll_FormatMessageW]
lea eax, [esp + 0xe0]
push eax
push dword [esp + 0x18]
push str.Unable_to_create_process_using__ls:__ls
push edi
call fcn.0040180f
add esp, 0x10
push dword [esp + 0x18]
mov eax, dword [esp + 0x24]
push ebx
mov dword [0x412570], eax
call dword [sym.imp.kernel32.dll_AssignProcessToJobObject]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0xffffffffffffffff
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
push str.Failed_to_get_exit_code_of_process
push eax
call fcn.0040180f
pop ecx
pop ecx
push dword [esp + 0x10]
call dword [sym.imp.kernel32.dll_ExitProcess]
Function at 0x40180f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40181e
pop dword [ebp - 0x44]
mov eax, 0x1ef17026
sub eax, 0x1eb15808
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xaaa0af45
sub dword [ebp - 0x54], 0x5c4e69fa
mov dword [ebp - 0x50], 0xccc09e20
sub dword [ebp - 0x50], 0x9a8d51db
mov dword [ebp - 0x4c], 0x3f0e4910
add dword [ebp - 0x4c], 0xd3dfb1e
mov dword [ebp - 0x48], 0xabb01ecc
add dword [ebp - 0x48], 0x544fe134
lea eax, [ebp - 0x54]
push eax
mov eax, 0x72611d3a
add eax, 0x8ddfb312
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x28546e88
sub dword [ebp - 0x54], 0xb3e20532
mov dword [ebp - 0x50], 0xb88739de
sub dword [ebp - 0x50], 0x771ad869
mov dword [ebp - 0x4c], 0xe7577848
sub dword [ebp - 0x4c], 0x83e80bdc
mov dword [ebp - 0x48], 0x32370cc1
add dword [ebp - 0x48], 0xcdc8f33f
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xbe1ade5e
add eax, 0x4225f1ea
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x38051
push 0
call eax
mov ecx, 0xe095172b
add ecx, 0x1f6b2a61
xor edi, edi
add edi, eax
mov esi, 0x41b000
add esi, dword [ebp - 0x44]
mov ebx, 0xc9fc3d9b
sub ebx, 0x3979b0e5
xor dword [ebp - 0x24], esi
mov edx, dword [esi]
add dword [ebp - 0x34], edi
sub edx, ebx
mov dword [edi], edx
add dword [ebp - 0x1c], esi
add edi, 0x5447546c
sub edi, 0x54475468
add esi, 4
loop 0x40193c
add eax, 0xb2415b07
add eax, 0x4dbf9dfc
mov ebx, eax
add eax, 5
mov ecx, 0x19b20484
sub ecx, 0x19720484
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d
Function at 0x40b2d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [edx + 0x28]
nop
movzx ecx, word [edx + 0x26]
xor edi, edi
jmp 0x40b1ab
nop
xor eax, eax
nop
jmp 0x40b1c0
lodsb al, byte [esi]
jmp 0x40b1cf
cmp al, 0x61
jmp 0x40b1db
jl 0x40b1ee
nop
nop
jmp 0x40b1ec
sub al, 0x20
jmp 0x40b1fe
ror edi, 0xd
add edi, eax
dec ecx
jne 0x40b1ab
nop
jmp 0x40b216
nop
push edx
nop
push edi
nop
jmp 0x40b229
mov edx, dword [edx + 0x10]
nop
mov eax, dword [edx + 0x3c]
nop
jmp 0x40b23c
add eax, edx
nop
jmp 0x40b24f
mov eax, dword [eax + 0x78]
jmp 0x40b263
test eax, eax
jmp 0x40b271
je 0x40b404
nop
nop
jmp 0x40b284
add eax, edx
nop
mov ecx, dword [eax + 0x18]
nop
push eax
mov ebx, dword [eax + 0x20]
nop
add ebx, edx
nop
jmp 0x40b29d
test ecx, ecx
je 0x40b3f5
xor edi, edi
nop
dec ecx
nop
mov esi, dword [ebx + ecx*4]
nop
jmp 0x40b2bc
add esi, edx
nop
nop
xor eax, eax
nop
jmp fcn.0040b2d0
lodsb al, byte [esi]
nop
jmp 0x40b2e3
ror edi, 0xd
add edi, eax
nop
jmp 0x40b2f7
cmp al, ah
nop
jmp 0x40b307
jne 0x40b2bf
add edi, dword [ebp - 8]
nop
jmp 0x40b320
cmp edi, dword [ebp + 0x24]
nop
jne 0x40b292
nop
jmp 0x40b33c
nop
pop eax
nop
jmp 0x40b34a
mov ebx, dword [eax + 0x24]
jmp 0x40b358
add ebx, edx
nop
mov cx, word [ebx + ecx*2]
nop
mov ebx, dword [eax + 0x1c]
nop
jmp 0x40b36f
add ebx, edx
nop
jmp 0x40b382
mov eax, dword [ebx + ecx*4]
nop
jmp 0x40b399
add eax, edx
nop
mov dword [esp + 0x24], eax
nop
jmp 0x40b3b4
pop ebx
nop
jmp 0x40b3c4
pop ebx
nop
jmp 0x40b3da
popal
nop
pop ecx
nop
pop edx
push ecx
nop
jmp 0x40b3f2
jmp eax
nop
pop eax
jmp 0x40b404
nop
jmp 0x40b417
pop edi
pop edx
jmp 0x40b42d
mov edx, dword [edx]
nop
jmp 0x40b443
jmp 0x40b193
Function at 0x4176ee
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00417390

Function at 0x4176f9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041751f

Function at 0x417af3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00408470
mov eax, dword [0x433010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00415e22
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x417b35
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x417c91
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004242b0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x43c3b0]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00418cc3
mov ecx, dword [esi*4 + 0x43c3b0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x417c8a
cmp eax, dword [edi + ecx + 0x24]
jne 0x417c8a
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x417c8a
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00418cc3
add esp, 0x14
test edx, edx
jl 0x417c8a
jg 0x417c00
test eax, eax
jb 0x417c8a
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x417c8a
jl 0x417c1a
cmp dword [ebp - 0x1008], eax
ja 0x417c8a
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x417c38
test ebx, ebx
je 0x417c71
cmp ecx, edi
jae 0x417c71
mov al, byte [ecx]
cmp al, 0xd
jne 0x417c52
lea eax, [edi - 1]
cmp ecx, eax
jae 0x417c5e
cmp byte [ecx + 1], 0xa
jne 0x417c5e
inc ecx
jmp 0x417c5e
movzx eax, al
movsx eax, byte [eax + 0x433298]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x417c38
cmp edx, ebx
jne 0x417c38
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x417c8f
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004078dc
leave
ret
Function at 0x418161
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x43c3b0]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4181a1
cmp byte [ebx], 0xa
jne 0x4181a1
or byte [eax + edi + 0x28], 4
jmp 0x4181a6
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x4182a4
mov al, byte [edx]
cmp al, 0x1a
je 0x418286
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x4181d5
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4181fa
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x418204
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x4181b7
jmp 0x4182a4
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x418281
cmp dword [ebp - 0xc], 0
je 0x418281
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x43c3b0]
test byte [eax + edi + 0x28], 0x48
je 0x41825b
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x418246
mov byte [esi], dl
jmp 0x418257
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x43c3b0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4182a4
cmp byte [ebp - 1], 0xa
jne 0x41826a
cmp esi, ebx
jne 0x41826a
mov byte [esi], 0xa
jmp 0x4182a3
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00418ce1
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4182a4
mov byte [esi], 0xd
jmp 0x4182a3
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x43c3b0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4182a0
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4182a4
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4182ad
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x43c3b0]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4182f0
cmp word [esi], dx
jne 0x4182f0
or byte [edi + eax + 0x28], 4
jmp 0x4182f5
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x418448
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x418428
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x418337
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41836d
cmp eax, edx
jae 0x418379
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x41830f
jmp 0x418448
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x418424
cmp dword [ebp - 0x14], 0
je 0x418424
mov eax, dword [ebx*4 + 0x43c3b0]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4183fc
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x4183c5
mov word [esi], cx
jmp 0x4183f8
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x43c3b0]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x43c3b0]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x43c3b0]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x418448
pop ebx
cmp word [ebp - 4], bx
jne 0x41840d
cmp esi, dword [ebp + 0xc]
jne 0x41840d
mov word [esi], bx
jmp 0x418445
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00418ce1
add esp, 0x10
cmp word [ebp - 4], bx
je 0x418448
push 0xd
jmp 0x418441
mov ecx, dword [ebx*4 + 0x43c3b0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41843f
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x418448
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4066a0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x45fb2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00454b68
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x406722
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00452ab7
mov eax, dword [eax]
push 0x5be1c0
push eax
call fcn.004459b4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00454df3
test bl, bl
je 0x406722
push 0x5be1c0
lea ecx, [esp + 0xc]
call fcn.00455183
push 0x5c1d10
lea ecx, [esp + 0xc]
call fcn.00455183
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40675e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00454df3
jmp 0x406829
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4067e2
lea edx, [esp + 0x7c]
push 0x5c1d0c
push edx
call fcn.004459b4
add esp, 8
test eax, eax
je 0x4067e2
lea eax, [esp + 0x7c]
push 0x5c1d08
push eax
call fcn.004459b4
add esp, 8
test eax, eax
je 0x4067e2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x406772
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00454df3
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x407020
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x407082
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc