joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d410
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
push 0
mov byte [esp + 0x16], al
lea eax, [esp + 0x14]
mov edi, dword [esi]
push 3
push eax
push dword [esi + 0x1a8]
mov byte [esp + 0x20], 0xff
mov byte [esp + 0x21], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x43d45c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.0041b160
add esp, 0xc
push dword [esp + 0x18]
push ebx
push str.SENT
push dword [esi]
call fcn.0043d010
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x43d5a0
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
cmp dword [esp + 0xc], 0x1f
mov eax, dword [esp + 8]
push ebx
mov eax, dword [eax]
mov dword [esp + 4], eax
mov ebx, dword [eax + 0x154]
jne 0x43d6ee
push ebp
push edi
lea ebp, [ebx + 0x1cb0]
lea edi, [ebx + 0x1eb0]
mov dword [edi], ebp
cmp ebp, edi
jae 0x43d5ee
lea eax, [ebp + 1]
mov byte [ebp], 0xff
mov dword [edi], eax
cmp eax, edi
jae 0x43d5ee
mov byte [eax], 0xfa
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x43d5ee
mov byte [eax], 0x1f
inc dword [edi]
movzx eax, word [ebx + 0x1ca8]
push esi
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
movzx eax, ax
mov dword [esp + 0x1c], eax
movzx eax, word [ebx + 0x1caa]
push eax
call esi
mov edx, dword [esp + 0x1c]
movzx ecx, ax
mov eax, dword [edi]
cmp eax, edi
jae 0x43d659
mov byte [eax], dl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x43d659
mov byte [eax], dh
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x43d659
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x43d659
shr ecx, 8
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x43d659
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x43d659
mov byte [eax], 0xf0
mov eax, dword [edi]
inc eax
mov esi, dword [esp + 0x10]
mov dword [ebx + 0x1eb4], eax
sub eax, ebp
sub eax, 2
mov dword [edi], ebp
push eax
lea eax, [ebx + 0x1cb2]
push eax
push 0x3e
push esi
call fcn.0043d120
mov edi, dword [esp + 0x28]
add esp, 0x10
push 0
push 3
push ebp
push dword [edi + 0x1a8]
call dword [sym.imp.WS2_32.dll_send]
mov ebp, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jns 0x43d6ad
call ebp
push eax
push str.Sending_data_failed___d_
push esi
call fcn.0041b160
add esp, 0xc
push 4
lea eax, [ebx + 0x1cb3]
push eax
push edi
call fcn.0043d480
add esp, 0xc
lea eax, [ebx + 0x1cb7]
push 0
push 2
push eax
push dword [edi + 0x1a8]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x43d6eb
call ebp
push eax
push str.Sending_data_failed___d_
push esi
call fcn.0041b160
add esp, 0xc
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret
Function at 0x43ec00
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x8c
mov eax, dword [0x462080]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push ebp
mov ebp, dword [esp + 0x98]
lea eax, [esp + 8]
push esi
push edi
push eax
mov edi, dword [ebp + 0x4a8]
lea eax, [esp + 0x1c]
mov ebx, dword [ebp]
push eax
mov dword [esp + 0x18], 0x80
mov eax, dword [edi + 0x154]
push 0
add eax, 4
push eax
push dword [edi + 0x15c]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [edi + 0x148], 0
mov dword [edi + 0x14c], eax
jne 0x43ec86
push dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
lea eax, [edi + 0xc8]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov dword [edi + 0x148], eax
mov esi, dword [edi + 0x14c]
cmp esi, 4
jge 0x43ecc1
push str.Received_too_short_packet
push ebx
call fcn.0041b160
add esp, 8
mov dword [edi + 0xc], 7
xor eax, eax
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004501c9
add esp, 0x8c
ret
mov edx, dword [edi + 0x15c]
movzx ecx, byte [edx]
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
mov dword [edi + 0xc], ecx
dec ecx
cmp ecx, 5
ja case.0x43ece0.1
jmp dword [ecx*4 + 0x43edf4]
cmp esi, 4
jle case.0x43ece0.4
movzx ecx, byte [edx + 2]
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, word [edi + 0x40]
inc eax
movzx eax, ax
cmp eax, ecx
jne case.0x43ece0.4
lea eax, [esi - 4]
push eax
lea eax, [edx + 4]
push eax
push 1
push ebp
call fcn.0041b0a0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43ed38
push 5
push edi
call fcn.0043f770
add esp, 8
mov eax, esi
jmp 0x43eca8
mov eax, dword [edi + 0x14c]
sub eax, 4
cdq
add dword [ebx + 0xa0], eax
adc dword [ebx + 0xa4], edx
push dword [ebx + 0xa4]
push dword [ebx + 0xa0]
push ebx
call fcn.00427820
jmp 0x43edc8
movzx ecx, byte [edx + 2]
lea eax, [edx + 4]
mov dword [esp + 0x14], eax
add esi, 0xfffffffc
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
lea eax, [edx + 4]
push esi
push eax
mov dword [edi + 8], ecx
call fcn.0043e8d0
add esp, 8
cmp eax, esi
jae case.0x43ece0.4
push dword [esp + 0x14]
push str.TFTP_error:__s_n
push ebx
call fcn.0041b250
jmp 0x43edc8
lea eax, [esi - 2]
push eax
lea eax, [edx + 2]
push eax
push edi
call fcn.0043e980
add esp, 0xc
test eax, eax
je case.0x43ece0.4
jmp 0x43eca8
push str.Internal_error:_Unexpected_packet
push 0x45726c
push ebx
call fcn.0041b160
add esp, 0xc
push ebp
call fcn.00427bd0
add esp, 4
test eax, eax
je 0x43eca6
push 5
push edi
call fcn.0043f770
add esp, 8
mov eax, 0x2a
jmp 0x43eca8
Function at 0x44d310
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, ebx
push edi
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x44d320
sub esi, ecx
cmp esi, 0x7fffffff
ja 0x44d40e
test esi, esi
je 0x44d345
lea eax, [esi + esi]
push eax
call dword [section..data]
jmp 0x44d350
push 0x452559
call dword [0x46200c]
mov edi, eax
add esp, 4
test edi, edi
je 0x44d40e
xor ecx, ecx
test esi, esi
je 0x44d373
mov al, byte [ecx + ebx]
mov byte [edi + ecx*2], al
mov byte [edi + ecx*2 + 1], 0
inc ecx
cmp ecx, esi
jb 0x44d363
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov ebx, dword [esp + 0x24]
test eax, eax
je 0x44d3f0
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x8002
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x44d3e4
push 0
lea eax, [esi + esi]
mov dword [esp + 0x18], 0x10
push eax
push edi
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 0x18]
push eax
push ebx
push 2
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [ebx + 0x10], 0
push edi
mov byte [ebx + 0x14], 0
call dword [0x462004]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0xc
ret
pop edi
pop esi
mov eax, 0x1b
pop ebx
add esp, 0xc
ret
Function at 0x44d420
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
sub esp, 0x24
mov eax, dword [0x462080]
xor eax, esp
mov dword [esp + 0x20], eax
push edi
mov edi, dword [esp + 0x30]
lea eax, [esp + 4]
push 0xf0000000
push 1
push 0
push 0
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x44d520
push esi
mov esi, dword [esp + 0x38]
push 8
mov dword [esp + 0x18], 0x208
mov dword [esp + 0x1c], 0x6601
mov dl, byte [esi + 1]
mov cl, byte [esi]
mov al, dl
shr al, 1
mov byte [esp + 0x24], cl
shl cl, 7
or al, cl
shl dl, 6
mov cl, byte [esi + 2]
mov byte [esp + 0x25], al
mov al, cl
shr al, 2
or al, dl
shl cl, 5
mov dl, byte [esi + 3]
mov byte [esp + 0x26], al
mov al, dl
shr al, 3
or al, cl
shl dl, 4
mov cl, byte [esi + 4]
mov byte [esp + 0x27], al
mov al, cl
shr al, 4
or al, dl
shl cl, 3
mov dl, byte [esi + 5]
mov byte [esp + 0x28], al
mov al, dl
shr al, 5
or al, cl
shl dl, 2
mov cl, byte [esi + 6]
mov byte [esp + 0x29], al
mov al, cl
shr al, 6
add cl, cl
or al, dl
mov dword [esp + 0x20], 8
mov byte [esp + 0x2a], al
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x2f], cl
call fcn.0044ff60
add esp, 8
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x14
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
pop esi
test eax, eax
jne 0x44d532
push eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
pop edi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004501c9
add esp, 0x24
ret
mov eax, dword [esp + 0x2c]
push dword [esp + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [edi + 4], eax
lea eax, [esp + 0xc]
push eax
push edi
push 0
push 0
push 0
push dword [esp + 0x24]
mov dword [edi], ecx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [esp + 0x24]
mov al, 1
pop edi
xor ecx, esp
call fcn.004501c9
add esp, 0x24
ret
Function at 0x450000
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
jne 0x450027
pop edi
pop esi
pop ecx
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x1c]
mov dword [edi + 8], eax
push ebp
cmp ebx, dword [esi + 0x10]
jbe 0x450072
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [esp + 0x24]
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [esp + 0x20], ebx
jmp 0x450076
mov ebp, dword [esp + 0x1c]
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x28]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x4500d6
mov dword [esp + 0x10], eax
mov ebx, eax
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x18], al
lea eax, [esp + 0x18]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x24], al
lea eax, [esp + 0x24]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x450095
mov ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0x10]
jae 0x450107
nop dword [eax + eax]
mov eax, dword [esi + 4]
push 1
push str.6x_F
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x45dd3f
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x4500e0
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x451137
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x451176
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x451176
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x451176
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x451176
cmp dword [ecx + 0x74], 0xe
jbe 0x451176
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10008ec6
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x10008f28
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, ecx
test edx, edx
jne 0x10008f38
push 0xd
pop eax
jmp 0x10008f6e
push ebp
push esi
push edi
xor esi, esi
mov edi, edx
mov ecx, edi
lea ebp, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10008f44
sub ecx, ebp
lea eax, [ecx + 1]
add edi, eax
add esi, eax
cmp eax, 1
jne 0x10008f3f
push esi
push edx
push 7
push 0
push dword [esp + 0x24]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x1000c3fb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1000c40a
pop dword [ebp - 0x28]
mov eax, 0x2ed0aa8c
sub eax, 0x1ecfe682
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x339cc
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x38b5
mov edi, eax
mov edx, 0xbe6bcd83
add edx, 0x5196467d
add edx, dword [ebp - 0x28]
mov esi, 0x75c6adf0
add esi, 0x32bbf348
sub dword [ebp - 0xc], 0xc053af0a
mov ebx, dword [edx]
add dword [ebp - 0x14], esi
xor ebx, esi
xor dword [ebp - 0x14], 0x4d9bd3ec
mov dword [edi], ebx
mov dword [ebp - 8], 0x25cd1b2a
add edi, 0x3677c630
sub edi, 0x3677c62c
add edx, 4
loop 0x1000c45e
add eax, 0xd5a7
mov ebx, eax
add eax, 5
mov ecx, 0x5e6aabe6
add ecx, 0xb195541a
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0xa97ded
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0xc], ebp
call fcn.00a97dd7

Function at 0xa97df6
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
lea esp, [esp + 3]
jmp 0xa97fff
mov dword [esp + 8], esi

Function at 0xa99023
Capabilities:
Execute anti-debugging instructions

Disassembly:
add ecx, 0xf5adda42
jmp 0xa98fdf
add ecx, 0xa1a8a45d
call fcn.00a99054
invalid
mov eax, 0xbb54fcb8
push si
lea esp, [esp + 2]
jmp 0xa98f81
jmp 0xa98f69
mov ecx, edx
inc ah
jmp 0xa98fd3
sub esp, 3
mov eax, 0xa1e9df4b
mov eax, dword [esp]
lea esp, [esp + 3]
jmp 0xa98ff5
lea esp, [esp + 0x24]
add dl, 0x4c
lea ecx, [ecx + ebp]
rcl ecx, 1
jg 0xa98f7f
mov eax, 0xbb54fcb8
push si
lea esp, [esp + 2]
jmp 0xa98f81
mov eax, dword [esp]
lea esp, [esp + 3]
jmp 0xa98ff5
je 0xa98f8b
sub esp, 3
mov eax, 0xa1e9df4b
jmp 0xa98fbd
setle ah
jmp 0xa99005
shl ecx, 2
mov ah, cl
mov ah, byte [esp]
mov eax, dword [esp]
jmp 0xa97e03
mov eax, 0x7004123d
mov ax, cx
lea eax, [eax + edx]
jmp 0xa99043
bswap ecx
jmp 0xa98fa2
rol ah, cl
jmp 0xa97e6e
mov ecx, dword [ecx + reloc.MSVCRT.dll_strncpy]
mov ax, 0xc876
bsr eax, esi
ja 0xa9902a
jbe 0xa9908b
rol ah, cl
jmp 0xa97e6e

Function at 0xb55df0
Capabilities:
Access peb ldr_data

Disassembly:
push eax
jmp 0xb54092
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0xb55cf8
lea esp, [esp + 0x28]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0xb55d25
pop word [esp]
mov byte [esp], ch
push sp
mov dword [esp + 0x28], edi
jmp 0xb55db0
Function at 0x10001450
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002916a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.1000d804
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x100014dd
push eax
push esi
call fcn.1000db62
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x100379e0
lea ecx, [ebp - 0x1c]
call fcn.100013f0
push 0x1003ae64
lea eax, [ebp - 0x1c]
push eax
call fcn.1000f6d7
int3

Function at 0x10001ed0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, 0x614
mov dword [ebp - 0xe], 0
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0xa], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 6], 0
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x1c], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov esp, ebp
pop ebp
ret

Function at 0x10001f20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push ecx
mov edi, edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10001f6d
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10002600
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1000262b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10002d90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x1000264d
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x1000264f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x100026d3
jg 0x10002664
test esi, esi
je 0x100026d3
test ecx, ecx
jl 0x100026ad
jg 0x1000266e
test eax, eax
je 0x100026ad
cmp edi, ecx
jg 0x10002682
jl 0x10002678
cmp esi, eax
jae 0x10002682
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.1000f8b0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x100026b0
mov edx, dword [ebp + 8]
test edi, edi
jl 0x100026d3
jg 0x100026ba
test esi, esi
je 0x100026d3
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x100026d3
push eax
push esi
push 1
push edx
call fcn.10013247
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100026f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x1000271b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10002e70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x1000273d
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x1000273f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x100027de
jg 0x1000275c
test esi, esi
je 0x100027de
test ecx, ecx
jl 0x100027a9
jg 0x10002766
test eax, eax
je 0x100027a9
cmp ebx, ecx
jg 0x1000277a
jl 0x10002770
cmp esi, eax
jae 0x1000277a
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.1000f8b0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x100027b0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x100027de
jg 0x100027ba
test esi, esi
je 0x100027de
cmp dword [edi + 0x4c], 0
je 0x100027de
mov ecx, edi
call fcn.10003690
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.10014bb8
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10002b10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10002b2c
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x10002b5e
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x10002b5e
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x10002c2f
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10002b86
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10002baf
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.10012917
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp + 8]
mov byte [ebp - 4], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x10002c2f
cmp eax, 1
jle 0x10002c02
cmp eax, 3
jne 0x10002c2f
push dword [esi + 0x4c]
push dword [ebp - 4]
call fcn.10001eb0
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x28]
sub edi, eax
je 0x10002c1f
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.10013247
add esp, 0x10
cmp edi, eax
jne 0x10002c2f
lea eax, [ebp - 4]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 8], eax
jne 0x10002b53
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10003750
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x100037cf
cmp byte [esi + 0x3d], 0
je 0x100037cf
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10003799
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x100037a1
sub eax, 1
je 0x100037a5
sub eax, 2
je 0x100037cf
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100037c2
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.10013247
add esp, 0x10
cmp edi, eax
jne 0x10003799
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret