joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6a4d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x6a4d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x6a4d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x6a4d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x6a4d94
push eax
push esi
call fcn.006a720b
add esp, 8
pop esi
ret 0x10

Function at 0x6a4da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6a4e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x6a4e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x6bd320
push ecx
mov dword [esp + 0x1c], 4
call fcn.006a6dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x6a4dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x6a4e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6a4ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x6a4eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x6bd320
push ecx
mov dword [esp + 0x1c], 4
call fcn.006a6dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x6a4eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x6a4e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x6a5000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x6a5131
push esi
call fcn.006a8145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00697080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x6a5131
push 0
push ebp
call fcn.006973a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00697260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x6a508b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.006972f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x6a5121
push 0x6bd918
push edi
call fcn.006a63f0
push eax
push ebx
push esi
call fcn.006a4f60
push 0x6bd8f8
push edi
call fcn.006a63f0
push eax
push ebx
push esi
call fcn.006a4f60
push 0x6bd8d8
push edi
call fcn.006a63f0
push eax
push ebx
push esi
call fcn.006a4f60
push 0x6bd8c0
push edi
call fcn.006a63f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.006a4f60
push 0x6bd8a0
push edi
call fcn.006a63f0
push eax
push ebx
push esi
call fcn.006a4f60
push 0x6bd888
push edi
call fcn.006a63f0
push eax
push ebx
push esi
call fcn.006a4f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x6a61b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.006a6140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.006a6140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.006a6140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.006a6140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x6a6bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6a6c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x6b887c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6a6c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x6a6c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x4039cf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, str.Serpiei
mov edi, eax
push esi
call fcn.00403061
test eax, eax
pop ecx
je 0x403a23
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0xc], 0x403756
call edi
pop edi
xor eax, eax
pop esi
leave
ret 0x10
and byte [ebp - 0x114], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
call fcn.00402ca7
lea eax, [ebp - 0x114]
push 1
push eax
push str.Microsoft_.NET_COM_Integration_with_SOAP
push str.Microsoft_.Net_Frameworek_COMi_Suppoot
push esi
call fcn.004031c0
add esp, 0x18
call fcn.00402217
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4bb15a
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [pe_dos_header]
mov eax, dword ds:[eax + 0x34]
mov ebp, dword ds:[eax + 0xb8]
jmp 0x4bb168
push eax
push ecx
push esi
push ebp
mov eax, dword fs:[0x30]
test eax, eax
js 0x4bb14a
mov eax, dword ds:[eax + 0xc]
mov esi, dword ds:[eax + 0x1c]
lodsd eax, dword [esi]
mov ebp, dword ds:[eax + 8]
mov dword [ebx + 0x60], ebp
mov eax, ebp
cmp word [eax], 0x5a4d
jne 0x4bb145
add eax, 0x3c
mov ecx, dword [eax]
add ecx, dword [ebx + 0x60]
cmp word [ecx], 0x4550
jne 0x4bb145
add ecx, 0x78
mov esi, dword [ecx]
add esi, dword [ebx + 0x60]
add esi, 0x18
lodsd eax, dword [esi]
mov dword [ebx + 0x64], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x68], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x6c], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x70], eax
pop ebp
pop esi
pop ecx
pop eax
ret
Function at 0x401da0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, eax
sub esp, 0x2c
mov dword [esp], eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ecx
call fcn.004167e0
mov ebx, eax
or edx, ebx
jne 0x401dd1
mov dword [0x4e50d4], 1
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebx + 2]
mov dword [esp], eax
call fcn.004a70b0
mov dword [esp + 4], 0x4b38bc
mov dword [esp], esi
mov dword [esp + 0x10], eax
call sub.msvcrt.dll_fopen
test eax, eax
mov edi, eax
je 0x401fe3
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fread
test eax, eax
je 0x401fd3
mov dword [esp], edi
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x401fd3
mov dword [esp], edi
mov ebp, 1
call sub.msvcrt.dll_fclose
mov edi, dword [esp + 0x10]
mov byte [edi + ebx], 0xa
mov byte [edi + ebx + 1], 0
movzx eax, byte [edi]
test al, al
je 0x401efa
mov dword [esp + 0x1c], esi
mov esi, dword [esp + 0x18]
nop
lea esi, [esi]
mov ebx, edi
jmp 0x401e79
cmp al, 0xd
je 0x401f23
cmp al, 0x23
jne 0x401e73
mov byte [ebx], 0
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0xa
je 0x401f10
jg 0x401e64
test al, al
jne 0x401e73
movzx eax, byte [edi]
cmp al, 9
je 0x401e92
cmp al, 0x20
jne 0x401ea0
add edi, 1
movzx eax, byte [edi]
cmp al, 0x20
je 0x401e92
cmp al, 9
je 0x401e92
cmp al, 0xa
je 0x401fcb
cmp al, 0xd
je 0x401fcb
test al, al
je 0x401fcb
mov edx, edi
lea esi, [esi]
movzx eax, byte [edx + 1]
lea ecx, [edx + 1]
cmp al, 0x20
je 0x401f40
cmp al, 9
je 0x401f40
cmp al, 0xa
je 0x401edd
cmp al, 0xd
je 0x401edd
test al, al
mov edx, ecx
jne 0x401ec0
cmp ecx, edi
mov byte [ecx], 0
ja 0x401fb0
movzx eax, byte [ebx + 1]
add ebp, 1
lea edi, [ebx + 1]
test al, al
jne 0x401e60
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [eax], esi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
cmp byte [ebx + 1], 0xd
mov byte [ebx], 0
sete al
add ebx, eax
jmp 0x401e87
xor eax, eax
cmp byte [ebx + 1], 0xa
mov byte [ebx], 0
sete al
add ebx, eax
jmp 0x401e87
cmp al, 0xa
je 0x401edd
cmp al, 0xd
je 0x401edd
test al, al
je 0x401edd
movzx eax, byte [ecx + 1]
add edx, 2
cmp al, 0x20
jne 0x401f6a
mov esi, esi
lea edi, [edi]
add edx, 1
movzx eax, byte [edx]
cmp al, 0x20
je 0x401f60
cmp al, 9
je 0x401f60
cmp al, 0xd
ja 0x401f80
mov edx, 0x2401
bt edx, eax
jb 0x401edd
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], ebp
mov dword [esp], str._s:_d:_Ignoring_rubbish_found_on_this_line
mov dword [esp + 0x18], ecx
mov dword [esp + 4], eax
call fcn.00416030
mov ecx, dword [esp + 0x18]
cmp ecx, edi
mov byte [ecx], 0
jbe 0x401ee8
nop
lea esi, [esi]
mov dword [esp + 8], 1
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.004a2b10
mov dword [eax], edi
jmp 0x401ee8
mov byte [edi], 0
jmp 0x401ee8
mov dword [esp + 4], esi
mov dword [esp], str._s:_fread_failed
call fcn.00416000
call dword [sym.imp.msvcrt.dll__errno]
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], str.cannot_open__s:__s
call fcn.00416000
mov esi, esi
lea edi, [edi]
Function at 0x402010
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov dword [esp + 0x1c], eax
mov dword [esp + 4], 0x4b390f
mov eax, dword [eax + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
test eax, eax
je 0x4020e2
mov dword [esp], 0x1000
mov esi, eax
mov edi, 0x1000
call fcn.004a70b0
mov ecx, dword [esp + 0x1c]
xor ebx, ebx
mov dword [ecx + 0x10], eax
jmp 0x402089
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x10]
mov edx, edi
add eax, ebx
mov dword [esp + 0xc], esi
sub edx, ebx
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [esp + 8], edx
call sub.msvcrt.dll_fread
mov dword [esp], esi
mov ebp, eax
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x4020cb
add ebx, ebp
mov dword [esp], esi
call sub.msvcrt.dll_feof
test eax, eax
jne 0x4020b4
cmp ebx, edi
jne 0x402054
mov ebp, dword [esp + 0x1c]
lea edi, [ebx + ebx]
mov dword [esp + 4], edi
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.004a7130
mov dword [ebp + 0x10], eax
jmp 0x40205b
mov eax, dword [esp + 0x1c]
mov dword [eax + 0xc], ebx
mov dword [esp], esi
call sub.msvcrt.dll_fclose
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 8]
mov dword [esp], str._s:_fread_failed
mov dword [esp + 4], eax
call fcn.00416000
call dword [sym.imp.msvcrt.dll__errno]
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 8]
mov dword [esp], str.cannot_open:__s:__s
mov dword [esp + 4], eax
call fcn.00416000
lea esi, [esi]
Function at 0x406b50
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
push eax
mov eax, 0x2028
call fcn.004a8620
sub esp, eax
mov eax, dword [esp + eax]
test eax, eax
js 0x406c58
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
mov ebx, edx
mov dword [esp + 8], 0
mov dword [esp], eax
mov edi, eax
call fcn.004a9b90
or edx, eax
jne 0x406c58
mov dword [esp + 4], 0x8201
mov dword [esp], ebx
call sub.msvcrt.dll__open
test eax, eax
mov ebp, eax
js 0x406c6a
lea esi, [esp + 0x20]
jmp 0x406bd4
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], ebp
call sub.msvcrt.dll__write_1
cmp ebx, eax
jne 0x406c20
mov dword [esp + 8], 0x2000
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.msvcrt.dll__read
test eax, eax
mov ebx, eax
jg 0x406bc0
mov esi, dword [sym.imp.msvcrt.dll__errno]
call esi
mov eax, dword [eax]
mov dword [esp], edi
mov dword [esp + 0x1c], eax
call sub.msvcrt.dll__close
mov dword [esp], ebp
call sub.msvcrt.dll__close
test ebx, ebx
jne 0x406c50
add esp, 0x202c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [sym.imp.msvcrt.dll__errno]
call ebx
mov esi, dword [eax]
mov dword [esp], edi
call sub.msvcrt.dll__close
mov dword [esp], ebp
call sub.msvcrt.dll__close
call ebx
mov ebx, 0xffffffff
mov dword [eax], esi
add esp, 0x202c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call esi
mov ecx, dword [esp + 0x1c]
mov dword [eax], ecx
add esp, 0x202c
mov ebx, 0xffffffff
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [sym.imp.msvcrt.dll__errno]
call ebx
mov esi, dword [eax]
mov dword [esp], edi
call sub.msvcrt.dll__close
call ebx
mov ebx, 0xffffffff
mov dword [eax], esi
jmp 0x406c10
Function at 0x406de0
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x21
mov dword [esp + 4], 1
mov dword [esp], str.Last_stabs_entries_before_error:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1e
mov dword [esp + 4], 1
mov dword [esp], str.n_type_n_desc_n_value__string_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov ebx, dword [0x4e5100]
jmp 0x406edf
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.__6s
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [edi + 4]
mov dword [esp + 4], str.___6d
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [edi + 8]
mov dword [esp + 4], 0x4b5e9b
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [esi + 0x4e5120]
test eax, eax
jne 0x406f40
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp], 0xa
add eax, 0x40
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
add ebx, 1
mov eax, ebx
sar eax, 0x1f
shr eax, 0x1c
add ebx, eax
and ebx, 0xf
sub ebx, eax
cmp ebx, dword [0x4e5100]
je 0x406f85
mov esi, ebx
shl esi, 4
lea edi, [esi + 0x4e5120]
mov edx, dword [edi + 0xc]
test edx, edx
je 0x406ec1
mov eax, dword [esi + 0x4e5120]
mov dword [esp], eax
call fcn.00424410
test eax, eax
jne 0x406e41
mov eax, dword [esi + 0x4e5120]
test eax, eax
jne 0x406f64
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], str.HdrSym
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x406e5d
mov eax, dword [edi + 0xc]
mov dword [esp + 4], 0x4b5ea1
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x406ea9
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.__6d
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x406e5d
add esp, 0x10
pop ebx
pop esi
pop edi
ret
Function at 0x40bee0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x3c
mov dword [esp], 0x28
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
call fcn.004a70b0
mov ebp, eax
mov eax, dword [esp + 0x50]
test ebx, ebx
mov byte [eax], 0
je 0x40c018
cmp dword [ebx], 0x2e
jne 0x40bfd0
mov ecx, dword [ebx + 0xc]
xor esi, esi
test ecx, ecx
je 0x40bfb8
mov edi, 0xa
jmp 0x40bf4d
mov dword [ebp + esi*4], edx
mov ebx, dword [ebx + 0x10]
mov esi, ecx
test ebx, ebx
je 0x40bfb5
cmp dword [ebx], 0x2e
jne 0x40bfd0
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x40bfb5
lea eax, [esp + 0x2f]
mov edx, dword [esp + 0x14]
mov dword [esp], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x10]
call fcn.0040b730
test eax, eax
mov edx, eax
je 0x40bfa0
lea ecx, [esi + 1]
cmp ecx, edi
jb 0x40bf30
add edi, 0xa
mov dword [esp + 0x18], eax
mov dword [esp], ebp
lea eax, [edi*4]
mov dword [esp + 0x1c], ecx
mov dword [esp + 4], eax
call fcn.004a7130
mov ecx, dword [esp + 0x1c]
mov ebp, eax
mov edx, dword [esp + 0x18]
jmp 0x40bf30
cmp byte [esp + 0x2f], 0
je 0x40c00c
mov eax, dword [esp + 0x50]
mov byte [eax], 1
mov ebx, dword [ebx + 0x10]
test ebx, ebx
jne 0x40bf3d
shl esi, 2
mov dword [ebp + esi], 0
add esp, 0x3c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x29
mov dword [esp + 4], 1
mov dword [esp], str.Unexpected_type_in_v3_arglist_demangling_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], ebp
xor ebp, ebp
call fcn.004a9de0
add esp, 0x3c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebp
xor ebp, ebp
call fcn.004a9de0
jmp 0x40c002
xor esi, esi
jmp 0x40bfb8
Function at 0x416150
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
test eax, eax
je 0x4161d0
mov dword [esp + 8], eax
mov dword [esp + 4], str._s:_supported_targets:
mov dword [esp], esi
call sub.msvcrt.dll_fprintf
call fcn.00425a10
mov edi, eax
mov eax, dword [eax]
lea ebx, [edi + 4]
test eax, eax
je 0x4161ae
lea esi, [esi]
lea edi, [edi]
add ebx, 4
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4b79ef
mov dword [esp], esi
call sub.msvcrt.dll_fprintf
mov eax, dword [ebx - 4]
test eax, eax
jne 0x416190
mov dword [esp + 4], esi
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
mov dword [esp + 0x20], edi
add esp, 0x10
pop ebx
pop esi
pop edi
jmp fcn.004a9de0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x12
mov dword [esp + 4], 1
mov dword [esp], str.Supported_targets:
call sub.msvcrt.dll_fwrite
jmp 0x416176
Function at 0x416740
Capabilities:
Create directory

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x20]
call fcn.00415c30
mov ebx, eax
mov dword [esp], eax
call sub.msvcrt.dll__mktemp
mov dword [esp], ebx
mov esi, eax
call sub.msvcrt.dll__mkdir
test eax, eax
jne 0x416772
test esi, esi
je 0x416772
add esp, 0x14
mov eax, esi
pop ebx
pop esi
ret
mov dword [esp], ebx
xor esi, esi
call fcn.004a9de0
add esp, 0x14
mov eax, esi
pop ebx
pop esi
ret

Function at 0x416a40
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
mov ebp, str.cause_of_error_unknown
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x38]
mov esi, dword [esp + 0x3c]
call fcn.0041b170
test eax, eax
jne 0x416b40
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
mov eax, dword [0x4e5ce4]
mov dword [esp], eax
call sub.msvcrt.dll_fputs
mov eax, dword [esp + 0x34]
test eax, eax
je 0x416b50
test ebx, ebx
je 0x416b71
test edi, edi
je 0x416b50
mov eax, dword [edi]
test eax, eax
je 0x416b50
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.:__s__s_
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
test esi, esi
je 0x416b1c
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 2
lea ebx, [esp + 0x40]
mov dword [esp + 4], 1
mov dword [esp], 0x4b7c5a
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], ebp
mov dword [esp + 4], str.:__s_n
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], eax
call fcn.0041b180
mov ebp, eax
jmp 0x416a65
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x4b7c55
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x416ad4
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call fcn.00416950
mov ebx, eax
jmp 0x416aa2
Function at 0x4207e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
test edi, edi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x1c], eax
je 0x420898
movzx edx, byte [edi]
xor eax, eax
lea ebp, [edi + 1]
test edx, edx
je 0x42083b
mov esi, esi
lea edi, [edi]
mov ecx, edx
add ebp, 1
shl ecx, 0x11
add edx, ecx
add eax, edx
mov edx, eax
shr edx, 2
xor eax, edx
movzx edx, byte [ebp - 1]
test edx, edx
jne 0x420820
sub ebp, edi
xor edx, edx
sub ebp, 1
mov ecx, ebp
add eax, ebp
shl ecx, 0x11
add ecx, eax
mov eax, ecx
mov ebx, ecx
mov ecx, dword [esp + 0x14]
shr eax, 2
xor ebx, eax
mov eax, ebx
div dword [ecx + 0xc]
mov eax, dword [ecx]
mov esi, dword [eax + edx*4]
test esi, esi
jne 0x420876
jmp 0x4208b5
mov esi, dword [esi]
test esi, esi
je 0x4208b5
cmp dword [esi + 8], ebx
jne 0x420870
mov dword [esp + 4], edi
mov eax, dword [esi + 4]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x420870
add esp, 0x2c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x1b6
mov dword [esp], str._builds_idf_crosstool_NG_.build_HOST_i686_w64_mingw32_xtensa_esp32s2_elf_src_binutils_bfd_hash.c
call fcn.0041b3c0
movzx eax, byte [pe_dos_header]
ud2
cmp byte [esp + 0x18], 0
je 0x42094c
cmp byte [esp + 0x1c], 0
je 0x420909
mov eax, dword [esp + 0x14]
mov esi, ebp
add esi, 1
mov eax, dword [eax + 8]
jne 0x420925
mov edx, dword [eax + 4]
mov ebp, 8
cmp edx, ebp
mov dword [esp + 0x18], edx
jae 0x420938
mov dword [esp + 4], ebp
mov dword [esp], eax
call fcn.004a3b30
mov ebp, eax
test ebp, ebp
je 0x420953
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov edi, ebp
mov dword [esp], ebp
call sub.msvcrt.dll_memcpy
mov eax, dword [esp + 0x14]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x44], edi
mov dword [esp + 0x40], eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00420600
add ebp, 8
and ebp, 0xfffffff8
je 0x4208e5
mov edx, dword [eax + 4]
cmp edx, ebp
mov dword [esp + 0x18], edx
jb 0x4208e5
mov ecx, dword [eax]
lea edx, [ecx + ebp]
mov dword [eax], edx
mov edx, dword [esp + 0x18]
sub edx, ebp
mov ebp, ecx
mov dword [eax + 4], edx
jmp 0x4208f3
xor esi, esi
jmp 0x42088e
mov dword [esp], 6
xor esi, esi
call fcn.0041b470
jmp 0x42088e