joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44bcb0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x44bce3
push esi
call fcn.0044edc0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44bcdc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x44bd69
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x44bd52
mov eax, dword [esi + 8]
test eax, eax
je 0x44bd07
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44bd4e
cmp eax, 2
je 0x44bd52
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44bcfa
cmp eax, 3
je 0x44bd2d
cmp eax, 1
jne 0x44bcfa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44bcfa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44bcfa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0044bd90
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x44bd78
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0044bd90
add esp, 4
pop esi
ret

Function at 0x46aba2
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46abda
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00468c2f
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00468c07
jmp 0x46abe6
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x46c294
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46c2d6
call fcn.00471e47
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46c2d6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x46c2cd
xor eax, eax
jmp 0x46c2de
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046c2e4
pop edi
pop esi
pop ebx
ret 4

Function at 0x472377
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4723a5
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4723c3
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004722dd
jmp 0x4723c3
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4723c3
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004722dd
test edi, edi
mov eax, edi
jne 0x4723ad
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x62243ac0
Capabilities:
Get geographical location

Disassembly:
test byte [0x62248028], 1
jne 0x62243ad8
mov eax, 0x80004001
ret 0xc
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], str.filter__p__level__p__country_code__p._n
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], str.dvd_info2_GetPlayerParentalLevel
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0x62248028
sub eax, 0x16c
mov dword [esp], 0
mov dword [esp + 0x10], eax
call sym._wine_dbg_log.constprop.0_1
mov eax, 0x80004001
leave
ret 0xc

Function at 0x622450e0
Capabilities:
Get process heap flags

Disassembly:
test edx, edx
je 0x622451aa
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
mov esi, edx
push ebx
mov eax, dword fs:[0x18]
sub esp, 0x2c
mov dword [esp + 8], 0x18
mov dword [esp + 4], 8
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x622451b0
mov dword [eax], sym._enum_pins_QueryInterface_12
mov dword [eax + 4], 1
mov dword [eax + 0x14], edi
mov eax, dword [edi]
mov dword [esp], edi
call dword [eax + 4]
mov eax, dword [edi + 0x160]
sub esp, 4
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0xc]
jmp 0x62245157
mov eax, dword [ebx + 0xc]
inc eax
mov dword [ebx + 0xc], eax
mov edx, dword [edi + 0x164]
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [edx]
test eax, eax
jne 0x62245150
test byte [0x62248058], 8
jne 0x62245180
mov dword [esi], ebx
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.Created_enumerator__p._n
mov dword [esp + 8], str.enum_pins_create
mov dword [esp + 4], 0x62248058
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x62245173
mov eax, 0x80004003
ret
mov dword [esi], 0
mov eax, 0x8007000e
jmp 0x62245177

Function at 0x622452b0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, 0xffffffff
push ecx
sub esp, 0x2c
mov esi, dword [ecx]
lock xadd dword [esi + 4], ebx
dec ebx
test byte [0x62248058], 8
jne 0x62245320
test ebx, ebx
jne 0x6224530f
mov eax, dword [esi + 0x14]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str._p_decreasing_refcount_to__lu._n
mov dword [esp + 8], str.enum_pins_Release
mov dword [esp + 4], 0x62248058
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x622452d9
Function at 0x62246a10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x62246a6b
cmp byte [esi + ebx - 1], 0xa
je 0x62246a3f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x6225a0a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x62247540
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x22c
mov eax, dword [0x6225a0c0]
test eax, eax
je 0x622475f8
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x62247580
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x220]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x6224756c
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x6224762d
mov dword [esp + 4], 0x622551ec
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x6225a0c0], eax
sub esp, 8
test eax, eax
jne 0x6224755d
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x6224756e
Function at 0x62247640
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get process heap flags
Get process heap force flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov edi, dword [ecx]
mov edx, dword [ecx + 4]
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov edx, dword [ebp - 0x1c]
sub esp, 8
mov ebx, eax
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
sub esp, 8
test ebx, ebx
je 0x622477d8
mov eax, dword [esi]
test eax, eax
je 0x622477c0
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], ebx
mov dword [esp + 0x14], 0
mov dword [ebp - 0x28], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
lea ecx, [eax + 1]
sub esp, 0x18
lea eax, [ecx + ecx]
mov dword [esp + 4], 0
mov edi, eax
mov dword [ebp - 0x20], eax
mov dword [esp + 8], edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x24], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x622477e8
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [esi + 4]
xor edx, edx
sub esp, 0x18
mov word [edi + eax - 2], dx
mov eax, dword [esi]
test ecx, ecx
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
jne 0x622477b0
call dword [edx + 0x28]
mov dword [esi + 8], eax
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 8]
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
not eax
pop ebx
shr eax, 0x1f
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
call dword [edx + 0x24]
mov dword [esi + 8], eax
sub esp, 8
jmp 0x62247776
mov edx, esi
mov eax, edi
call sym._create_registrar
test eax, eax
jne 0x622476b0
lea esi, [esi]
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esi + 8], 0x8007000e
xor eax, eax
jmp 0x622477da
Function at 0x4036d4
Capabilities:
Terminate process

Disassembly:
jmp 0x458d83
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x458d94
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405ae2
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x403805
Capabilities:
Query environment variable

Disassembly:
jmp 0x49726f
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x497280
pop esi
ret
push ebx
push edi
push esi
call fcn.00497156
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.004040ed
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4972a8
push ebx
push esi
push edi
call fcn.004058c1
add esp, 0xc
push 0
call fcn.0040648d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x40598e
Capabilities:
Parse pe header

Disassembly:
jmp 0x41aae3
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41ab22
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41ab22
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41ab22
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41ab22
cmp dword [ecx + 0x74], 0xe
jbe 0x41ab22
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x495444
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4d7304]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x49548f
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00495906
test al, al
jne 0x495489
sub edx, 2
cmp edx, edi
jne 0x49546f
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x4954b1
lea eax, [edi + 2]
cmp edx, eax
je 0x4954b1
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0049503d
add esp, 0x10
jmp 0x4955ab
push esi
lea ecx, [ebp - 0x255]
call fcn.00495906
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4954f4
push dword [ebp - 0x25c]
jmp 0x4954a1
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x495531
cmp word [ebp - 0x226], 0
je 0x495552
cmp word [ebp - 0x226], ax
jne 0x495531
cmp word [ebp - 0x224], 0
je 0x495552
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0049503d
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x49559e
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x49550b
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x495586
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4955ab
push 0x494a25
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.004056e6
add esp, 0x10
jmp 0x49557b
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403102
leave
ret
Function at 0x4a06be
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00401dd9
mov eax, dword [0x4d7304]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00406073
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4a0700
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4a085c
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004061d1
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x4daf88]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0040332d
mov ecx, dword [esi*4 + 0x4daf88]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x4a0855
cmp eax, dword [edi + ecx + 0x24]
jne 0x4a0855
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a0855
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0040332d
add esp, 0x14
test edx, edx
jl 0x4a0855
jg 0x4a07cb
test eax, eax
jb 0x4a0855
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4a0855
jl 0x4a07e5
cmp dword [ebp - 0x1008], eax
ja 0x4a0855
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4a0803
test ebx, ebx
je 0x4a083c
cmp ecx, edi
jae 0x4a083c
mov al, byte [ecx]
cmp al, 0xd
jne 0x4a081d
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4a0829
cmp byte [ecx + 1], 0xa
jne 0x4a0829
inc ecx
jmp 0x4a0829
movzx eax, al
movsx eax, byte [eax + 0x4d7c40]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4a0803
cmp edx, ebx
jne 0x4a0803
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4a085a
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00403102
leave
ret
Function at 0x4a10b9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4daf88]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4a10f9
cmp byte [ebx], 0xa
jne 0x4a10f9
or byte [eax + edi + 0x28], 4
jmp 0x4a10fe
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x4a11fc
mov al, byte [edx]
cmp al, 0x1a
je 0x4a11de
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x4a112d
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4a1152
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x4a115c
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x4a110f
jmp 0x4a11fc
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a11d9
cmp dword [ebp - 0xc], 0
je 0x4a11d9
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x4daf88]
test byte [eax + edi + 0x28], 0x48
je 0x4a11b3
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4a119e
mov byte [esi], dl
jmp 0x4a11af
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4daf88]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4a11fc
cmp byte [ebp - 1], 0xa
jne 0x4a11c2
cmp esi, ebx
jne 0x4a11c2
mov byte [esi], 0xa
jmp 0x4a11fb
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00401974
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4a11fc
mov byte [esi], 0xd
jmp 0x4a11fb
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x4daf88]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4a11f8
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4a11fc
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4a1258
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x4daf88]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4a129b
cmp word [esi], dx
jne 0x4a129b
or byte [edi + eax + 0x28], 4
jmp 0x4a12a0
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x4a13f3
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4a13d3
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4a12e2
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4a1318
cmp eax, edx
jae 0x4a1324
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4a12ba
jmp 0x4a13f3
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a13cf
cmp dword [ebp - 0x14], 0
je 0x4a13cf
mov eax, dword [ebx*4 + 0x4daf88]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4a13a7
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x4a1370
mov word [esi], cx
jmp 0x4a13a3
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x4daf88]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x4daf88]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x4daf88]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x4a13f3
pop ebx
cmp word [ebp - 4], bx
jne 0x4a13b8
cmp esi, dword [ebp + 0xc]
jne 0x4a13b8
mov word [esi], bx
jmp 0x4a13f0
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00401974
add esp, 0x10
cmp word [ebp - 4], bx
je 0x4a13f3
push 0xd
jmp 0x4a13ec
mov ecx, dword [ebx*4 + 0x4daf88]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4a13ea
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4a13f3
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x40611e
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
jge 0x406140
mov eax, 0xfffffffd
jmp 0x4061b8
mov ebx, dword [0x6f6854]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x406186
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x6f6854]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x4061ae
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x4061b8
mov esp, ebp
pop ebp
ret 4

Function at 0x40942a
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
mov ecx, dword fs:[0x30]
mov al, byte [ecx + 2]
leave
ret