joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001d66d
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x1010
call fcn.1001f380
mov eax, dword [0x1006b1fc]
xor eax, esp
mov dword [esp + 0x100c], eax
push ebx
mov ebx, dword [esp + 0x1018]
lea eax, [esp + 0x10]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1028]
mov ebp, 0x800
xor esi, esi
mov dword [esp + 0x18], 1
push ebp
push esi
push eax
mov dword [esp + 0x1c], esi
call fcn.10022670
push ebp
lea eax, [esp + 0x82c]
push esi
push eax
call fcn.10022670
push ebx
call fcn.1002f4fb
add esp, 0x1c
test eax, eax
je 0x1001d706
push eax
push dword [esp + 0x1030]
push edi
call fcn.10024438
add esp, 0xc
test eax, eax
je 0x1001d87d
xor eax, eax
mov ecx, dword [esp + 0x101c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001f12f
add esp, 0x1010
ret
lea eax, [esp + 0x10]
push eax
push 0x20019
push esi
push dword [0x1006b1ec]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001d6eb
lea eax, [esp + 0x102c]
push eax
push edi
lea eax, [esp + 0x20]
push eax
push esi
push ebx
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1001d861
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x800
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
push esi
push 0x1005a838
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1001d781
xor esi, esi
inc esi
jmp 0x1001d861
push dword [esp + 0x10]
call ebp
lea eax, [esp + 0x10]
push eax
push 0x20019
push esi
push str.SOFTWAREOracleJavaDeploy
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001d779
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x800
push eax
lea eax, [esp + 0x820]
push eax
lea eax, [esp + 0x20]
push eax
push esi
push str.deployment.modified.timestamp
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001d779
lea eax, [esp + 0x1c]
mov dword [esp + 0x14], 0x800
push eax
lea eax, [esp + 0x820]
push eax
call fcn.100282dc
pop ecx
pop ecx
test eax, eax
js 0x1001d87d
lea eax, [esp + 0x14]
push eax
push edi
lea eax, [esp + 0x20]
push eax
push esi
push ebx
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001d779
push dword [esp + 0x10]
call ebp
call fcn.1001c9bd
test eax, eax
jne 0x1001d87d
lea eax, [esp + 0x10]
push eax
push 0x20006
push esi
push dword [0x1006b1ec]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001d6eb
push dword [esp + 0x14]
push edi
push 1
push esi
push ebx
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1001d86e
push dword [esp + 0x10]
call ebp
mov eax, esi
jmp 0x1001d6ed
push dword [esp + 0x10]
call ebp
push edi
push ebx
call fcn.1001d605
pop ecx
pop ecx
xor eax, eax
inc eax
jmp 0x1001d6ed
Function at 0x1001d885
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 8]
xor edi, edi
xor esi, esi
inc edi
mov dword [ebp - 4], esi
mov dword [ebp - 8], edi
call fcn.1002f4fb
pop ecx
test eax, eax
je 0x1001d8bb
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.10024438
add esp, 0xc
test eax, eax
jne 0x1001d8da
mov eax, edi
jmp 0x1001d906
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push dword [0x1006b1f0]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1001d8de
xor eax, eax
jmp 0x1001d906
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
test eax, eax
cmove esi, edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x1001e53e
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x824
mov eax, dword [0x1006b1fc]
xor eax, esp
mov dword [esp + 0x820], eax
push ebx
push ebp
mov ebp, dword [esp + 0x830]
lea eax, [esp + 0x428]
push esi
mov esi, dword [esp + 0x838]
xor ebx, ebx
push edi
mov edi, 0x400
push edi
push ebx
push eax
call fcn.10022670
push esi
push ebx
push ebp
push 0xffffffffffffffff
lea eax, [esp + 0x44c]
push edi
push eax
call fcn.1000ec7e
movzx ecx, byte [esp + 0x853]
lea edi, [esp + 0x34]
xor edx, edx
test eax, eax
push 8
cmovs ecx, edx
xor eax, eax
mov byte [esp + 0x857], cl
pop ecx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
push 0x20
push eax
call fcn.1001e4c0
push 0x1005bf70
lea eax, [esp + 0x40]
push 0x20
push eax
call fcn.10024492
push 0x400
lea eax, [esp + 0x6c]
push ebx
push eax
call fcn.10022670
mov ecx, ebp
add esp, 0x44
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001e5e3
sub ecx, edx
cmp ecx, 6
jbe 0x1001e60a
lea eax, [ebp - 6]
add eax, ecx
push str.__08x_
push eax
call fcn.100282dc
pop ecx
pop ecx
test eax, eax
jne 0x1001e60a
xor ebx, ebx
inc ebx
lea esi, [esp + 0x10]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1001e611
sub esi, ecx
lea eax, [esp + 0x430]
push eax
mov ecx, 0x1005bede
test ebx, ebx
mov eax, str.Error:
cmove eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.P:_04d_T:_04d__s_s
mov eax, 0x3ff
sub eax, esi
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x4c]
add eax, esi
push eax
call fcn.1000ec5f
mov ecx, dword [esp + 0x44b]
test eax, eax
push esi
lea eax, [esp + 0x34]
mov edx, 0x2e2e2e
push eax
lea eax, [esp + 0x58]
cmovs ecx, edx
push eax
mov dword [esp + 0x457], ecx
call fcn.100220f0
lea edi, [esp + 0x5c]
add esp, 0x2c
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1001e68b
mov ax, word [0x1005bf9c]
mov word [edi], ax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x830]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001f12f
add esp, 0x824
ret
Function at 0x10035bd5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10035a4b

Function at 0x10037fef
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10037b42

Function at 0x10041ea0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10041ecd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10041ecd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40492a
Capabilities:
Get session user name

Disassembly:
push ebx
push edi
push esi
sub esp, 0x220
mov eax, esp
mov esi, ecx
lea ebx, [esp + 0x20]
mov dword [eax], 0x100
push eax
push ebx
push 2
call sub.Secur32.dll_GetUserNameExW
test al, 1
je 0x40499c
lea edi, [esp + 4]
mov edx, esi
mov ecx, edi
push dword [esp]
push ebx
push 0x100
call fcn.00404a86
add esp, 0xc
mov eax, dword [edi]
lea ecx, [esp + 0xc]
mov dword [ecx], esi
mov dword [ecx + 4], eax
and dword [ecx + 8], 0
mov dword [ecx + 0xc], 1
mov byte [ecx + 0x10], 0x5c
call fcn.00410d33
mov ecx, eax
mov eax, edx
test ecx, ecx
push 6
pop edx
cmovne edx, eax
mov eax, str.unknow
cmovne eax, ecx
jmp 0x4049a4
push 6
pop edx
mov eax, str.unknow
add esp, 0x220
pop esi
pop edi
pop ebx
ret

Function at 0x4049ae
Capabilities:
Get session user name

Disassembly:
push ebx
push edi
push esi
sub esp, 0x224
mov eax, esp
mov esi, ecx
lea ebx, [esp + 0x22]
mov dword [eax], 0x100
push eax
push ebx
push 2
call sub.Secur32.dll_GetUserNameExW
test al, 1
je 0x404a29
lea edi, [esp + 4]
mov edx, esi
mov ecx, edi
push dword [esp]
push ebx
push 0x100
call fcn.00404a86
add esp, 0xc
mov eax, dword [edi]
lea edi, [esp + 0xc]
mov dword [edi], esi
mov ecx, edi
mov dword [edi + 4], eax
and dword [edi + 8], 0
mov dword [edi + 0xc], 1
mov byte [edi + 0x10], 0x5c
call fcn.00410d33
mov ecx, edi
call fcn.00410d33
mov ecx, eax
mov eax, edx
test ecx, ecx
push 6
pop edx
cmovne edx, eax
mov eax, str.unknow
cmovne eax, ecx
jmp 0x404a31
push 6
pop edx
mov eax, str.unknow
add esp, 0x224
pop esi
pop edi
pop ebx
ret

Function at 0x404ba0
Capabilities:
Initialize winsock library

Disassembly:
push esi
sub esp, 0x190
push 0x4310c0
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov eax, esp
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x404be4
cmp ax, 0x2734
je 0x404bde
movzx eax, ax
cmp eax, 0x2753
je 0x404be8
cmp eax, 0x276b
je 0x404bee
cmp eax, 0x276c
mov si, 0xe
jmp 0x404bf2
xor esi, esi
jmp 0x404bf2
mov si, 0x12
jmp 0x404bf2
mov si, 0x15
push 0x4310c0
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
mov eax, esi
add esp, 0x190
pop esi
ret
Function at 0x409192
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x88
mov edi, ecx
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push 0x12
push 0x68
push eax
push ecx
push edx
call sub.ntdll.dll_NtQueryInformationFile
test eax, eax
je 0x4091d1
cmp eax, 0xc0000022
je 0x4092f4
cmp eax, 0x80000005
jne 0x409300
and word [edi + 0x48], 0
xor eax, eax
cmp byte [esp + 0x55], 0
movsd xmm0, qword [esp + 0x58]
movsd xmm1, qword [esp + 0x48]
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
sete al
movsd qword [edi], xmm0
movsd qword [edi + 8], xmm1
lea eax, [eax + eax*2 + 2]
and al, 0xf
mov byte [edi + 0x40], al
mov eax, 0x2ac18000
add ecx, eax
mov eax, 0xfe624e21
adc esi, eax
mov eax, esi
sar eax, 0x1f
push 0x64
pop edx
imul edx
mov dword [esp + 8], eax
mov ebx, edx
mov eax, ecx
push 0x64
pop ecx
mul ecx
mov dword [esp + 4], eax
mov eax, esi
mov dword [esp + 0xc], edx
mov esi, dword [esp + 0x2c]
mul ecx
mov ecx, dword [esp + 4]
add eax, dword [esp + 0xc]
mov dword [edi + 0x10], ecx
mov ecx, dword [esp + 0x28]
adc edx, dword [esp + 8]
mov dword [edi + 0x14], eax
mov eax, 0x2ac18000
adc ebx, 0
add ecx, eax
mov eax, 0xfe624e21
mov dword [edi + 0x18], edx
adc esi, eax
mov dword [edi + 0x1c], ebx
mov eax, esi
sar eax, 0x1f
push 0x64
pop edx
imul edx
mov dword [esp + 8], eax
mov ebx, edx
mov eax, ecx
push 0x64
pop ecx
mul ecx
mov dword [esp + 4], eax
mov ecx, edx
mov eax, esi
push 0x64
pop edx
mul edx
mov esi, 0x2ac18000
add eax, ecx
mov ecx, dword [esp + 4]
adc edx, dword [esp + 8]
mov dword [edi + 0x24], eax
mov eax, 0xfe624e21
mov dword [edi + 0x20], ecx
adc ebx, 0
add esi, dword [esp + 0x18]
mov dword [edi + 0x28], edx
mov dword [edi + 0x2c], ebx
adc eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
sar eax, 0x1f
push 0x64
pop ecx
imul ecx
mov dword [esp + 8], eax
mov eax, esi
mov ebx, edx
mul ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 0xc]
mov esi, edx
mul ecx
mov ecx, dword [esp + 4]
add eax, esi
adc edx, dword [esp + 8]
mov dword [edi + 0x34], eax
mov dword [edi + 0x30], ecx
adc ebx, 0
mov dword [edi + 0x38], edx
mov dword [edi + 0x3c], ebx
jmp 0x409306
push 0x14
pop ecx
mov esi, 0x42b670
rep movsd dword es:[edi], dword [esi]
jmp 0x409306
mov word [edi + 0x48], 0xe
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40a403
Capabilities:
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [esp], ecx
mov ebx, dword [edx + 4]
mov ecx, dword [edx + 8]
lea eax, [edx + 0x10]
mov dword [esp + 4], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov eax, dword [esp + 8]
mov edi, dword [esp + 4]
mov esi, ebx
cmp ebx, eax
jb 0x40a47d
movzx eax, byte [edi + 0x410]
push eax
push 0
push 0
push 3
push 0x400
push dword [esp + 0x20]
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 0
push dword [edi]
call sub.ntdll.dll_NtQueryDirectoryFile
mov byte [edi + 0x410], 0
mov esi, eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40a540
and dword [edi + 4], 0
test esi, esi
mov dword [edi + 8], eax
jne 0x40a529
lea ebp, [edi + esi + 0x6e]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x5e]
mov ecx, ebp
lea ebx, [eax + esi]
test eax, eax
mov eax, 0x400
cmove ebx, eax
mov dword [edi + 4], ebx
mov edi, dword [ebp - 0x22]
shr edi, 1
mov edx, edi
push 1
push 0x42bb72
call fcn.00409adc
pop ecx
pop edx
test al, 1
jne 0x40a422
mov ecx, ebp
mov edx, edi
push 2
push 0x42bb74
call fcn.00409adc
pop ecx
pop edx
test al, 1
jne 0x40a422
mov ebx, dword [esp + 4]
lea ecx, [esp + 0x18]
lea esi, [ebx + esi + 0x10]
add ebx, 0x411
mov edx, ebx
push edi
push ebp
push 0x2fd
call fcn.00404a86
add esp, 0xc
mov ecx, dword [esi + 0x38]
lea eax, [esp + 0x18]
mov eax, dword [eax]
bt ecx, 0xa
setae dl
or dl, 4
test cl, 0x10
movzx edx, dl
push 2
pop ecx
mov esi, dword [esp]
cmove ecx, edx
and word [esi + 0x10], 0
mov byte [esi + 0xc], 1
mov dword [esi], ebx
mov dword [esi + 4], eax
mov byte [esi + 8], cl
jmp 0x40a561
cmp esi, 0xc0000022
jne 0x40a558
push 5
pop ecx
mov edi, dword [esp]
mov esi, 0x42bae8
rep movsd dword es:[edi], dword [esi]
jmp 0x40a561
mov eax, dword [esp]
and dword [eax + 4], 0
and dword [eax], 0
and dword [eax + 0xc], 0
and dword [eax + 8], 0
and dword [eax + 0x10], 0
jmp 0x40a561
mov eax, dword [esp]
mov word [eax + 0x10], 0xe
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40aad1
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebx, dword [esp + 0x38]
mov esi, dword [esp + 0x30]
mov edi, edx
lea ebp, [esp + 4]
mov dword [esp], ecx
cmp byte [ebx + 8], 0
je 0x40ab11
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
and dword [esp + 8], 0
and dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
and dword [esp + 0x18], 0
lea eax, [esp + 8]
jmp 0x40ab13
xor eax, eax
push eax
push ebp
push dword [esp + 0x3c]
push esi
push edi
call sub.KERNEL32.dll_ReadFile
test eax, eax
jne 0x40ab4d
call sub.KERNEL32.dll_GetLastError
cmp ax, 0x3e3
je 0x40aae9
movzx eax, ax
cmp eax, 0x26
je 0x40ab41
cmp eax, 0x40
je 0x40ab5d
cmp eax, 0x6d
jne 0x40ab6c
mov eax, dword [esp]
and dword [eax + 4], 0
and dword [eax], 0
jmp 0x40ab75
mov eax, dword [esp + 4]
mov ecx, dword [esp]
mov dword [ecx], eax
and word [ecx + 4], 0
jmp 0x40ab75
mov eax, dword [esp]
and dword [eax], 0
mov dword [eax + 4], 0x24
jmp 0x40ab75
mov eax, dword [esp]
mov word [eax + 4], 0xe
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40ab7d
Capabilities:
Write file on windows

Disassembly:
push esi
push eax
mov esi, ecx
mov eax, esp
push 0
push eax
push dword [esp + 0x18]
push dword [esp + 0x18]
push edx
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x40aba7
mov eax, dword [esp]
mov dword [esi], eax
and word [esi + 4], 0
add esp, 4
pop esi
ret
call sub.KERNEL32.dll_GetLastError
cmp ax, 6
je 0x40abe5
movzx eax, ax
cmp eax, 8
je 0x40abd9
cmp eax, 0x21
je 0x40abf1
cmp eax, 0x6d
je 0x40abfd
cmp eax, 0x3e3
je 0x40ac09
cmp eax, 0x6f8
je 0x40abd9
cmp eax, 0x718
jne 0x40ac15
and dword [esi], 0
mov dword [esi + 4], 0x15
jmp 0x40aba2
and dword [esi], 0
mov dword [esi + 4], 0x5a
jmp 0x40aba2
and dword [esi], 0
mov dword [esi + 4], 0x5b
jmp 0x40aba2
and dword [esi], 0
mov dword [esi + 4], 0x20
jmp 0x40aba2
and dword [esi], 0
mov dword [esi + 4], 0x1f
jmp 0x40aba2
mov word [esi + 4], 0xe
jmp 0x40aba2

Function at 0x40ac9f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov al, byte [esp + 0x30]
mov ebp, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov edi, edx
mov dword [esp], ecx
and al, 0xf
cmp al, 2
sete bl
mov eax, dword [edi]
test bl, 1
je 0x40acef
mov dword [esp + 4], eax
lea ecx, [esp + 0xc]
lea edx, [esp + 4]
push 0x42bb70
push ebp
push esi
call fcn.00409b43
add esp, 0xc
movzx eax, word [esp + 0x10]
movzx ecx, ax
jmp dword [ecx*4 + 0x42f1e8]
mov dword [esp + 8], eax
lea ecx, [esp + 8]
mov edx, esi
push ebp
call fcn.0040adaa
pop ecx
cmp ax, 0x1c
ja case.0x40ad09.9
movzx ecx, ax
jmp dword [ecx*4 + 0x42f174]
xor bl, 1
jmp 0x40acbe
mov ecx, dword [esp]
mov word [ecx + 8], ax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp]
and dword [eax + 4], 0
and dword [eax], 0
and dword [eax + 8], 0
jmp 0x40ad1c

Function at 0x40b7ef
Capabilities:
Create pipe
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1f4
mov al, byte [ecx + 0x84]
mov ebp, ecx
lea edi, [ecx + 0x84]
cmp al, 1
je case.default.0x40b87c
cmp byte [ebp + 0x85], 1
je case.default.0x40b87c
cmp byte [ebp + 0x86], 1
jne 0x40b86f
lea esi, [esp + 0x140]
mov edx, str.DeviceNull
mov ecx, esi
push 0x42bcc8
push 0xc
call fcn.004098ff
pop eax
pop ecx
movzx eax, word [esi + 4]
test ax, ax
jne 0x40bead
mov ebx, dword [esp + 0x140]
mov ecx, ebx
call fcn.0040e457
test ax, ax
jne 0x40bea3
mov al, 1
xor ecx, ecx
mov dword [esp + 0x20], eax
movzx eax, byte [edi]
jmp dword [eax*4 + 0x42f254]
movzx eax, al
mov dword [esp + 0x20], 0
xor ecx, ecx
jmp dword [eax*4 + 0x42f254]
Function at 0x40da41
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov ebx, dword [esp + 0x44]
mov ebp, edx
mov dword [esp], ecx
mov dword [esp + 0x1c], edx
mov eax, dword [ebx + 0xc]
mov esi, dword [ebx + 0x14]
mov ecx, eax
sub ecx, esi
cmp ecx, 0x1ff
ja 0x40db83
add esi, 0x200
mov di, 2
jb 0x40dbe3
cmp eax, esi
jae 0x40db83
mov ecx, ebx
call fcn.0040df78
dec esi
push 0x20
pop eax
je 0x40da96
bsr eax, esi
xor eax, 0x1f
test ax, ax
je 0x40dbe3
mov cl, 0x20
mov esi, dword [ebx + 0xc]
mov edx, dword [esp + 0x3c]
sub cl, al
xor ebp, ebp
mov eax, 0
inc ebp
shl ebp, cl
test cl, 0x20
cmovne ebp, eax
mov eax, dword [ebx]
test esi, esi
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
je 0x40daf9
mov edx, dword [ebx + 8]
mov ecx, dword [esp + 4]
mov dword [esp + 0xc], edx
push dword [esp + 8]
push ebp
push 0
mov dword [esp + 0x24], esi
push esi
mov dword [esp + 0x20], eax
call dword [eax + 4]
add esp, 0x10
test al, 1
je 0x40db23
mov eax, dword [esp + 0xc]
jmp 0x40db79
mov edx, dword [esp + 4]
lea ecx, [esp + 0x24]
push dword [esp + 8]
push ebp
push eax
call fcn.0040e00c
add esp, 0xc
movzx edi, word [esp + 0x28]
test di, di
jne 0x40dbe3
mov eax, dword [esp + 0x24]
jmp 0x40db79
mov ecx, dword [esp + 4]
mov edx, ebp
push dword [esp + 8]
push 0
mov eax, dword [esp + 0x18]
call dword [eax]
add esp, 8
test eax, eax
je 0x40dbe3
mov edi, dword [esp + 0x18]
cmp ebp, edi
mov ecx, edi
cmovb ecx, ebp
push ecx
mov esi, dword [esp + 0x10]
push esi
push eax
mov dword [esp + 0x20], eax
call fcn.0040307b
add esp, 0xc
mov ecx, dword [esp + 4]
mov edx, esi
push dword [esp + 8]
push 0
push edi
mov eax, dword [esp + 0x1c]
call dword [eax + 8]
add esp, 0xc
mov eax, dword [esp + 0x14]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], ebp
mov ebp, dword [esp + 0x1c]
mov ecx, ebx
call fcn.0040e046
cmp edx, 0x1ff
ja 0x40dba0
mov ecx, ebx
call fcn.0040df78
mov ecx, ebx
call fcn.0040e046
push dword [esp + 0x40]
lea ecx, [esp + 0x24]
push ecx
push edx
push eax
push ebp
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x40dbc7
mov esi, dword [ebx + 0x14]
mov eax, dword [ebx + 0xc]
add esi, dword [esp + 0x20]
mov dword [ebx + 0x14], esi
jmp 0x40da5b
call sub.KERNEL32.dll_GetLastError
cmp ax, 0x6d
je 0x40dbeb
movzx eax, ax
cmp eax, 0x3e5
jne 0x40dbf7
mov eax, dword [0x42bafc]
jmp 0x40dbf0
mov eax, dword [esp]
mov word [eax], di
jmp 0x40dbff
mov eax, dword [0x42b580]
mov ecx, dword [esp]
mov dword [ecx], eax
jmp 0x40dbff
mov eax, dword [esp]
mov word [eax], 0xe
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40e067
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [0x431094]
mov esi, dword fs:[0x2c]
mov eax, dword [esi + eax*4]
mov eax, dword [eax + 0x210]
test eax, eax
jne 0x40e1e3
mov dword [esp], ecx
mov ecx, dword fs:[0x2c]
mov edi, edx
mov eax, dword [0x431094]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x210], 1
lock inc byte [0x43109c]
push 0x431098
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov ebp, dword [eax + 0x20]
call sub.KERNEL32.dll_GetCurrentThreadId
mov ebx, eax
lea ecx, [esp + 8]
mov edx, str.thread__panic:
mov dword [ecx], ebp
push 7
call fcn.0040e232
pop ecx
test ax, ax
jne 0x40e226
push 0x1f
pop esi
push 0x64
pop ecx
cmp ebx, 0x64
jb 0x40e111
mov eax, ebx
xor edx, edx
div ecx
movzx edx, word [edx + edx + str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899]
mov ebx, eax
mov word [esp + esi + 0xc], dx
add esi, 0xfffffffe
jmp 0x40e0f2
cmp ebx, 9
ja 0x40e120
add bl, 0x30
mov byte [esp + esi + 0xd], bl
inc esi
jmp 0x40e12d
movzx eax, word [ebx + ebx + str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899]
mov word [esp + esi + 0xc], ax
lea ecx, [esp + esi + 0xc]
push 0x21
pop edx
sub edx, esi
push ebp
call fcn.0040e27a
pop ecx
test ax, ax
jne 0x40e226
lea ebx, [esp + 4]
mov edx, 0x42bd21
mov ecx, ebx
mov dword [ebx], ebp
push 8
call fcn.0040e232
pop ecx
mov ecx, dword [esp]
test ax, ax
jne 0x40e226
mov edx, edi
push ebp
call fcn.0040e27a
pop ecx
test ax, ax
jne 0x40e226
lea ecx, [esp + 0xc]
mov edx, 0x42bd2d
mov dword [ecx], ebp
push 1
call fcn.0040e232
pop ecx
test ax, ax
jne 0x40e226
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
lea esi, [esp + 0xc]
mov edx, str.Unable_to_dump_stack_trace:_debug_info_stripped_n
mov ecx, esi
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x20]
mov dword [esi], eax
push 0x30
call fcn.0040e232
pop ecx
push 0x431098
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
lock dec byte [0x43109c]
je 0x40e226
and dword [esp + 4], 0
and dword [esp + 0xc], 0
push 0
push 4
push esi
push ebx
call sub.ntdll.dll_RtlWaitOnAddress
jmp 0x40e1d1
cmp eax, 1
jne 0x40e226
mov eax, dword [0x431094]
mov ecx, dword fs:[0x2c]
mov edx, str.Panicked_during_a_panic._Aborting._n
mov eax, dword [ecx + eax*4]
lea ecx, [esp + 0xc]
mov dword [eax + 0x210], 2
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x20]
mov dword [ecx], eax
push 0x23
call fcn.0040e232
pop ecx
test ax, ax
call 0x40e22b
push 3
call sub.KERNEL32.dll_ExitProcess