joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40288e
pop dword [ebp - 0x18]
mov eax, 0x36a44b97
sub eax, 0x36642309
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x928db02b
sub dword [ebp - 0x28], 0x443b6ae0
mov dword [ebp - 0x24], 0x35be99dc
sub dword [ebp - 0x24], 0x38b4d97
mov dword [ebp - 0x20], 0x2c98adbb
add dword [ebp - 0x20], 0x1fb39673
mov dword [ebp - 0x1c], 0xb96ebd8
add dword [ebp - 0x1c], 0xf4691428
lea eax, [ebp - 0x28]
push eax
mov eax, 0x3e5f85f1
add eax, 0xc1e0ea73
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xfb91ce02
add dword [ebp - 0x28], 0x78e09b54
mov dword [ebp - 0x24], 0x697dada4
add dword [ebp - 0x24], 0xd7eeb3d1
mov dword [ebp - 0x20], 0x5faa2925
sub dword [ebp - 0x20], 0xfc3abcb9
mov dword [ebp - 0x1c], 0x639d3f05
add dword [ebp - 0x1c], 0x9c62c0fb
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x369be
push 0
call eax
mov ecx, 0x480d
mov edx, eax
mov edi, 0x410000
add edi, dword [ebp - 0x18]
mov esi, 0xc767dd44
add esi, 0xc911f3e1
mov ebx, dword [edi]
xor dword [ebp - 0x14], ebx
xor ebx, esi
mov dword [edx], ebx
add edx, 0xe566d652
sub edx, 0xe566d64e
add edi, 0xa56e6b5a
add edi, 0x5a9194aa
loop 0x40299f
add eax, 0x258c5c9a
add eax, 0xda74b66d
mov ebx, eax
add eax, 0xadf9644c
add eax, 0x52069bb9
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x40288e
pop dword [ebp - 0x10]
mov eax, 0xcfdd4eca
add eax, 0x3062d9c4
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x20bde113
add dword [ebp - 0x20], 0x2d946438
mov dword [ebp - 0x1c], 0xf1952529
add dword [ebp - 0x1c], 0x409e271c
mov dword [ebp - 0x18], 0xb3abcbc
sub dword [ebp - 0x18], 0xbeee788e
mov dword [ebp - 0x14], 0x93a39552
sub dword [ebp - 0x14], 0x93a39552
lea eax, [ebp - 0x20]
push eax
mov eax, 0x23e5b42c
add eax, 0xdc5acc60
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x577cc3aa
add dword [ebp - 0x20], 0x1cf5a5ac
mov dword [ebp - 0x1c], 0xfcefc98a
add dword [ebp - 0x1c], 0x447c97eb
mov dword [ebp - 0x18], 0x754c854
add dword [ebp - 0x18], 0x5c1aa418
mov dword [ebp - 0x14], 0xff355d85
sub dword [ebp - 0x14], 0xff355d85
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x2a1bfedd
add eax, 0xd62481f7
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x33fea
push 0
call eax
mov ecx, 0xb1848608
sub ecx, 0xb1844870
xor esi, esi
add esi, eax
mov edi, 0x1b8899a3
add edi, 0xe4b8765d
add edi, dword [ebp - 0x10]
mov ebx, 0xc8a80e5c
add dword [ebp - 0xc], 0x11c1d088
mov edx, dword [edi]
mov dword [ebp - 4], 0x4f06f6f
add edx, ebx
xor dword [ebp - 0xc], 0xf35296da
mov dword [esi], edx
xor dword [ebp - 8], eax
add esi, 0x303ee1bd
sub esi, 0x303ee1b9
add edi, 0xd9a95886
sub edi, 0xd9a95882
loop 0x4029ac
add eax, 0xe933
mov ebx, eax
add eax, 0x1897e9bd
add eax, 0xe7681648
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x408fea
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x409029
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x409029
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x409029
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x409029
cmp dword [ecx + 0x74], 0xe
jbe 0x409029
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40eee6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4484a8
push 0x4484a0
push str.FlsAlloc
push 0x1f
call fcn.0040eda5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ef1a
push dword [ebp + 8]
mov ecx, esi
call dword [0x427130]
call esi
jmp 0x40ef20
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40ef64
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4484b8
push 0x4484b0
push str.FlsGetValue
push 0x21
call fcn.0040eda5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ef9b
push dword [ebp + 8]
mov ecx, esi
call dword [0x427130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40efa3
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4484c0
push 0x4484b8
push str.FlsSetValue
push 0x22
call fcn.0040eda5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40efdd
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x427130]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x412529
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4125c6
push ebx
push esi
call fcn.004124f2
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00412486
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x412573
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4125c5
push edi
push eax
call fcn.0040f695
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x412593
call fcn.0040ec38
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4125c4
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00412486
add esp, 0x20
test eax, eax
jne 0x4125b2
push edi
call fcn.0040ec38
jmp 0x4125ba
push ebx
call fcn.0040ec38
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x41a680
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41a6ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41a6ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x404e00
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov edi, edx
mov ebx, ecx
push str.ANDROID_PRODUCT_OUT
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x404f5a
mov esi, eax
cmp byte [eax], 0
je 0x404f5a
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
cmp eax, 0xfffffff0
jae 0x404f64
mov ecx, eax
mov dword [esp + 0x14], edi
cmp eax, 0xb
jae 0x404e75
mov eax, ecx
add al, cl
mov byte [esp], al
lea edi, [esp + 1]
test ecx, ecx
jne 0x404ea2
jmp 0x404eb1
mov dword [esp + 0x10], ebx
mov ebx, ecx
add ebx, 0x10
and ebx, 0xfffffff0
push ebx
mov edi, ecx
call fcn.0041a1e0
mov ecx, edi
add esp, 4
mov edi, eax
mov dword [esp + 8], eax
or ebx, 1
mov dword [esp], ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ecx
push ecx
push esi
push edi
mov esi, ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov ecx, esi
add esp, 0xc
mov byte [edi + ecx], 0
mov ecx, esp
push 0x55c2ba
call fcn.0041e2e0
mov ecx, dword [eax + 8]
mov dword [esp + 0x20], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x18], xmm0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov edx, dword [esp + 0x14]
movzx eax, byte [edx]
test al, 1
je 0x404ef9
mov eax, dword [edx + 4]
mov edx, dword [edx + 8]
jmp 0x404efe
add edx, 1
shr eax, 1
lea ecx, [esp + 0x18]
push eax
push edx
call fcn.0041e090
mov ecx, dword [eax + 8]
mov dword [ebx + 8], ecx
movsd xmm0, qword [eax]
movsd qword [ebx], xmm0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax], 0
test byte [esp + 0x18], 1
je 0x404f3e
push dword [esp + 0x20]
call fcn.0041a380
add esp, 4
test byte [esp], 1
je 0x404f50
push dword [esp + 8]
call fcn.0041a380
add esp, 4
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push str.ANDROID_PRODUCT_OUT_not_set
call fcn.00424010
mov ecx, esp
call fcn.0041d590
nop dword [eax + eax]
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov dword [esp + 0x18], ecx
mov edx, dword [ebp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x10], 0
lea ecx, [esp + 8]
call fcn.00404e00
mov al, byte [esp + 8]
mov byte [esp + 7], al
test al, 1
mov eax, dword [esp + 0x10]
lea ebx, [esp + 9]
mov dword [esp + 0x14], eax
cmovne ebx, eax
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
nop word cs:[eax + eax]
nop dword [eax]
push 0x8000
push ebx
call sub.api_ms_win_crt_stdio_l1_1_0.dll__open
add esp, 8
mov edi, eax
cmp eax, 0xffffffff
jne 0x404fec
call esi
cmp dword [eax], 4
je 0x404fd0
call esi
mov ebx, dword [eax]
mov eax, dword [esp + 0x18]
mov dword [eax], edi
mov edi, eax
call esi
mov dword [eax], ebx
test byte [esp + 7], 1
je 0x40500f
push dword [esp + 0x14]
call fcn.0041a380
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x408790
Capabilities:
Terminate process

Disassembly:
push edi
push esi
push eax
mov edi, dword [esp + 0x10]
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call esi
add esp, 4
push str.fastboot:_usage:
push eax
call fcn.0040de00
add esp, 8
lea eax, [esp + 0x14]
mov dword [esp], eax
push 2
call esi
add esp, 4
push dword [esp]
push edi
push eax
call fcn.0040ef90
add esp, 0xc
push 2
call esi
add esp, 4
push 0x55bb78
push eax
call fcn.0040de00
add esp, 8
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop dword [eax]
Function at 0x408c80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
mov ecx, esp
push edx
call fcn.0041d7e0
movzx eax, byte [esp]
test al, 1
je 0x408cc0
mov eax, dword [esp + 4]
cmp eax, 3
je 0x408cc7
jmp 0x408ce1
shr eax, 1
cmp eax, 3
jne 0x408ce1
mov ecx, esp
push 3
push 0x55b171
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x408da5
call fcn.0040ab80
test eax, eax
je 0x408e62
mov edi, eax
movzx eax, byte [esp]
mov ecx, eax
shr ecx, 1
and al, 1
mov edx, dword [esp + 4]
mov ebx, edx
cmove ebx, ecx
cmp ebx, 5
jne 0x408d30
mov ecx, esp
push 5
push str.other
push 0xffffffffffffffff
push 0
call fcn.0041f610
test eax, eax
je 0x408dc8
movzx ecx, byte [esp]
mov edx, dword [esp + 4]
mov eax, ecx
and al, 1
shr ecx, 1
test al, al
cmovne ecx, edx
cmp ecx, 1
jne 0x408e4b
test al, al
je 0x408d48
mov eax, dword [esp + 8]
jmp 0x408d4c
lea eax, [esp + 1]
movzx eax, byte [eax]
cmp al, 0x61
jl 0x408e4b
add eax, 0xffffff9f
cmp eax, edi
jge 0x408e4b
mov eax, dword [esp + 8]
mov dword [esi + 8], eax
movsd xmm0, qword [esp]
movsd qword [esi], xmm0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
test byte [esp], 1
je 0x408d9b
push dword [esp + 8]
call fcn.0041a380
add esp, 4
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp byte [ebp + 8], 0
je 0x408e20
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov byte [esi], 6
mov word [esi + 1], 0x6c61
mov byte [esi + 3], 0x6c
jmp 0x408d89
lea ecx, [esp + 0x10]
call fcn.0040aa90
mov bl, byte [esp + 0x10]
test bl, 1
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x11]
cmovne eax, ecx
movsx eax, byte [eax]
add eax, 0xffffffa0
cdq
idiv edi
add dl, 0x61
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi], 2
mov byte [esi + 1], dl
test bl, 1
je 0x408d89
push ecx
call fcn.0041a380
add esp, 4
jmp 0x408d89
call fcn.0040ab80
test eax, eax
jle 0x408ebd
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov word [esi], 0x6102
jmp 0x408d89
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
test byte [esp], 1
je 0x408e6c
mov ecx, dword [esp + 8]
jmp 0x408e70
push str.Device_does_not_support_slots
call fcn.00424010
lea ecx, [esp + 1]
push ecx
push str.Slot__s_does_not_exist._supported_slots_are:_n
push eax
call fcn.0040de00
add esp, 0xc
test edi, edi
jle 0x408eb6
mov esi, 0x61000000
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop
push 2
call ebx
add esp, 4
mov ecx, esi
sar ecx, 0x18
push ecx
push 0x55d64c
push eax
call fcn.0040de00
add esp, 0xc
add esi, 0x1000000
add edi, 0xffffffff
jne 0x408e90
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push str.No_known_slots
call fcn.00424010
nop word [eax + eax]
Function at 0x40ab80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov ecx, dword [0x586538]
mov byte [esp + 4], 0x14
mov dword [esp + 5], 0x746f6c73
mov dword [esp + 9], 0x756f632d
mov word [esp + 0xd], 0x746e
mov byte [esp + 0xf], 0
lea eax, [esp + 0x10]
lea edx, [esp + 4]
push 0
push eax
push edx
call fcn.00463ce0
test eax, eax
je 0x40abfe
test byte [esp + 4], 1
je 0x40abfa
push dword [esp + 0xc]
call fcn.0041a380
add esp, 4
xor esi, esi
jmp 0x40ac46
test byte [esp + 0x10], 1
je 0x40ac0b
mov eax, dword [esp + 0x18]
jmp 0x40ac0f
lea eax, [esp + 0x11]
lea ecx, [esp + 0x1c]
push 0x7fffffff
push 0x80000000
push ecx
push eax
call fcn.0040df80
add esp, 0x10
mov ebx, eax
test byte [esp + 4], 1
je 0x40ac3c
push dword [esp + 0xc]
call fcn.0041a380
add esp, 4
xor esi, esi
test bl, bl
je 0x40ac46
mov esi, dword [esp + 0x1c]
test byte [esp + 0x10], 1
je 0x40ac59
push dword [esp + 0x18]
call fcn.0041a380
add esp, 4
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
Function at 0x40ffb0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x4100bc
mov edi, ecx
movsx eax, byte [esi]
cmp eax, 0x5b
jg 0x41006f
cmp eax, 0x24
je 0x410094
cmp eax, 0x28
jne 0x4100bc
lea eax, [esi + 1]
cmp eax, ebx
je 0x4100bc
cmp byte [eax], 0x3f
jne 0x4100bc
lea eax, [esi + 2]
cmp eax, ebx
je 0x4100bc
movsx eax, byte [eax]
cmp eax, 0x21
je 0x41015a
cmp eax, 0x3d
jne 0x4100bc
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
lea ecx, [esp + 0x10]
call fcn.00410b60
mov eax, dword [edi + 0xc]
mov dword [esp + 0x1c], eax
add esi, 3
lea ecx, [esp + 0x10]
push ebx
push esi
call fcn.0040f510
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov ecx, edi
push dword [edi + 0x10]
push 0
jmp 0x4101a6
cmp eax, 0x5c
je 0x4100c8
cmp eax, 0x5e
jne 0x4100bc
push 8
call fcn.0041a1e0
add esp, 4
mov ecx, dword [edi + 0x24]
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov dword [eax], 0x55edec
jmp 0x4100ad
push 8
call fcn.0041a1e0
add esp, 4
mov ecx, dword [edi + 0x24]
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov dword [eax], 0x55ee28
mov dword [ecx + 4], eax
mov eax, dword [edi + 0x24]
mov eax, dword [eax + 4]
mov dword [edi + 0x24], eax
add esi, 1
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
lea eax, [esi + 1]
cmp eax, ebx
je 0x4100bc
mov al, byte [eax]
cmp al, 0x42
je 0x41010f
cmp al, 0x62
jne 0x4100bc
push 0x18
call fcn.0041a1e0
add esp, 4
mov ebx, eax
mov eax, dword [edi + 0x24]
mov eax, dword [eax + 4]
mov dword [ebx + 4], eax
mov dword [ebx], 0x55ee64
lea ecx, [ebx + 8]
push edi
call fcn.00427390
mov eax, dword [edi + 4]
mov ecx, dword [edi + 8]
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x14], 0
jmp 0x410143
push 0x18
call fcn.0041a1e0
add esp, 4
mov ebx, eax
mov eax, dword [edi + 0x24]
mov eax, dword [eax + 4]
mov dword [ebx + 4], eax
mov dword [ebx], 0x55ee64
lea ecx, [ebx + 8]
push edi
call fcn.00427390
mov eax, dword [edi + 4]
mov ecx, dword [edi + 8]
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x14], 1
mov eax, dword [edi + 0x24]
mov dword [eax + 4], ebx
mov eax, dword [edi + 0x24]
mov eax, dword [eax + 4]
mov dword [edi + 0x24], eax
add esi, 2
jmp 0x4100bc
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
lea ecx, [esp + 0x10]
call fcn.00410b60
mov eax, dword [edi + 0xc]
mov dword [esp + 0x1c], eax
add esi, 3
lea ecx, [esp + 0x10]
push ebx
push esi
call fcn.0040f510
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov ecx, edi
push dword [edi + 0x10]
push 1
lea eax, [esp + 0x18]
push eax
call fcn.00410ba0
mov eax, dword [esp + 0xc]
add dword [edi + 0x10], eax
cmp esi, ebx
je 0x4101d1
cmp byte [esi], 0x29
jne 0x4101d1
add esi, 1
lea ecx, [esp + 0x10]
call fcn.0040dd90
jmp 0x4100bc
call fcn.00410c30
int3
Function at 0x4225b0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
mov dword [esp + 0xc], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00497f00
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
lea esi, [esi]

Function at 0x422610
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov eax, dword [0x586f60]
test eax, eax
jle 0x422720
mov edx, dword [0x586f64]
xor ebx, ebx
mov ecx, dword [edx + 0xc]
cmp ecx, esi
ja 0x422641
mov edi, dword [edx + 0x10]
add ecx, dword [edi + 8]
cmp esi, ecx
jb 0x4226ba
add ebx, 1
add edx, 0x14
cmp ebx, eax
jne 0x422630
mov dword [esp], esi
call fcn.00498060
test eax, eax
mov edi, eax
je 0x422747
lea esi, [ebx + ebx*4]
mov ebx, dword [0x586f64]
shl esi, 2
add ebx, esi
mov dword [ebx + 0x10], eax
mov dword [ebx], 0
call fcn.00498150
add eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x586f64]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + esi + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x422727
mov eax, dword [ebp - 0x20]
cmp eax, 0x40
jne 0x4226c2
add dword [0x586f60], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 4
je 0x4226b3
cmp eax, 0x80
je 0x4226b3
cmp eax, 8
je 0x4226b3
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x28]
add esi, dword [0x586f64]
mov dword [esi + 4], eax
mov dword [esi + 8], edx
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4226b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004225b0
nop
lea esi, [esi]
xor ebx, ebx
jmp 0x42264b
mov eax, dword [0x586f64]
mov eax, dword [eax + esi + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004225b0
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004225b0
mov esi, esi
lea edi, [edi]
Function at 0x423690
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x240
mov esi, dword [ebp + 0xc]
lea eax, [ebp + 8]
test byte [esi], 1
jne 0x4236b1
mov word [esi], 0
jmp 0x4236be
mov ecx, dword [esi + 8]
mov byte [ecx], 0
mov dword [esi + 4], 0
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
mov edi, dword [eax]
mov eax, esp
push eax
push edi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__fstat32i64]
add esp, 8
cmp eax, 0xffffffff
je 0x4236fb
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
cmp eax, 1
sbb ecx, 0
jl 0x4236fb
mov ecx, esi
push eax
call fcn.0041de10
lea ebx, [esp + 0x3c]
jmp 0x42371b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 4
jne 0x423743
push 0x200
push ebx
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
add esp, 0xc
cmp eax, 0xffffffff
je 0x423710
test eax, eax
jle 0x42373e
mov ecx, esi
push eax
push ebx
call fcn.0041e090
jmp 0x42371b
sete al
jmp 0x423745
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4239b0
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov ebx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
test esi, esi
sete al
je 0x423a17
mov dword [esp], eax
nop word cs:[eax + eax]
nop dword [eax + eax]
push esi
push edi
push ebp
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
add esp, 0xc
cmp eax, 0xffffffff
jne 0x423a00
call ebx
cmp dword [eax], 4
je 0x4239e0
jmp 0x423a0d
add edi, eax
sub esi, eax
test eax, eax
mov eax, dword [esp]
jg 0x4239c7
jmp 0x423a0f
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov al, 1
jmp 0x423a0f