joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ab3c
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040460c
xor eax, eax
push ebp
push 0x46acb1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.0040415c
push 0
push 0
push 0
push 0
mov eax, dword [0x46e694]
call fcn.0040461c
push eax
call sub.wininet.dll_InternetOpenA
mov ebx, eax
test ebx, ebx
je 0x46ac27
push 0
push 0x80000000
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040461c
push eax
push ebx
call sub.wininet.dll_InternetOpenUrlA
mov esi, eax
test esi, esi
je 0x46ac21
lea eax, [ebp - 8]
push eax
push 0x401
lea eax, [ebp - 0x40d]
push eax
push esi
call sub.wininet.dll_InternetReadFile
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x418]
lea edx, [ebp - 0x40d]
mov ecx, 0x401
call fcn.004043cc
mov eax, dword [ebp - 0x418]
mov ecx, dword [ebp - 8]
xor edx, edx
call fcn.0040467c
mov edx, dword [ebp - 0x414]
lea eax, [ebp - 0xc]
call fcn.00404424
cmp dword [ebp - 8], 0
jne 0x46abc4
push esi
call sub.wininet.dll_InternetCloseHandle
push ebx
call sub.wininet.dll_InternetCloseHandle
lea eax, [ebp - 0x41c]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0040467c
mov eax, dword [ebp - 0x41c]
mov edx, 0x46acc8
call fcn.00404568
je 0x46ac68
push 0x668a0
call sub.KERNEL32.DLL_Sleep
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0046ab3c
jmp 0x46ac83
push edi
mov eax, dword [ebp - 0xc]
call fcn.0040441c
mov ecx, eax
sub ecx, 6
mov edx, 4
mov eax, dword [ebp - 0xc]
call fcn.0040467c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46acb8
lea eax, [ebp - 0x41c]
mov edx, 3
call fcn.00404180
lea eax, [ebp - 0xc]
call fcn.0040415c
lea eax, [ebp - 4]
call fcn.0040415c
ret

Function at 0x46b2b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff30
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46b322
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040415c
push 0xc9
lea eax, [ebp - 0xcd]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea eax, [ebp - 4]
mov dl, byte [ebp - 0xcd]
call fcn.00404344
lea eax, [ebp - 4]
mov edx, 0x46b338
call fcn.00404424
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0046ae7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b329
lea eax, [ebp - 4]
call fcn.0040415c
ret
Function at 0x46b34c
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x46b3de
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040415c
push 0
call sub.user32.dll_OpenClipboard
push 1
call sub.user32.dll_GetClipboardData
mov ebx, eax
test ebx, ebx
je 0x46b3c3
push ebx
call sub.KERNEL32.DLL_GlobalLock
mov edx, eax
lea eax, [ebp - 4]
call fcn.00404354
mov eax, dword [ebp - 4]
call fcn.0040441c
cmp eax, 0xc8
jle 0x46b3b3
lea eax, [ebp - 4]
push eax
mov ecx, 0xc8
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040467c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004041b0
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
call sub.user32.dll_CloseClipboard
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b3e5
lea eax, [ebp - 4]
call fcn.0040415c
ret

Function at 0x46b3ec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x46b474
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.004047a8
push 0xffffffffffffffff
push 6
mov eax, dword [ebp - 4]
call fcn.0040461c
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
jne 0x46b433
lea eax, [ebp - 4]
call fcn.0040415c
jmp 0x46b44f
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004089bc
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, dword [0x46e6b4]
call fcn.00404468
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004041b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b47b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404180
ret
Function at 0x46b480
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46b599
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0040415c
lea eax, [ebp - 8]
call fcn.0040415c
mov dword [ebp - 0x10], 0x400
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [0x46e6b8]
call fcn.0040461c
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0
mov eax, dword [0x46e6bc]
call fcn.0040461c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x46b513
lea eax, [ebp - 4]
lea edx, [ebp - 0x410]
mov ecx, 0x400
call fcn.004043cc
mov eax, dword [ebp - 4]
call fcn.0040441c
test eax, eax
je 0x46b56b
mov dword [ebp - 0x10], 0x400
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
mov dl, byte [edx]
call fcn.00404344
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040461c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x46b56b
lea eax, [ebp - 8]
lea edx, [ebp - 0x410]
mov ecx, 0x400
call fcn.004043cc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004041b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b5a0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404180
ret

Function at 0x46b6d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x46b796
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebx]
push eax
call sub.user32.dll_GetAsyncKeyState
and ax, 1
cmp ax, 1
jne 0x46b76e
mov eax, ebx
add eax, 0xffffffd0
sub eax, 0xa
jb 0x46b714
add eax, 0xfffffff9
sub eax, 0x1a
jb 0x46b714
add eax, 0xfffffffa
sub eax, 0x1a
jae 0x46b742
push dword [0x46fc1c]
push 0x46b7ac
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404344
push dword [ebp - 4]
push 0x46b7b8
mov eax, 0x46fc1c
mov edx, 4
call fcn.004044dc
jmp 0x46b76e
push dword [0x46fc1c]
push 0x46b7c4
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004082f4
push dword [ebp - 8]
push 0x46b7d0
mov eax, 0x46fc1c
mov edx, 4
call fcn.004044dc
inc ebx
cmp ebx, 0x100
jne 0x46b6e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b79d
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404180
ret
Function at 0x10002d30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [ebx + 0x40fffffc], edi
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.100024c3
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10002478
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0

Function at 0x10002dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
invalid
invalid

Function at 0x100067f2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x10014140
cmp edx, dword [eax]
je 0x10006814
add eax, 8
inc ecx
cmp eax, 0x100141d0
jl 0x10006805
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x10014140]
jne 0x10006942
mov eax, dword [0x100147c0]
cmp eax, 1
je 0x1000691c
test eax, eax
jne 0x10006845
cmp dword [0x100147c4], 1
je 0x1000691c
cmp edx, 0xfc
je 0x10006942
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1000687c
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.10006c60
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.10006b60
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x100068bf
lea eax, [ebp - 0x1a4]
push eax
call fcn.10006b60
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x100095a0
push edi
call fcn.10006a20
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.10006c60
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.10006c70
lea eax, [ebp - 0xa0]
push 0x10009580
push eax
call fcn.10006c70
push dword [esi + 0x10014144]
lea eax, [ebp - 0xa0]
push eax
call fcn.10006c70
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.10007fb9
add esp, 0x2c
pop edi
jmp 0x10006942
lea eax, [ebp + 8]
lea esi, [esi + 0x10014144]
push 0
push eax
push dword [esi]
call fcn.10006b60
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10001930
Capabilities:
Query or enumerate registry value

Disassembly:
cmp dword [0x10007334], 0
jne 0x10001948
mov dword [0x10007334], 1
jmp fcn.10004e04
ret

Function at 0x10001949
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call fcn.10001958

Function at 0x100055c0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x100055d6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x100055f1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x401ef0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421978
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x431034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x3c], esi
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 7
mov word [esi + 0x18], ax
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401f77
sub ecx, edx
sar ecx, 1
push ecx
push ebx
mov ecx, esi
call fcn.004061a0
mov ebx, dword [ebp - 0x38]
mov edx, ebx
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x401f97
sub edx, ecx
lea ecx, [esi + 0x18]
sar edx, 1
push edx
push ebx
call fcn.004061a0
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor eax, eax
mov word [esi + 0x30], ax
mov ax, word [ebp - 0x34]
test ax, ax
jne 0x401fd0
mov eax, 0x20
jmp 0x401fdb
cmp ax, 9
jne 0x401fdf
mov eax, 0x40
mov word [esi + 0x30], ax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040abb0
mov esp, ebp
pop ebp
ret 8
Function at 0x407000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
push dword [ebp + 8]
call fcn.00406c79
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.00406cb4
mov ah, 0xba
fisttp qword [edi - 0x7717ba73]
pop ebp
call 0xe99df875
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.00406cc4
push eax
push esi
push dword [ebp + 8]
call fcn.00406c79
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00406cc4
push eax
push esi
push dword [ebp + 8]
call fcn.00406c79
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
invalid
inc ebp
invalid

Function at 0x407c30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor dh, al
test dword [eax + 0x38fffffc], esp
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00406cc4
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00406c79
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00406cb4
pop ebx
or byte [eax + edi*8 + 0x10468], bl
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid
Function at 0x408858
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
cmp al, 0xc6
test dword [eax + edi*8 - 1], edi
push dword [eax]
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.00406cc4
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.00406c25
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x408c2c

Function at 0x409d18
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x409d39
jl 0x409d30
test edi, edi
jne 0x409d39
xor eax, eax
xor edx, edx
jmp 0x409dfa
cmp dword [ebx + 0x38], 0
je 0x409d4e
push eax
push edi
push dword [ebp + 8]
call fcn.00409e00
jmp 0x409dfa
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x409d95
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x409d95
cmp eax, edi
jb 0x409d6f
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.0040c3c0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x409d9b
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x409def
mov ecx, ebx
call fcn.004093d8
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x409dda
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.00410596
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x409def
jmp 0x409dad
test edx, edx
je 0x409def
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00410596
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x415da0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x426348
push 0x426340
push str.FlsAlloc
push 0x1e
call fcn.00415c2c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x415dd4
push dword [ebp + 8]
mov ecx, esi
call dword [0x4231e4]
call esi
jmp 0x415dda
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x415e1e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x426358
push 0x426350
push str.FlsGetValue
push 0x20
call fcn.00415c2c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x415e55
push dword [ebp + 8]
mov ecx, esi
call dword [0x4231e4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x41736d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004171de

Function at 0x417767
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040b940
mov eax, dword [0x431034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004163d3
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4177a9
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x417905
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004217f0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x432a68]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0041875e
mov ecx, dword [esi*4 + 0x432a68]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x4178fe
cmp eax, dword [edi + ecx + 0x24]
jne 0x4178fe
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4178fe
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041875e
add esp, 0x14
test edx, edx
jl 0x4178fe
jg 0x417874
test eax, eax
jb 0x4178fe
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4178fe
jl 0x41788e
cmp dword [ebp - 0x1008], eax
ja 0x4178fe
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4178ac
test ebx, ebx
je 0x4178e5
cmp ecx, edi
jae 0x4178e5
mov al, byte [ecx]
cmp al, 0xd
jne 0x4178c6
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4178d2
cmp byte [ecx + 1], 0xa
jne 0x4178d2
inc ecx
jmp 0x4178d2
movzx eax, al
movsx eax, byte [eax + 0x4312b8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4178ac
cmp edx, ebx
jne 0x4178ac
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x417903
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040abb0
leave
ret
Function at 0x417bfc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x432a68]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x417c3c
cmp byte [ebx], 0xa
jne 0x417c3c
or byte [eax + edi + 0x28], 4
jmp 0x417c41
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x417d3f
mov al, byte [edx]
cmp al, 0x1a
je 0x417d21
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x417c70
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x417c95
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x417c9f
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x417c52
jmp 0x417d3f
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x417d1c
cmp dword [ebp - 0xc], 0
je 0x417d1c
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x432a68]
test byte [eax + edi + 0x28], 0x48
je 0x417cf6
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x417ce1
mov byte [esi], dl
jmp 0x417cf2
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x432a68]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x417d3f
cmp byte [ebp - 1], 0xa
jne 0x417d05
cmp esi, ebx
jne 0x417d05
mov byte [esi], 0xa
jmp 0x417d3e
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041877c
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x417d3f
mov byte [esi], 0xd
jmp 0x417d3e
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x432a68]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x417d3b
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x417d3f
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret