joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a680c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4a683a
mov eax, ebx
call fcn.004a72c0
cmp dword [ebx + 0x40], 0
je 0x4a6833
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4a68ab
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4a689d
cmp dword [ebx + 8], 0
je 0x4a685c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4a686e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4a689d
cmp dword [ebx + 8], 0
je 0x4a684f
cmp eax, 3
je 0x4a6881
dec eax
jne 0x4a684f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4a684f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4a684f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4a68c9
cmp dword [ebx + 0x14], 0xcc
je 0x4a68c9
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004a68d4
pop ebx
ret
Function at 0x4fba84
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea ebx, [ebp - 4]
mov eax, dword [ebx]
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x4fbaa4
mov eax, dword [ebx]
mov eax, dword [eax + 4]
mov esi, dword [eax + 0x30]
jmp 0x4fbaa6
mov esi, eax
mov eax, dword [ebx]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x4fbab9
mov eax, dword [ebx]
mov eax, dword [eax + 8]
mov edi, dword [eax + 0x30]
jmp 0x4fbabb
mov edi, eax
mov eax, dword [ebx]
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x30]
mov eax, dword [ebx]
add eax, 0x10
call fcn.004fb944
mov eax, dword [ebx]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x30]
mov eax, dword [ebx]
add eax, 0x14
call fcn.004fb944
mov eax, dword [ebx]
add eax, 0x10
mov edx, esi
call fcn.004fba14
mov eax, dword [ebx]
add eax, 0x14
mov edx, edi
call fcn.004fba14
mov eax, dword [ebx]
mov eax, dword [eax + 0x18]
mov dx, word [eax + 4]
mov eax, dword [ebx]
mov eax, dword [eax + 0x10]
call fcn.0053c07c
mov eax, dword [ebx]
mov eax, dword [eax + 0x10]
xor edx, edx
call fcn.0053b79c
mov eax, dword [ebx]
mov eax, dword [eax + 0x18]
mov dx, word [eax + 6]
mov eax, dword [ebx]
mov eax, dword [eax + 0x14]
call fcn.0053c07c
mov eax, dword [ebx]
mov eax, dword [eax + 0x14]
xor edx, edx
call fcn.0053b79c
push ebp
mov eax, dword [ebx]
mov eax, dword [eax + 0x10]
call fcn.004fb90c
pop ecx
push ebp
mov eax, dword [ebx]
mov eax, dword [eax + 0x14]
call fcn.004fb90c
pop ecx
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x38]
cmp dword [eax + 8], 0
jne 0x4fbb92
mov eax, dword [ebx]
mov eax, dword [eax + 0x10]
mov edx, dword [eax + 0x54]
push edx
push 0
mov ecx, dword [eax + 0x50]
mov dl, 1
mov eax, dword [0x53869c]
call fcn.00539828
mov edx, dword [ebx]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x44]
mov dword [eax + 0x44], edx
mov byte [eax + 0x30], 1
mov edx, dword [ebx]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x38]
xchg edx, eax
call fcn.0041bb78
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4fbf84
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov byte [ebp - 5], cl
mov ebx, edx
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00539800
dec bl
je 0x4fbfba
sub bl, 2
je 0x4fbfc7
dec bl
je 0x4fc038
jmp 0x4fc091
mov eax, dword [ebp - 4]
call fcn.004fba84
jmp 0x4fc091
mov al, byte [ebp - 5]
dec al
je 0x4fbfd7
dec al
je 0x4fc009
jmp 0x4fc091
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov dx, word [eax + 4]
mov eax, ebx
call fcn.0053c07c
xor edx, edx
mov eax, ebx
call fcn.0053b79c
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0053cd10
jmp 0x4fc091
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov dx, word [eax + 6]
mov eax, ebx
call fcn.0053c07c
xor edx, edx
mov eax, ebx
call fcn.0053b79c
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0053cd10
jmp 0x4fc091
mov al, byte [ebp - 5]
dec al
je 0x4fc049
dec al
je 0x4fc05c
dec al
je 0x4fc06f
jmp 0x4fc091
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.0053cd10
jmp 0x4fc091
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.0053cd10
jmp 0x4fc091
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.0053cd10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.0053cd10
push ebp
call fcn.004fbe8c
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x523f34
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5240ad
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 4]
add eax, 0x30
mov dl, 3
call fcn.00523bf0
pop ecx
push ebp
mov eax, dword [ebp - 4]
add eax, 0x2c
mov dl, 2
call fcn.00523bf0
pop ecx
push ebp
mov eax, dword [ebp - 4]
add eax, 0x34
mov dl, 1
call fcn.00523bf0
pop ecx
mov dl, 1
mov eax, dword [0x419464]
call fcn.00403440
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 0x18]
call fcn.0041bb78
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2c]
mov eax, dword [ebp - 0x18]
call fcn.0041bb78
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x34]
mov eax, dword [ebp - 0x18]
call fcn.0041bb78
mov eax, dword [0x5487d4]
cmp word [eax + 2], 0
je 0x523fd7
mov ebx, dword [0x5487d4]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebx + 4]
call dword [ebx]
mov eax, dword [0x54a374]
mov ecx, dword [eax + 0x194]
mov eax, dword [0x54a374]
mov edx, dword [eax + 0x190]
mov eax, dword [ebp - 4]
call fcn.00524180
mov byte [ebp - 5], al
lea eax, [ebp - 0x50]
push eax
call fcn.005214d0
pop ecx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ebx, dword [ebp + ecx*8 - 0x50]
mov dword [eax + edx*8], ebx
mov ebx, dword [ebp + ecx*8 - 0x4c]
mov dword [eax + edx*8 + 4], ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x7c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ebx, dword [ebp + ecx*8 - 0x38]
mov dword [eax + edx*8], ebx
mov ebx, dword [ebp + ecx*8 - 0x34]
mov dword [eax + edx*8 + 4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jne 0x524007
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0x7c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 0x78]
mov eax, dword [ebp - 4]
call fcn.00524a84
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
mov dl, byte [ebp - 5]
mov eax, dword [ebp - 4]
call fcn.00524788
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5240b4
lea eax, [ebp - 0x14]
mov edx, dword [0x521418]
mov ecx, 3
call fcn.00405078
ret
Function at 0x597088
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00597004
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x597200
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x597200
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x5971af
jg 0x5970e1
test eax, eax
je 0x5971a5
push 1
push 0x1000
call fcn.0058d059
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x597107
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x59719c
push 0x8000
push ebx
call fcn.00589dd3
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x597133
jg 0x59712e
cmp ecx, 0x1000
jb 0x597133
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0059026f
add esp, 0x10
cmp eax, 0xffffffff
je 0x597178
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x59712e
jl 0x59715f
test ecx, ecx
jne 0x597120
push dword [ebp - 0xc]
push ebx
call fcn.00589dd3
push esi
call fcn.0058a618
add esp, 0xc
xor edi, edi
jmp 0x597211
cmp byte [edi + 0x24], 0
je 0x59718f
cmp dword [edi + 0x20], 5
jne 0x59718f
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x59719a
mov edi, dword [edi + 0x18]
jmp 0x59719c
xor edi, edi
push esi
call fcn.0058a618
pop ecx
jmp 0x597211
test ecx, ecx
jg 0x597171
jl 0x5971af
test eax, eax
jae 0x597171
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0058c4e8
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x5971d2
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x597171
jmp 0x597209
push ebx
call fcn.00589017
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x597171
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x597211
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x59720e
mov edi, dword [edi + 0x18]
jmp 0x597211
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0058c4e8
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x1000b71f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1000b72e
pop dword [ebp - 0x20]
mov eax, 0x286e6440
add eax, 0xe79252ee
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x41162
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x370d2a55
sub ecx, 0x370ce643
xor ebx, ebx
add ebx, eax
mov edx, 0x10185c00
add edx, dword [ebp - 0x20]
mov edi, 0xcca78afd
add edi, 0x65a58cb9
add dword [ebp - 0x14], 0x38906cdb
mov esi, dword [edx]
add dword [ebp - 0x18], esi
add esi, edi
add dword [ebp - 4], 0xc5b517f
mov dword [ebx], esi
xor dword [ebp - 0x10], 0xccd3f693
add ebx, 0xed52c09f
add ebx, 0x12ad3f65
add edx, 0x6e71c027
sub edx, 0x6e71c023
loop 0x1000b784
add eax, 0x1031b
mov ebx, eax
add eax, 0x675f6a05
sub eax, 0x675f6a00
mov ecx, 0x699253a9
add ecx, 0xa66dac57
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x100696fd
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
jne 0x10069780
push ebx
mov ebx, dword [ebp + 0x10]
push edi
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x1006974a
mov byte [esi + 0x2d], 0xff
test edi, edi
je 0x1006974a
cmp edi, ebx
jge 0x1006974a
mov eax, dword [ebp + 0xc]
mov ecx, ebx
sub ecx, edi
push ecx
add eax, edi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 0
je 0x1006977a
add dword [esi + 0x1c], ebx
cmp dword [esi + 0x1c], 0xffff
jle 0x1006977a
xor eax, eax
mov word [esi + 0x1e], ax
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx]
push 1
push dword [esi + 0x20]
push eax
push ecx
call dword [edx + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, edi
pop edi
pop ebx
jmp 0x10069792
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc

Function at 0x10069a28
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100b1980]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
cmp byte [0x1016c088], al
je 0x10069a5f
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x10069ac3
push 0x103
push eax
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x107]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.1000b71f
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.1000b71f
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.1000b71f
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006e864
leave
ret 0x10

Function at 0x10069ad4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100b1980]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1016c088], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x10069b00
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x10069b31
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x10069b2f
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.1000b71f
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x10069b31
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1006e864
leave
ret 8
Function at 0x10069bcc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100b1980]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1016c088], 0
mov eax, dword [ebp + 8]
je 0x10069bf4
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x10069c0e
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.1000b71f
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.1006e864
leave
ret 4

Function at 0x1006e864
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100b1980]
jne 0x1006e86e
repz ret
jmp fcn.1006ef63
Function at 0x41c1fc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041c06d

Function at 0x41c5f6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040a570
mov eax, dword [0x47f3c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0041a1b9
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41c638
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41c794
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00425090
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x481ae0]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0041d395
mov ecx, dword [esi*4 + 0x481ae0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x41c78d
cmp eax, dword [edi + ecx + 0x24]
jne 0x41c78d
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41c78d
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041d395
add esp, 0x14
test edx, edx
jl 0x41c78d
jg 0x41c703
test eax, eax
jb 0x41c78d
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41c78d
jl 0x41c71d
cmp dword [ebp - 0x1008], eax
ja 0x41c78d
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41c73b
test ebx, ebx
je 0x41c774
cmp ecx, edi
jae 0x41c774
mov al, byte [ecx]
cmp al, 0xd
jne 0x41c755
lea eax, [edi - 1]
cmp ecx, eax
jae 0x41c761
cmp byte [ecx + 1], 0xa
jne 0x41c761
inc ecx
jmp 0x41c761
movzx eax, al
movsx eax, byte [eax + 0x47f688]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41c73b
cmp edx, ebx
jne 0x41c73b
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x41c792
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00409962
leave
ret
Function at 0x41c833
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x481ae0]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41c873
cmp byte [ebx], 0xa
jne 0x41c873
or byte [eax + edi + 0x28], 4
jmp 0x41c878
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x41c976
mov al, byte [edx]
cmp al, 0x1a
je 0x41c958
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x41c8a7
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x41c8cc
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x41c8d6
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x41c889
jmp 0x41c976
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41c953
cmp dword [ebp - 0xc], 0
je 0x41c953
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x481ae0]
test byte [eax + edi + 0x28], 0x48
je 0x41c92d
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x41c918
mov byte [esi], dl
jmp 0x41c929
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x481ae0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x41c976
cmp byte [ebp - 1], 0xa
jne 0x41c93c
cmp esi, ebx
jne 0x41c93c
mov byte [esi], 0xa
jmp 0x41c975
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041d3b3
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x41c976
mov byte [esi], 0xd
jmp 0x41c975
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x481ae0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41c972
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41c976
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41c97f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x481ae0]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41c9c2
cmp word [esi], dx
jne 0x41c9c2
or byte [edi + eax + 0x28], 4
jmp 0x41c9c7
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x41cb1a
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x41cafa
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x41ca09
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41ca3f
cmp eax, edx
jae 0x41ca4b
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x41c9e1
jmp 0x41cb1a
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41caf6
cmp dword [ebp - 0x14], 0
je 0x41caf6
mov eax, dword [ebx*4 + 0x481ae0]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x41cace
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x41ca97
mov word [esi], cx
jmp 0x41caca
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x481ae0]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x481ae0]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x481ae0]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x41cb1a
pop ebx
cmp word [ebp - 4], bx
jne 0x41cadf
cmp esi, dword [ebp + 0xc]
jne 0x41cadf
mov word [esi], bx
jmp 0x41cb17
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041d3b3
add esp, 0x10
cmp word [ebp - 4], bx
je 0x41cb1a
push 0xd
jmp 0x41cb13
mov ecx, dword [ebx*4 + 0x481ae0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41cb11
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41cb1a
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret