joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c2f1
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
push ebx
mov edx, 0xa
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40c2f8
call fcn.00438620
mov edx, dword [esp + 0x34]
lea ecx, [esp]
call fcn.00417060
mov edx, dword [esp + 0x38]
lea ecx, [esp + 4]
call fcn.00417060
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 8]
call fcn.00417060
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0xc]
call fcn.00417060
mov edx, dword [esp + 0x44]
lea ecx, [esp + 0x10]
call fcn.00417060
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x14]
call fcn.00417060
push 0
call sub.ole32.dll_CoInitialize
lea eax, [esp + 0x24]
push eax
mov ebp, 0x7ad55b
push ebp
push 1
push 0
mov ebp, 0x7ad54b
push ebp
call sub.ole32.dll_CoCreateInstance
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x18]
and ebx, ebx
jne 0x40c456
sub esp, 4
push dword [esp + 4]
mov eax, dword [esp + 0x2c]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
push eax
pop eax
add esp, 4
sub esp, 4
push dword [esp + 0xc]
mov eax, dword [esp + 0x2c]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
push eax
pop eax
add esp, 4
sub esp, 4
push dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
push eax
pop eax
add esp, 4
sub esp, 4
push dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
push eax
pop eax
add esp, 4
sub esp, 4
push dword [esp + 0x50]
push dword [esp + 0x1c]
mov eax, dword [esp + 0x30]
push eax
mov eax, dword [eax]
call dword [eax + 0x44]
push eax
pop eax
add esp, 4
lea eax, [esp + 0x20]
push eax
mov ebp, 0x7ad56b
push ebp
mov eax, dword [esp + 0x2c]
push eax
mov eax, dword [eax]
call dword [eax]
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x18]
and ebx, ebx
jne 0x40c44c
sub esp, 4
push 1
push dword [esp + 0xc]
mov eax, dword [esp + 0x2c]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
push eax
pop eax
add esp, 4
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [eax]
call dword [eax + 8]
mov eax, dword [esp + 0x24]
push eax
mov eax, dword [eax]
call dword [eax + 8]
call sub.ole32.dll_CoUninitialize
mov eax, dword [esp + 0x18]
jmp 0x40c463
push dword [esp]
call fcn.00438680
push dword [esp + 4]
call fcn.00438680
push dword [esp + 0x14]
call fcn.00438680
push dword [esp + 0xc]
call fcn.00438680
push dword [esp + 0x1c]
call fcn.00438680
push dword [esp + 8]
call fcn.00438680
push dword [esp + 0x10]
call fcn.00438680
add esp, 0x28
pop ebx
pop ebp
ret 0x1c
Function at 0x413d10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00438620
push 0xa0
call sub.USER32.dll_GetAsyncKeyState
mov dword [esp], eax
push 0x24
call sub.USER32.dll_GetAsyncKeyState
mov dword [esp + 4], eax
push 0x23
call sub.USER32.dll_GetAsyncKeyState
mov dword [esp + 8], eax
push 0x21
call sub.USER32.dll_GetAsyncKeyState
mov dword [esp + 0xc], eax
push 0x22
call sub.USER32.dll_GetAsyncKeyState
mov dword [esp + 0x10], eax
mov ebx, dword [esp]
and ebx, ebx
je 0x413d78
mov ebx, dword [esp + 4]
and ebx, ebx
je 0x413d78
mov eax, 1
jmp 0x413d7a
xor eax, eax
and eax, eax
je 0x413d8d
call fcn.0040c9bb
mov dword [0x7b0400], 0
mov ebx, dword [esp]
and ebx, ebx
je 0x413da3
mov ebx, dword [esp + 8]
and ebx, ebx
je 0x413da3
mov eax, 1
jmp 0x413da5
xor eax, eax
and eax, eax
je 0x413db8
call fcn.0040c15c
mov dword [0x7b0400], 0
mov ebx, dword [esp]
and ebx, ebx
je 0x413dce
mov ebx, dword [esp + 0xc]
and ebx, ebx
je 0x413dce
mov eax, 1
jmp 0x413dd0
xor eax, eax
and eax, eax
je 0x413dd9
call fcn.0040ead0
mov ebx, dword [esp]
and ebx, ebx
je 0x413def
mov ebx, dword [esp + 0x10]
and ebx, ebx
je 0x413def
mov eax, 1
jmp 0x413df1
xor eax, eax
and eax, eax
je 0x413dfa
call fcn.004122ec
xor eax, eax
add esp, 0x14
pop ebx
ret

Function at 0x41783d
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
je 0x4178d5
push edi
push 0x7b2fc4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x7b05dc]
test edi, edi
je 0x4178a9
push ebx
push esi
lea ebx, [edi + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4178a2
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
push ebx
push 0x7b05dc
call fcn.00438372
pop ecx
pop ecx
jmp 0x4178a4
mov edi, dword [edi]
test edi, edi
jne 0x417879
pop ebx
mov eax, dword [0x7ad57c]
mov esi, eax
inc eax
push 0x10
push 0x7b05dc
mov dword [0x7ad57c], eax
call fcn.004383b2
pop ecx
pop ecx
push 0x7b2fc4
mov dword [eax], ebp
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8
Function at 0x41c563
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x41c5b8
push dword [esp + 0x10]
push 0x41c4e2
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [0x7b08b0]
test esi, esi
je 0x41c611
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x41c5b0
cmp byte [esi + 0x10], 0
je 0x41c5b0
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x41c58c
jmp 0x41c611
mov esi, dword [0x7b08b0]
test esi, esi
je 0x41c611
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x41c60a
cmp byte [esi + 0x11], 0
je 0x41c5e6
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x41c5fd
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebp
push 0x7b08b0
call fcn.00438372
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x41c5c5
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x41d93e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x7b3338]
call fcn.00437a2e
mov edi, dword [eax + 0x24]
test edi, edi
je 0x41d9fc
cmp dword [edi + 8], 1
je 0x41d9fc
mov edi, dword [edi + 0xc]
test edi, edi
je 0x41d9fc
mov al, byte [edi]
cmp al, 0x20
je 0x41d977
cmp al, 9
jne 0x41d97a
inc edi
jmp 0x41d96d
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
push eax
push eax
push 0xffffffffffffffff
push edi
push eax
push 0xfde9
call esi
push dword [esp + 0x14]
mov ebx, eax
lea ecx, [ebx - 1]
push ecx
call fcn.004387e0
push ebx
mov ebp, eax
push ebp
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call esi
test ebx, ebx
jle 0x41d9cb
push 9
pop edx
lea eax, [ebp - 2]
lea eax, [eax + ebx*2]
movzx ecx, word [eax]
push 0x20
pop esi
cmp cx, si
je 0x41d9e7
cmp cx, dx
je 0x41d9e7
pop edi
pop esi
pop ebp
pop ebx
ret 4
movzx ecx, word [eax]
cmp cx, si
je 0x41d9df
cmp cx, dx
jne 0x41d9eb
xor ecx, ecx
mov word [eax], cx
sub eax, 2
cmp eax, ebp
jae 0x41d9d2
push ebp
call sub.MSVCRT.dll_wcslen
pop ecx
sub ebx, eax
push ebx
call fcn.004388c0
jmp 0x41d9cb
pop edi
pop esi
pop ebp
pop ebx
jmp fcn.004388f0
Function at 0x41f690
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x7b08c4], 0
jne 0x41f69e
call fcn.0041f610
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x7b08c8]
call esi
test eax, eax
jne 0x41f6c1
call fcn.0041f610
push dword [0x7b08c8]
call esi
mov edx, dword [esp + 0x14]
lea esi, [eax + 8]
mov edi, 0x11
lea ecx, [ecx]
imul ecx, edx, 0x53a9b4fb
lea esi, [esi + 4]
mov edx, 1
sub edx, ecx
imul ecx, edx, 0x53a9b4fb
mov dword [esi + 0x40], edx
mov edx, 1
sub edx, ecx
mov dword [esi - 4], edx
dec edi
jne 0x41f6d0
mov dword [eax], edi
lea ebp, [edi + 0x1f]
mov dword [eax + 4], 0xa
mov ebx, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [eax + ebx*4 + 8]
mov ecx, dword [eax + ebx*4 + 0x4c]
mov esi, dword [eax + edi*4 + 8]
ror ecx, 0xd
add ecx, dword [eax + edi*4 + 0x4c]
dec edi
ror edx, 5
add edx, esi
mov dword [eax + ebx*4 + 8], ecx
mov dword [eax + ebx*4 + 0x4c], edx
dec ebx
jns 0x41f730
mov ebx, 0x10
test edi, edi
jns 0x41f739
mov edi, 0x10
mov dword [eax], ebx
mov dword [eax + 4], edi
dec ebp
jne 0x41f702
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x41f750
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x7b08c4], 0
jne 0x41f75e
call fcn.0041f610
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x7b08c8]
call esi
mov edx, eax
test edx, edx
jne 0x41f785
call fcn.0041f610
push dword [0x7b08c8]
call esi
mov edx, eax
mov ebx, dword [edx]
mov esi, dword [edx + 4]
mov ebp, dword [esp + 0x14]
inc ebp
mov edi, dword [edx + ebx*4 + 0x4c]
mov eax, dword [edx + ebx*4 + 8]
mov ecx, dword [edx + esi*4 + 8]
ror edi, 0xd
add edi, dword [edx + esi*4 + 0x4c]
dec esi
ror eax, 5
add eax, ecx
mov dword [edx + ebx*4 + 8], edi
mov dword [edx + ebx*4 + 0x4c], eax
dec ebx
jns 0x41f7b8
mov ebx, 0x10
test esi, esi
jns 0x41f7c1
mov esi, 0x10
mov dword [edx], ebx
mov eax, edi
mov dword [edx + 4], esi
test ebp, ebp
je 0x41f7d0
mul ebp
mov eax, edx
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x421f85
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push esi
push 0x421ed4
push 0x10
push 0x2c
call fcn.00437c72
xor esi, esi
mov dword [0x7b0a68], eax
push esi
push esi
push 8
call fcn.00437a99
mov dword [0x7b3354], eax
cmp word [0x7b0a60], si
jne 0x42206e
push edi
lea eax, [esp + 8]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
inc edi
test eax, eax
jne 0x421fdd
mov word [0x7b0a60], di
jmp 0x421fe5
xor eax, eax
mov word [0x7b0a60], ax
push 0x800
push esi
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x7b0a7c], eax
test eax, eax
je 0x42206d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.getaddrinfo
push eax
call esi
push str.freeaddrinfo
push dword [0x7b0a7c]
mov dword [0x7b0a6c], eax
call esi
push str.getnameinfo
push dword [0x7b0a7c]
mov dword [0x7b0a70], eax
call esi
push str.WSAStringToAddressA
push dword [0x7b0a7c]
mov dword [0x7b0a74], eax
call esi
cmp dword [0x7b0a6c], 0
mov dword [0x7b0a78], eax
je 0x42206d
cmp dword [0x7b0a70], 0
je 0x42206d
cmp dword [0x7b0a74], 0
je 0x42206d
test eax, eax
je 0x42206d
mov dword [0x7b0a64], edi
pop edi
pop esi
add esp, 0x190
ret

Function at 0x4220f0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x42212c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4
Function at 0x4225c0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x4226c8
cmp word [edx], 0
je 0x4226c8
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
test ecx, ecx
jne 0x4225ee
mov ecx, dword [esi + 0x18]
push edi
cmp ecx, 0x19
jne 0x42264d
cmp dword [esi + 4], 0
mov ecx, edx
lea edi, [ecx + 2]
je 0x422620
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x422600
sub ecx, edi
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.00422a30
pop edi
pop esi
pop ecx
ret 0xc
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x422620
sub ecx, edi
lea eax, [esp + 8]
push 0
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
cmp ecx, 2
lea ecx, [esp + 0x14]
setne al
push ecx
dec eax
and eax, 0xfde9
push edx
push eax
call fcn.00422b40
mov edi, eax
test edi, edi
je 0x422643
cmp dword [esi + 4], 0
je 0x42269b
push dword [esp + 0x14]
push edi
push esi
call fcn.00422a30
push edi
push 0
push dword [0x7b013c]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
push dword [0x7b013c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc

Function at 0x422740
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
mov dword [esp + 4], 0
test esi, esi
je 0x4227a5
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x42279d
push dword [esp + 0x10]
push dword [0x7b3358]
call fcn.00437b9f
test eax, eax
je 0x422793
cmp dword [eax + 4], 0
je 0x422782
push edi
push esi
push eax
call fcn.00422a30
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea ecx, [esp + 0xc]
push ecx
push edi
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
pop edi
xor eax, eax
pop esi
pop ecx
ret 0xc
xor eax, eax
pop esi
pop ecx
ret 0xc

Function at 0x4228c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push dword [esp + 0x10]
mov dword [esp + 8], 0
push dword [0x7b3358]
call fcn.00437b9f
mov esi, eax
test esi, esi
je 0x42293f
cmp dword [esi + 4], 0
je 0x422910
push 1
lea eax, [esp + 8]
push eax
push esi
call fcn.00423060
test eax, eax
je 0x422904
inc dword [esi + 0xc]
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, 1
pop esi
add esp, 8
ret 4
push 0
lea eax, [esp + 0xc]
push eax
push 1
lea eax, [esp + 0x1c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42294a
cmp dword [esp + 8], 0
je 0x42294a
push 1
push 0
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 4
or eax, 0xffffffff
pop esi
add esp, 8
ret 4
Function at 0x422960
Capabilities:
Read file on windows

Disassembly:
push ecx
push dword [esp + 8]
mov dword [esp + 4], 0
push dword [0x7b3358]
call fcn.00437b9f
test eax, eax
je 0x4229ac
cmp dword [eax + 4], 0
je 0x422996
push 4
lea ecx, [esp + 4]
push ecx
push eax
call fcn.00423060
mov eax, dword [esp]
pop ecx
ret 4
push 0
lea ecx, [esp + 0xc]
push ecx
push 4
lea ecx, [esp + 0xc]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp]
pop ecx
ret 4

Function at 0x422a30
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp dword [esi + 0x1c], 0
jne 0x422b37
cmp dword [esi + 0x14], 1
jne 0x422a7b
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0xc]
push 1
neg eax
cdq
push ecx
push eax
push dword [esi]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
push edi
mov edi, dword [esp + 0x20]
cmp eax, edi
jle 0x422af8
mov ecx, dword [esi + 8]
add ecx, dword [esi + 4]
sub ecx, eax
mov eax, edi
dec eax
je 0x422ae3
dec eax
je 0x422acc
sub eax, 2
je 0x422ab7
push edi
push dword [esp + 0x20]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov ax, word [eax]
mov word [ecx], ax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
mov byte [ecx], al
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
push esi
call fcn.004220f0
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x422b25
push 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [esp + 0x28]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0xc
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
push edi
push dword [esp + 0x20]
add ecx, eax
jmp 0x422aa1
xor eax, eax
pop esi
add esp, 0xc
ret 0xc
Function at 0x422bb0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0x7b013c]
mov dword [esp + 0x14], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x422d34
mov cl, byte [esp + 3]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov esi, edx
mov edi, edi
cmp ebp, 0xffffffff
je 0x422bfe
test ebp, ebp
je 0x422ca0
dec ebp
cmp dword [ebx + 4], 0
je 0x422c17
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.00423060
mov dword [esp + 0x14], eax
jmp 0x422c31
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov cl, byte [esp + 0x13]
cmp eax, 1
jne 0x422ca0
test cl, cl
je 0x422c45
mov byte [esi], cl
inc esi
mov cl, byte [esp + 0x13]
mov eax, dword [esp + 0x18]
mov edi, esi
mov edx, dword [esp + 0x20]
dec eax
sub edi, edx
cmp edi, eax
jle 0x422c80
mov eax, dword [esp + 0x18]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x7b013c]
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x20], edx
lea esi, [edi + edx]
test cl, cl
je 0x422ca0
cmp dword [esp + 0x2c], 0
jne 0x422bf0
cmp cl, 0xd
je 0x422ca7
cmp cl, 0xa
jne 0x422bf0
dec esi
jmp 0x422d17
cmp dword [esp + 0x2c], 0
jne 0x422d17
cmp cl, 0xa
jne 0x422caf
dec esi
jmp 0x422d17
cmp cl, 0xd
jne 0x422d17
dec esi
cmp dword [ebx + 4], 0
je 0x422cce
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.00423060
mov dword [esp + 0x14], eax
jmp 0x422ce4
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x422d17
cmp dword [ebx + 4], 0
je 0x422cf6
inc dword [ebx + 0xc]
jmp 0x422d17
push 1
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebx]
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x20]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x1c]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x422d40
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push 0x1000
push 0
push dword [0x7b013c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [esp + 8], ecx
test ecx, ecx
je 0x422eed
mov ax, word [esp]
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
push edi
mov edi, ecx
mov dword [esp + 0x20], 0x1000
mov dword [esp + 0x1c], 0x7ff
cmp ebp, 0xffffffff
je 0x422d94
test ebp, ebp
je 0x422e4d
dec ebp
cmp dword [ebx + 4], 0
je 0x422dad
push 2
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.00423060
mov dword [esp + 0x14], eax
jmp 0x422dc7
push 0
lea eax, [esp + 0x18]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
cmp eax, 2
mov ax, word [esp + 0x10]
jne 0x422e4d
test ax, ax
je 0x422de1
mov word [edi], ax
add edi, 2
mov ax, word [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov esi, edi
mov edx, dword [esp + 0x1c]
sub esi, ecx
sar esi, 1
cmp esi, edx
jle 0x422e28
mov eax, dword [esp + 0x20]
add edx, 0x800
add eax, 0x1000
mov dword [esp + 0x1c], edx
push eax
push ecx
push 8
push dword [0x7b013c]
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
mov ax, word [esp + 0x10]
mov dword [esp + 0x18], ecx
lea edi, [ecx + esi*2]
test ax, ax
je 0x422e4d
cmp dword [esp + 0x30], 0
jne 0x422d86
cmp ax, 0xd
je 0x422e54
cmp ax, 0xa
jne 0x422d86
sub edi, 2
jmp 0x422ecc
cmp dword [esp + 0x30], 0
jne 0x422ecc
cmp ax, 0xa
jne 0x422e5f
sub edi, 2
jmp 0x422ecc
cmp ax, 0xd
jne 0x422ecc
sub edi, 2
cmp dword [ebx + 4], 0
je 0x422e81
push 2
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.00423060
mov dword [esp + 0x14], eax
jmp 0x422e97
push 0
lea eax, [esp + 0x18]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp word [esp + 0x10], 0xa
je 0x422ecc
cmp dword [ebx + 4], 0
je 0x422eab
add dword [ebx + 0xc], 2
jmp 0x422ecc
push 1
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 0xfffffffe
push eax
push 0xfffffffffffffffe
push dword [ebx]
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x38]
mov ecx, edi
sub ecx, dword [esp + 0x18]
sar ecx, 1
mov dword [eax], ecx
xor eax, eax
mov word [edi], ax
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
xor eax, eax
add esp, 0x18
ret 0x10
Function at 0x422f00
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0x7b013c]
mov dword [esp + 0x10], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x423050
mov eax, dword [esp + 0x1c]
mov cl, byte [esp + 3]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, edx
cmp edi, 0xffffffff
je 0x422f4c
test edi, edi
je 0x422fbd
dec edi
push esi
push ebp
call fcn.00423180
mov dword [esp + 0x20], eax
test eax, eax
jne 0x422f5f
xor cl, cl
jmp 0x422f61
mov cl, byte [esi]
mov edx, dword [esp + 0x1c]
add esi, eax
mov eax, dword [esp + 0x14]
mov ebx, esi
sub ebx, edx
mov byte [esp + 0x13], cl
add eax, 0xfffffffb
cmp ebx, eax
jle 0x422fa4
mov eax, dword [esp + 0x14]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x7b013c]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x1c], edx
lea esi, [ebx + edx]
mov eax, dword [esp + 0x2c]
test cl, cl
je 0x422fbd
test eax, eax
jne 0x422f42
cmp cl, 0xd
je 0x422fc1
cmp cl, 0xa
jne 0x422f42
dec esi
jmp 0x423033
test eax, eax
jne 0x423033
cmp cl, 0xa
jne 0x422fc9
dec esi
jmp 0x423033
cmp cl, 0xd
jne 0x423033
dec esi
cmp dword [ebp + 4], 0
je 0x422fe8
push 1
lea eax, [esp + 0x17]
push eax
push ebp
call fcn.00423060
mov dword [esp + 0x20], eax
jmp 0x422fff
push 0
lea eax, [esp + 0x24]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x423033
cmp dword [ebp + 4], 0
je 0x423011
inc dword [ebp + 0xc]
jmp 0x423033
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebp]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x1c]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x18]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10