joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4182d0
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x418394
mov edi, dword [esp + 0x1c]
cmp dword [edi], 0
je 0x4182f1
mov eax, dword [edi + 8]
mov byte [eax], 0
jmp 0x4182f9
mov eax, dword [0x5052b0]
mov dword [edi + 8], eax
mov dword [edi + 4], 0
push ebx
call sym._strlen
add esp, 4
test eax, eax
je 0x41838f
mov esi, eax
mov eax, dword [edi]
mov ecx, eax
sub ecx, 1
jb 0x418327
cmp ecx, esi
jb 0x418327
mov eax, dword [edi + 8]
xor ecx, ecx
jmp 0x418373
cmp eax, 2
mov ecx, 0x20
cmovae ecx, eax
mov edx, esi
inc edx
nop word cs:[eax + eax]
mov ebp, ecx
add ecx, ecx
cmp edx, ebp
ja 0x418340
test eax, eax
je 0x418360
push ebp
push dword [edi + 8]
call sym._realloc
add esp, 8
mov dword [edi + 8], eax
mov ecx, dword [edi + 4]
jmp 0x418371
push ebp
call sym._malloc
add esp, 4
mov byte [eax], 0
mov dword [edi + 8], eax
xor ecx, ecx
mov dword [edi], ebp
add ecx, eax
push esi
push ebx
push ecx
call sym._memcpy
add esp, 0xc
mov eax, dword [edi + 4]
add eax, esi
mov dword [edi + 4], eax
mov ecx, dword [edi + 8]
mov byte [ecx + eax], 0
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [esp + 0x14]
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push esi
push str.Error:_usage:__s__str__n
push eax
call sym._fprintf.llvm.5402686137902257467
add esp, 0xc
push 0x1dd
call sym._exit
int3

Function at 0x419040
Capabilities:
Terminate process

Disassembly:
push esi
push eax
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
test eax, eax
je 0x419069
mov ecx, esp
push 0xa
push ecx
push eax
call sym._strtoul
add esp, 0xc
mov ecx, dword [esp]
cmp byte [ecx], 0
jne 0x41908d
add esp, 4
pop esi
ret
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push esi
push str.Error:_usage:__s__num__n
push eax
call sym._fprintf.llvm.5402686137902257467
add esp, 0xc
push 0x1e0
call sym._exit
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push esi
push str.Error:_usage:__s__num__n
push eax
call sym._fprintf.llvm.5402686137902257467
add esp, 0xc
push 0x1df
call sym._exit
int3

Function at 0x4190c0
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
test edi, edi
je 0x419131
mov ebx, dword [esp + 0x1c]
mov eax, dword [ebx]
test eax, eax
je 0x419104
add ebx, 8
mov ebp, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
nop word cs:[eax + eax]
push eax
push edi
call ebp
add esp, 8
test eax, eax
je 0x419129
mov eax, dword [ebx]
add ebx, 8
test eax, eax
jne 0x4190f0
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push edi
push esi
push str.Error:_unknown__s_value:__s_n
push eax
call sym._fprintf.llvm.5402686137902257467
add esp, 0x10
push 0x1de
call sym._exit
mov eax, dword [ebx - 4]
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push esi
push str.Error:_usage:__s__value__n
push eax
call sym._fprintf.llvm.5402686137902257467
add esp, 0xc
push 0x1dc
call sym._exit
int3
Function at 0x4197c0
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
movzx ebx, byte [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov eax, dword [0x507634]
test eax, eax
je 0x4197e7
push eax
push str.e__uC
call sym._printf.llvm.1952461286852829747
add esp, 8
inc dword [0x50763c]
test edi, edi
je 0x4199a8
mov esi, dword [esp + 0x30]
test esi, esi
je 0x419815
push 0x4aaef8
push dword [esi + 8]
call sym._strcmp
add esp, 8
test eax, eax
je 0x4199a8
mov ebp, dword [esp + 0x34]
cmp byte [0x506391], 0
jne 0x419898
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 4
push 0x4aaefa
call sym._fwrite
add esp, 0x10
cmp byte [0x506380], 0
je 0x419865
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 4
push str.e_1m
call sym._fwrite
add esp, 0x10
test esi, esi
je 0x41987b
mov eax, ebp
and eax, 2
jne 0x41987b
cmp dword [esi + 0x10], 0
je 0x41987b
lea eax, [esi + 0x14]
jmp 0x419889
mov eax, 0x506370
cmp dword [0x50636c], 0
je 0x419898
push dword [eax]
push 0x4aaf18
call sym._printf.llvm.16596591741532047019
add esp, 8
test esi, esi
je 0x41992d
mov eax, ebp
and eax, 1
jne 0x41992d
cmp dword [esi + 4], 0
je 0x41992d
mov dword [esp], 0
mov dword [esp + 4], 0
mov eax, dword [0x5052b0]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
mov ecx, esp
push eax
push 1
push esi
push ecx
call dbg.ffParseFormatString
add esp, 0x10
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push dword [esp + 8]
push 1
push dword [esp + 0x14]
call sym._fwrite
add esp, 0x10
cmp dword [esp], 0
mov dword [esp + 4], 0
je 0x419957
mov dword [esp], 0
push dword [esp + 8]
call sym._free
add esp, 4
jmp 0x419957
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push edi
call sym._fputs
add esp, 8
test bl, bl
je 0x419957
movzx eax, bl
push eax
push str.__hhu
call sym._printf.llvm.16596591741532047019
add esp, 8
cmp byte [0x506391], 0
jne 0x41997d
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 4
push 0x4aaefa
call sym._fwrite
add esp, 0x10
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push dword [0x506388]
push 1
push dword [0x50638c]
call sym._fwrite
add esp, 0x10
cmp byte [0x506391], 0
je 0x4199b0
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 4
push 0x4aaefa
call sym._fwrite
add esp, 0x10
mov eax, ebp
test al, 4
jne 0x4199a8
cmp byte [0x506391], 0
jne 0x4199a8
test esi, esi
je 0x4199e7
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x4199f0
mov eax, dword [0x506410]
test eax, eax
je 0x4199a8
add eax, dword [0x507634]
push eax
push str.e__uG
call sym._printf.llvm.16596591741532047019
add esp, 8
jmp 0x4199a8
Function at 0x419a40
Capabilities:
Write file on windows

Disassembly:
push esi
sub esp, 0xc
mov esi, dword [esp + 0x1c]
mov dword [esp], 0
mov dword [esp + 4], 0
mov eax, dword [0x5052b0]
mov dword [esp + 8], eax
test esi, esi
je 0x419a84
lea eax, [esi + 0x18]
mov ecx, esp
push dword [esp + 0x28]
push dword [esp + 0x28]
push eax
push ecx
call dbg.ffParseFormatString
add esp, 0x10
cmp dword [esp + 4], 0
jne 0x419ab2
jmp 0x419af7
push 0x20
call sym._malloc
add esp, 4
mov dword [esp + 8], eax
mov dword [esp], 0x20
mov dword [eax + 3], 0x6e776f6e
mov dword [eax], 0x6e6b6e75
mov dword [esp + 4], 7
mov byte [eax + 7], 0
movzx eax, byte [esp + 0x18]
movzx eax, al
push dword [esp + 0x20]
push esi
push eax
push dword [esp + 0x20]
call dbg.ffPrintLogoAndKey
add esp, 0x10
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
mov esi, eax
push eax
push dword [esp + 8]
push 1
push dword [esp + 0x14]
call sym._fwrite
add esp, 0x10
push esi
push 0xa
call sym._fputc
add esp, 8
cmp dword [esp], 0
mov dword [esp + 4], 0
je 0x419b18
mov dword [esp], 0
push dword [esp + 8]
call sym._free
add esp, 4
add esp, 0xc
pop esi
ret

Function at 0x419b20
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push eax
lea esi, [esp + 0x24]
mov dword [esp], esi
cmp byte [0x506392], 0
je 0x419bc4
mov edi, dword [esp + 0x20]
movzx eax, byte [esp + 0x14]
movzx eax, al
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push eax
push dword [esp + 0x1c]
call dbg.ffPrintLogoAndKey
add esp, 0x10
cmp byte [0x506391], 0
jne 0x419b7e
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 7
push str.e_1_31m
call sym._fwrite
add esp, 0x10
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push esi
push edi
push eax
call dbg.__mingw_vfprintf
add esp, 0xc
cmp byte [0x506391], 0
jne 0x419bba
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 4
push 0x4aaefa
call sym._fwrite
add esp, 0x10
push 0xa
call sym._putchar
add esp, 4
add esp, 4
pop esi
pop edi
ret

Function at 0x419bd0
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov esi, dword [esp + 0x38]
test esi, esi
je 0x419c5b
movzx eax, byte [esp + 0x34]
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
movdqu xmmword [esp + 0x10], xmm0
movdqu xmmword [esp], xmm0
cmp esi, 0x20
jb 0x419c3c
mov edi, 0x20
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ebp, esp
nop word cs:[eax + eax]
push 1
call ebx
add esp, 4
push eax
push 0x20
push 1
push ebp
call sym._fwrite
add esp, 0x10
add edi, 0x20
cmp edi, esi
jbe 0x419c20
and esi, 0x1f
je 0x419c5b
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
mov ecx, esp
push eax
push esi
push 1
push ecx
call sym._fwrite
add esp, 0x10
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41a630
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x18]
push 4
push str.temp
push ebp
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strnicmp]
add esp, 0xc
test eax, eax
je 0x41a651
xor eax, eax
jmp 0x41a6cb
mov ebx, dword [esp + 0x1c]
movzx eax, byte [ebp + 4]
cmp eax, 0x2d
je 0x41a673
test eax, eax
jne 0x41a64d
mov esi, dword [esp + 0x20]
push ebx
call dbg.ffOptionParseBoolean
add esp, 4
mov byte [esi], al
jmp 0x41a6c9
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x14]
add ebp, 5
push str.green
push ebp
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x41a6b8
push str.yellow
push ebp
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x41a64d
push ebx
push esi
call dbg.ffOptionParseUInt32
add esp, 8
cmp eax, 0x65
jae 0x41a6d0
mov byte [edi + 1], al
jmp 0x41a6c9
push ebx
push esi
call dbg.ffOptionParseUInt32
add esp, 8
cmp eax, 0x65
jae 0x41a6d0
mov byte [edi], al
mov al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push esi
push str.Error:_usage:__s_must_be_between_0_and_100_n
push eax
call sym._fprintf.llvm.10217759100641897789
add esp, 0xc
push 0x1e0
call sym._exit
int3
Function at 0x41a720
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x18]
push str.temp
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x41a749
test eax, eax
sete al
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x41a85e
mov edi, dword [esp + 0x20]
mov edx, dword [ecx]
mov ebx, edx
and bl, 7
cmp bl, 2
je 0x41a780
mov ebx, edx
and ebx, 7
cmp ebx, 7
je 0x41a785
cmp ebx, 3
jne 0x41a85e
test dl, 0x18
setne byte [edi]
jmp 0x41a73c
mov byte [edi], 0
jmp 0x41a73c
mov ebp, dword [ecx + 4]
mov byte [edi], 1
shld ebp, edx, 0x18
je 0x41a73c
add ecx, 0x10
mov dword [esp], ebp
mov edi, ecx
mov esi, 0x65657267
jmp 0x41a7a8
add edi, edx
add edi, 0x10
dec ebp
je 0x41a7f5
cmp dword [edi + 1], 5
jne 0x41a7c0
mov edx, dword [edi + 8]
mov ebx, dword [edx]
xor ebx, esi
movzx edx, byte [edx + 4]
xor edx, 0x6e
or edx, ebx
je 0x41a7d4
mov ebx, dword [edi + 0x10]
not ebx
mov edx, 0x10
test bl, 6
jne 0x41a7a0
mov edx, dword [edi + 0x18]
jmp 0x41a7a0
mov edx, 0xf7
and edx, dword [edi + 0x10]
xor ebx, ebx
cmp edx, 4
jne 0x41a7ef
mov ebx, dword [edi + 0x18]
cmp ebx, 0x65
jae 0x41a882
mov edx, dword [esp + 0x24]
mov byte [edx], bl
mov edi, 0x6c6c6579
mov esi, dword [esp]
jmp 0x41a80c
add ecx, edx
add ecx, 0x10
dec esi
je 0x41a73c
cmp dword [ecx + 1], 6
jne 0x41a827
mov edx, dword [ecx + 8]
mov ebx, dword [edx]
xor ebx, edi
movzx edx, word [edx + 4]
xor edx, 0x776f
or edx, ebx
je 0x41a83b
mov ebx, dword [ecx + 0x10]
not ebx
mov edx, 0x10
test bl, 6
jne 0x41a800
mov edx, dword [ecx + 0x18]
jmp 0x41a800
mov edx, 0xf7
and edx, dword [ecx + 0x10]
xor ebx, ebx
cmp edx, 4
jne 0x41a852
mov ebx, dword [ecx + 0x18]
cmp ebx, 0x65
jae 0x41a899
mov ecx, dword [esp + 0x24]
mov byte [ecx + 1], bl
jmp 0x41a73c
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push esi
push str.Error:_usage:__s_must_be_an_object_or_a_boolean_n
push eax
call sym._fprintf.llvm.10217759100641897789
add esp, 0xc
push 0x1e0
call sym._exit
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 0x33
push str.Error:_usage:_temp.green_must_be_between_0_and_100_n
jmp 0x41a8ae
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 0x34
push str.Error:_usage:_temp.yellow_must_be_between_0_and_100_n
call sym._fwrite
add esp, 0x10
push 0x1e0
call sym._exit
Function at 0x41cdf0
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
cmp dword [0x505240], 0xffffffff
jne 0x41cfcd
mov ebx, dword [esp + 0x18]
mov edi, dword [ebx + 0x4c]
test edi, edi
je 0x41ce38
mov edx, dword [ebx + 0x48]
test edx, edx
je 0x41ce5e
push edx
mov ebp, edx
call sym._malloc
add esp, 4
mov esi, eax
mov byte [eax], 0
mov ebx, dword [ebx + 0x50]
test ebx, ebx
je 0x41ce9a
lea eax, [ebp - 1]
cmp eax, edi
mov edx, ebp
jb 0x41ce6f
mov ebp, edx
jmp 0x41ceaf
push 0
push str._json
push str.ipinfo.io
push 0x507744
call dbg.ffNetworkingSendHttpRequest
add esp, 0x10
movzx eax, al
mov dword [0x505240], eax
jmp 0x41cfb7
mov esi, dword [0x5052b0]
mov ebx, dword [ebx + 0x50]
test ebx, ebx
je 0x41cfbf
cmp edx, 2
mov eax, 0x20
cmovae eax, edx
lea ecx, [edi + 1]
nop dword [eax]
mov ebp, eax
add eax, eax
cmp ecx, ebp
ja 0x41ce80
test edx, edx
je 0x41cea1
push ebp
push esi
call sym._realloc
add esp, 8
mov esi, eax
jmp 0x41ceaf
mov dword [esp], ebp
xor edi, edi
jmp 0x41cec1
push ebp
call sym._malloc
add esp, 4
mov esi, eax
mov byte [eax], 0
push edi
push ebx
push esi
call sym._memcpy
add esp, 0xc
mov byte [esi + edi], 0
mov dword [esp], ebp
push 0x4ab8b1
push esi
call sym._strstr
add esp, 8
mov ecx, eax
sub ecx, esi
test eax, eax
cmove ecx, edi
lea eax, [ecx + 2]
mov ebp, edi
sub ebp, eax
jbe 0x41cf01
cmp dword [esp], 0
je 0x41cf05
add eax, esi
inc eax
sub edi, ecx
lea ebp, [edi - 3]
push ebp
push eax
push esi
call sym._memmove
add esp, 0xc
mov byte [esi + edi - 3], 0
jmp 0x41cf07
mov ebp, edi
jmp 0x41cf07
add esi, eax
push ebp
push 0x2f
push esi
call sym._memchr
add esp, 0xc
xor ebx, ebx
mov edi, dword [0x5052b0]
mov ecx, 0x4ab8b5
test eax, eax
je 0x41cf80
mov edx, edi
mov edi, eax
sub edi, esi
sub ebp, edi
je 0x41cf7e
xor ebx, ebx
test esi, esi
je 0x41cf7a
cmp eax, esi
je 0x41cf7a
add ebp, esi
lea eax, [edi + 1]
mov ecx, 0x20
nop word cs:[eax + eax]
mov ebx, ecx
add ecx, ecx
cmp eax, ebx
ja 0x41cf50
push ebx
call sym._malloc
add esp, 4
mov byte [eax], 0
push edi
push ebp
mov ebp, eax
push eax
call sym._memcpy
add esp, 0xc
mov byte [ebp + edi], 0
mov edx, ebp
mov ecx, ebp
mov byte [esi + edi], 0
mov edi, edx
push 0
push ecx
push esi
push 0x507744
call dbg.ffNetworkingSendHttpRequest
add esp, 0x10
movzx eax, al
mov dword [0x505240], eax
test ebx, ebx
je 0x41cfa6
push edi
call sym._free
add esp, 4
cmp dword [esp], 0
je 0x41cfb7
push esi
call sym._free
add esp, 8
jmp 0x41cfba
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
mov dword [esp], 0
jmp 0x41cec1
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 0x45
push 0x4ab85b
call sym._fwrite
add esp, 0x10
push 1
call sym._exit
int3
Function at 0x420a70
Capabilities:
Get file version info

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, edx
mov ebx, ecx
lea eax, [esp + 8]
push eax
push ecx
call sym._GetFileVersionInfoSizeA_8
test eax, eax
je 0x420b1a
mov ebp, eax
push eax
call sym._malloc
add esp, 4
mov esi, eax
push eax
push ebp
push dword [esp + 0x10]
push ebx
call sym._GetFileVersionInfoA_16
test eax, eax
je 0x420b02
mov eax, esp
lea ecx, [esp + 4]
push eax
push ecx
push 0x4ac27a
push esi
call sym._VerQueryValueW_16
test eax, eax
je 0x420b02
cmp dword [esp], 0
je 0x420b02
mov eax, dword [esp + 4]
cmp dword [eax], 0xfeef04bd
jne 0x420b02
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
movzx edx, cx
shr ecx, 0x10
movzx ebx, ax
shr eax, 0x10
push ebx
push eax
push edx
push ecx
push 0x4ac27e
push edi
call dbg.ffStrbufAppendF
add esp, 0x18
mov bl, 1
mov al, 1
test esi, esi
jne 0x420b0d
jmp 0x420b1c
xor ebx, ebx
mov eax, 0
test esi, esi
je 0x420b1c
push esi
call sym._free
add esp, 4
mov eax, ebx
jmp 0x420b1c
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x422380
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
cmp dword [0x505244], 0xffffffff
jne 0x422582
mov esi, dword [esp + 0x24]
push 0x20
call sym._malloc
mov ecx, esi
add esp, 4
mov ebx, eax
mov word [eax], 0x2f
mov ebp, dword [esi + 0x4c]
mov edi, 0x20
test ebp, ebp
je 0x4223fe
mov esi, dword [ecx + 0x50]
test esi, esi
je 0x4223fe
cmp ebp, 0x1e
jbe 0x422405
lea eax, [ebp + 2]
mov ecx, 0x20
nop dword [eax + eax]
mov edi, ecx
add ecx, ecx
cmp eax, edi
ja 0x4223d0
push edi
push ebx
call sym._realloc
add esp, 8
mov ebx, eax
inc eax
push ebp
push esi
push eax
call sym._memcpy
add esp, 0xc
mov byte [ebx + ebp + 1], 0
inc ebp
test edi, edi
jne 0x422419
mov al, 1
jmp 0x42242e
mov ebp, 1
jmp 0x42241d
mov eax, ebx
inc eax
push ebp
push esi
push eax
call sym._memcpy
add esp, 0xc
mov byte [ebx + ebp + 1], 0
inc ebp
mov ecx, dword [esp + 0x24]
mov eax, ebp
not eax
add eax, edi
cmp eax, 7
ja 0x42246b
xor eax, eax
test edi, edi
jne 0x422433
mov edi, 0x20
lea ecx, [ebp + 9]
mov edx, edi
nop dword [eax + eax]
mov edi, edx
add edx, edx
cmp ecx, edi
ja 0x422440
test al, al
je 0x42246f
push edi
call sym._malloc
add esp, 4
mov esi, eax
test ebp, ebp
je 0x42247d
lea eax, [ebp + 1]
push eax
push ebx
push esi
call sym._memcpy
add esp, 0xc
jmp 0x422482
mov esi, ebx
jmp 0x422486
push edi
push ebx
call sym._realloc
add esp, 8
mov esi, eax
jmp 0x422482
mov byte [esi], 0
xor ebp, ebp
mov ecx, dword [esp + 0x24]
mov dword [esi + ebp + 4], 0x3d74616d
mov dword [esi + ebp], 0x726f663f
mov byte [esi + ebp + 8], 0
mov edx, dword [ecx + 0x58]
test edx, edx
je 0x42254b
mov ecx, dword [ecx + 0x5c]
test ecx, ecx
je 0x42254b
lea ebx, [ebp + 8]
test edi, edi
je 0x4224c2
mov eax, edi
sub eax, ebp
add eax, 0xfffffff7
cmp eax, edx
jae 0x4224fe
mov dword [esp + 8], ecx
cmp edi, 2
mov eax, 0x20
cmovae eax, edi
lea ecx, [edx + ebx]
mov dword [esp + 4], ecx
mov dword [esp], ebx
lea ecx, [edx + ebx]
inc ecx
nop
mov ebx, eax
add eax, eax
cmp ecx, ebx
ja 0x4224e0
mov dword [esp + 0xc], edx
test edi, edi
je 0x422503
push ebx
push esi
call sym._realloc
add esp, 8
mov esi, eax
jmp 0x422529
lea ebp, [edx + ebx]
jmp 0x42253a
push ebx
call sym._malloc
add esp, 4
mov edi, eax
cmp dword [esp], 0
je 0x422524
add ebp, 9
push ebp
push esi
push edi
call sym._memcpy
add esp, 0xc
jmp 0x422527
mov byte [edi], 0
mov esi, edi
mov edi, ebx
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov ebx, dword [esp]
mov ebp, dword [esp + 4]
add ebx, esi
push edx
push ecx
push ebx
call sym._memcpy
add esp, 0xc
mov byte [esi + ebp], 0
push str.User_Agent:_curl_0.0.0_r_n
push esi
push str.wttr.in
push 0x50775c
call dbg.ffNetworkingSendHttpRequest
add esp, 0x10
movzx eax, al
mov dword [0x505244], eax
test edi, edi
je 0x42257a
push esi
call sym._free
add esp, 0x14
jmp 0x42257d
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 0x45
push str.Error:_this_module_can_only_be_used_once_due_to_internal_limitations_n
call sym._fwrite
add esp, 0x10
push 1
call sym._exit
int3
Function at 0x423090
Capabilities:
Encode data using base64

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, edx
mov edi, ecx
mov esi, dword [edx + 4]
lea eax, [esi*4]
mov ebp, 0xaaaaaaab
mul ebp
shr edx, 1
add edx, 0xa
mov dword [ecx], edx
push edx
call sym._malloc
add esp, 4
mov ecx, eax
mov byte [eax], 0
mov dword [esp + 0xc], edi
mov dword [edi + 8], eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
mov eax, esi
mul ebp
shr edx, 1
lea ebp, [edx + edx*2]
sub esi, ebp
mov eax, esi
test ebp, ebp
jne 0x423125
mov edi, ecx
mov edx, dword [esp]
mov ebx, ecx
cmp eax, 2
je 0x4231a5
cmp eax, 1
jne 0x4231ec
movsx ecx, byte [edx]
mov edx, ecx
shr edx, 2
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi], dl
shl ecx, 4
and ecx, 0x30
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 1], cl
mov byte [edi + 2], 0x3d
jmp 0x4231e5
mov edx, dword [esp]
add edx, ebp
mov dword [esp + 4], edx
xor edx, edx
mov edi, ecx
mov dword [esp + 8], ecx
nop word cs:[eax + eax]
mov ecx, dword [esp]
mov ecx, dword [ecx + edx]
bswap ecx
mov esi, ecx
shr esi, 0x1a
movzx ebx, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi], bl
mov esi, ecx
shr esi, 0x14
and esi, 0x3f
movzx ebx, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 1], bl
mov esi, ecx
shr esi, 0xe
and esi, 0x3f
movzx ebx, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 2], bl
shr ecx, 8
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 3], cl
add edi, 4
add edx, 3
cmp ebp, edx
jne 0x423140
mov ebx, dword [esp + 8]
mov edx, dword [esp + 4]
cmp eax, 2
jne 0x4230ef
movsx ecx, byte [edx]
shl ecx, 0x10
movsx edx, byte [edx + 1]
mov esi, edx
shl esi, 8
or esi, ecx
mov ecx, esi
shr ecx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi], cl
shr esi, 0xc
and esi, 0x3f
movzx ecx, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 1], cl
and edx, 0xf
movzx ecx, byte [edx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 2], cl
mov byte [edi + 3], 0x3d
add edi, 4
mov byte [edi], 0
sub edi, ebx
mov eax, dword [esp + 0xc]
mov dword [eax + 4], edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x425330
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [0x507638]
mov esi, eax
sub esi, dword [0x50763c]
jb 0x4253b0
inc esi
je 0x4253b0
movaps xmm0, xmmword [str._n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_ne__sm]
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp], xmm0
cmp esi, 0x20
jb 0x42538c
mov edi, 0x20
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ebp, esp
nop dword [eax + eax]
push 1
call ebx
add esp, 4
push eax
push 0x20
push 1
push ebp
call sym._fwrite
add esp, 0x10
add edi, 0x20
cmp edi, esi
jbe 0x425370
and esi, 0x1f
je 0x4253ab
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
mov ecx, esp
push eax
push esi
push 1
push ecx
call sym._fwrite
add esp, 0x10
mov eax, dword [0x507638]
inc eax
mov dword [0x50763c], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret