joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41da50
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x418
push ebx
push esi
push edi
mov eax, 0x10
mov ebx, 0x400
push 1
mov word [esp + 0x10], ax
mov word [esp + 0x24], bx
call fcn.0040887c
push eax
push 0x2e
push 1
push str.Error_reading_global.env_environment_file_set.
call fcn.00408b11
push 0x42fa28
call fcn.00401350
add esp, 0x18
xor eax, eax
mov word [esp + 0x22], ax
lea eax, [esp + 0x20]
push 0x42f958
push eax
call sym.test_embusb.exe__string_appends_8
push 0x20
lea eax, [esp + 0x24]
push eax
call sym.test_embusb.exe__string_append1_8
mov edi, dword [esp + 0x428]
lea eax, [esp + 0xc]
push dword [edi + 0x914]
push eax
call sym.test_embusb.exe__string_f_int_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x24]
push eax
call sym.test_embusb.exe__string_append_8
push 0x42f9a8
lea eax, [esp + 0x24]
push eax
call sym.test_embusb.exe__string_appends_8
mov ax, word [esp + 0x22]
cmp ax, bx
jle 0x41db0c
cwde
push 0x431f72
sub eax, ebx
push eax
push 0x42fa2c
call fcn.00401350
mov ax, word [esp + 0x2e]
add esp, 0xc
test ax, ax
jle 0x41db1f
cmp ax, bx
jge 0x41db1b
movsx esi, ax
jmp 0x41db21
mov esi, ebx
jmp 0x41db21
xor esi, esi
push 1
call fcn.0040887c
push eax
push esi
lea eax, [esp + 0x30]
push 1
push eax
call fcn.00408b11
push 0x42fa30
call fcn.00401350
movzx ecx, word [edi + 0x50e]
add esp, 0x18
mov eax, ecx
cmp cx, bx
jle 0x41db73
movsx eax, cx
push 0x431f73
sub eax, 0x400
push eax
push 0x42fa34
call fcn.00401350
movzx eax, word [edi + 0x50e]
add esp, 0xc
test ax, ax
jle 0x41db86
cmp ax, bx
jge 0x41db82
movsx esi, ax
jmp 0x41db88
mov esi, ebx
jmp 0x41db88
xor esi, esi
push 1
call fcn.0040887c
push eax
push esi
lea eax, [edi + 0x510]
push 1
push eax
call fcn.00408b11
push 0x42fa38
call fcn.00401350
add esp, 0x18
call sym.test_embusb.exe__sys_bomb_0
pop edi
pop esi
pop ebx
add esp, 0x418
ret 4
Function at 0x41e510
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x418
push ebx
push esi
push edi
mov eax, 0x10
mov ebx, 0x400
push 1
mov word [esp + 0x10], ax
mov word [esp + 0x24], bx
call fcn.0040887c
push eax
push 0xe
push 1
push str.Error_reading
call fcn.00408b11
mov edi, dword [esp + 0x43c]
add esp, 0x14
movzx ecx, word [edi + 2]
mov eax, ecx
cmp cx, 0x20
jle 0x41e576
movsx eax, cx
push 0x431fd2
sub eax, 0x20
push eax
push 0x42fc70
call fcn.00401350
movzx eax, word [edi + 2]
add esp, 0xc
test ax, ax
jle 0x41e58d
cmp ax, 0x20
jge 0x41e586
movsx esi, ax
jmp 0x41e58f
mov esi, 0x20
jmp 0x41e58f
xor esi, esi
push 1
call fcn.0040887c
push eax
push esi
lea eax, [edi + 4]
push 1
push eax
call fcn.00408b11
push 1
call fcn.0040887c
push eax
push 0x22
push 1
push str..lan_language_descriptor_file_set.
call fcn.00408b11
push 0x42fc98
call fcn.00401350
add esp, 0x2c
xor eax, eax
mov word [esp + 0x22], ax
lea eax, [esp + 0x20]
push str.Error_on_line
push eax
call sym.test_embusb.exe__string_appends_8
push 0x20
lea eax, [esp + 0x24]
push eax
call sym.test_embusb.exe__string_append1_8
mov edi, dword [esp + 0x42c]
lea eax, [esp + 0xc]
push dword [edi + 0x914]
push eax
call sym.test_embusb.exe__string_f_int_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x24]
push eax
call sym.test_embusb.exe__string_append_8
push str._of_file
lea eax, [esp + 0x24]
push eax
call sym.test_embusb.exe__string_appends_8
mov ax, word [esp + 0x22]
cmp ax, bx
jle 0x41e645
cwde
push 0x431fd3
sub eax, 0x400
push eax
push 0x42fc9c
call fcn.00401350
mov ax, word [esp + 0x2e]
add esp, 0xc
test ax, ax
jle 0x41e658
cmp ax, bx
jge 0x41e654
movsx esi, ax
jmp 0x41e65a
mov esi, ebx
jmp 0x41e65a
xor esi, esi
push 1
call fcn.0040887c
push eax
push esi
lea eax, [esp + 0x30]
push 1
push eax
call fcn.00408b11
push 0x42fca0
call fcn.00401350
movzx ecx, word [edi + 0x50e]
add esp, 0x18
mov eax, ecx
cmp cx, bx
jle 0x41e6ac
movsx eax, cx
push 0x431fd4
sub eax, 0x400
push eax
push 0x42fca4
call fcn.00401350
movzx eax, word [edi + 0x50e]
add esp, 0xc
test ax, ax
jle 0x41e6bf
cmp ax, bx
jge 0x41e6bb
movsx esi, ax
jmp 0x41e6c1
mov esi, ebx
jmp 0x41e6c1
xor esi, esi
push 1
call fcn.0040887c
push eax
push esi
lea eax, [edi + 0x510]
push 1
push eax
call fcn.00408b11
push 0x42fca8
call fcn.00401350
add esp, 0x18
call sym.test_embusb.exe__sys_bomb_0
pop edi
pop esi
pop ebx
add esp, 0x418
ret 8
Function at 0x41f9e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x24]
push esi
call sym.test_embusb.exe__sys_error_none_4
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0x10
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x20]
push dword [eax + 0x920]
call sub.WS2_32.dll_getsockname
test eax, eax
je 0x41fa22
call sub.WS2_32.dll_WSAGetLastError
mov dword [esi + 0xc], eax
pop esi
add esp, 0x10
ret 0x10
push 4
lea eax, [esp + 0xc]
push eax
call sym.test_embusb.exe__sys_order_flip_8
push 2
lea eax, [esp + 0xa]
push eax
call sym.test_embusb.exe__sys_order_flip_8
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 8]
pop esi
mov dword [ecx], eax
mov ecx, dword [esp + 0x1c]
mov ax, word [esp + 2]
mov word [ecx], ax
add esp, 0x10
ret 0x10

Function at 0x41fa60
Capabilities:
Create udp socket

Disassembly:
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
call sym.test_embusb.exe__sys_error_none_4
call sym.test_embusb.exe__sys_sys_netstart_0
push 0
push 2
push 2
call sub.WS2_32.dll_socket
mov edi, eax
cmp edi, 0xffffffff
jne 0x41fa90
call sub.WS2_32.dll_WSAGetLastError
pop edi
mov dword [esi + 0xc], eax
pop esi
ret 0x10
lea eax, [esp + 0x18]
push eax
push 0x10
call sym.test_embusb.exe__sys_mem_alloc_8
mov eax, dword [esp + 0x18]
mov ecx, 2
push 4
mov word [eax], cx
mov ecx, dword [esp + 0x1c]
mov ax, word [esp + 0x14]
mov word [ecx + 2], ax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x1c]
add eax, 4
push eax
call sym.test_embusb.exe__sys_order_flip_8
mov eax, dword [esp + 0x18]
push 2
add eax, 2
push eax
call sym.test_embusb.exe__sys_order_flip_8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [ecx + 0x920], edi
pop edi
mov word [ecx], 0xa03
mov byte [ecx + 2], 0
mov dword [ecx + 4], 0x400
mov dword [ecx + 0x408], 0x100
mov dword [ecx + 0x50c], 0x400
mov dword [ecx + 0x910], 0
mov dword [ecx + 0x914], 0xfffffffe
mov dword [ecx + 0x918], eax
mov dword [ecx + 0x91c], 0x420380
pop esi
ret 0x10
Function at 0x41fdf0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push esi
mov esi, dword [esp + 0x30]
push edi
push esi
call sym.test_embusb.exe__sys_error_none_4
mov edi, dword [esp + 0x30]
test edi, edi
je 0x41ff91
push ebx
mov ebx, dword [esp + 0x30]
push ebp
mov ebp, dword [ebx + 0x918]
test ebp, ebp
jne 0x41fe43
push 1
call fcn.0040887c
push eax
push 0x36
push 1
push str.INTERNAL_ERROR:_Data_pointer_NIL_in_FILE_READ_INETSTR.
call fcn.00408b11
push 0x42fde4
call fcn.00401350
add esp, 0x18
call sym.test_embusb.exe__sys_bomb_0
push 0x431fec
push 0
push 1
push dword [0x431fe8]
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
call sub.KERNEL32.dll_CreateEventA
mov dword [esp + 0x28], eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x40]
push eax
push edi
push dword [esp + 0x3c]
push dword [ebx + 0x920]
call sub.KERNEL32.dll_WriteFile
test al, al
jne 0x41ff58
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x3e5
jne 0x41ff25
movss xmm0, dword [ebp + 4]
or eax, 0xffffffff
comiss xmm0, dword [0x4276b8]
jbe 0x41feef
movsd xmm1, qword [0x426ca0]
sub esp, 8
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [0x427690]
maxsd xmm1, xmm0
addsd xmm1, qword [0x4274d0]
movsd qword [esp + 0x18], xmm1
fld qword [esp + 0x18]
fstp qword [esp]
call fcn.00420ec0
fstp qword [esp + 0x18]
cvttsd2si eax, qword [esp + 0x18]
add esp, 8
push eax
push dword [esp + 0x2c]
call sub.KERNEL32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x41ff3b
cmp eax, 0xffffffff
je 0x41ff20
push 1
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x20]
push eax
push dword [ebx + 0x920]
call sub.KERNEL32.dll_GetOverlappedResult
test al, al
jne 0x41ff58
call sub.KERNEL32.dll_GetLastError
push dword [esp + 0x28]
mov dword [esi + 0xc], eax
call fcn.00405e0a
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x1c
ret 0x10
push esi
push 0x20
push 0xfffffffffffffffd
call sym.test_embusb.exe__sys_stat_set_12
push dword [esp + 0x28]
call fcn.00405e0a
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x1c
ret 0x10
cmp dword [esp + 0x3c], edi
je 0x41ff86
push esi
push 9
push 0xfffffffffffffffd
call sym.test_embusb.exe__sys_stat_set_12
push esi
lea eax, [ebx + 0x50c]
push eax
call sym.test_embusb.exe__sys_stat_parm_vstr_8
push esi
push edi
call sym.test_embusb.exe__sys_stat_parm_int_8
push esi
push dword [esp + 0x40]
call sym.test_embusb.exe__sys_stat_parm_int_8
push dword [esp + 0x28]
call fcn.00405e0a
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x1c
ret 0x10

Function at 0x41ffa0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, dword [esp + 0x18]
push esi
call sym.test_embusb.exe__sys_error_none_4
mov eax, dword [esp + 0xc]
push 0x10
push dword [eax + 0x918]
push 0
push dword [esp + 0x1c]
push dword [esp + 0x18]
push dword [eax + 0x920]
call sub.WS2_32.dll_sendto
mov ecx, eax
mov eax, dword [esp + 0x14]
test ecx, ecx
jns 0x41ffe8
mov dword [eax], 0
call sub.WS2_32.dll_WSAGetLastError
mov dword [esi + 0xc], eax
pop esi
ret 0x14
mov dword [eax], ecx
cmp ecx, dword [esp + 0x10]
je 0x41fffa
push esi
push 0x1c
push 0xfffffffffffffffd
call sym.test_embusb.exe__sys_stat_set_12
pop esi
ret 0x14
Function at 0x420060
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x400
push ebx
mov ebx, dword [esp + 0x40c]
push esi
mov esi, dword [esp + 0x414]
push edi
mov edi, dword [esp + 0x410]
push esi
push ebx
push edi
call sym.test_embusb.exe__string_t_inetadr_12
push esi
call sym.test_embusb.exe__sys_error_4
test al, al
je 0x4200fc
push ebp
push esi
call sym.test_embusb.exe__sys_error_none_4
call sym.test_embusb.exe__sys_sys_netstart_0
movsx ebp, word [edi + 2]
cmp dword [0x42fd60], ebp
cmovl ebp, dword [0x42fd60]
cmp ebp, 1
jl 0x4200c4
lea eax, [edi + 4]
push ebp
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00406d30
add esp, 0xc
mov al, byte [0x431fdc]
mov byte [esp + ebp + 0x10], al
lea eax, [esp + 0x10]
push eax
call sub.WS2_32.dll_gethostbyname
pop ebp
test eax, eax
jne 0x420108
call sub.WS2_32.dll_WSAGetLastError
mov dword [esi + 0xc], eax
cmp eax, 0x2af9
jne 0x4200fc
push esi
push 0xf
push 0xfffffffffffffffd
call sym.test_embusb.exe__sys_stat_set_12
push esi
push edi
call sym.test_embusb.exe__sys_stat_parm_vstr_8
pop edi
pop esi
pop ebx
add esp, 0x400
ret 0xc
mov eax, dword [eax + 0xc]
test eax, eax
je 0x4200eb
mov eax, dword [eax]
test eax, eax
je 0x4200eb
mov eax, dword [eax]
push 4
push ebx
mov dword [ebx], eax
call sym.test_embusb.exe__sys_order_flip_8
pop edi
pop esi
pop ebx
add esp, 0x400
ret 0xc

Function at 0x4201d0
Capabilities:
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, dword [esp + 0x28]
push edi
call sym.test_embusb.exe__sys_error_none_4
call sym.test_embusb.exe__sys_sys_netstart_0
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov esi, dword [esp + 0x24]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x42020b
call sub.WS2_32.dll_WSAGetLastError
mov dword [edi + 0xc], eax
pop edi
pop esi
add esp, 0x10
ret 0x10
lea eax, [esp + 8]
push eax
call sym.test_embusb.exe__file_inet_sockaddr_init_4
mov ax, word [esp + 0x20]
mov word [esp + 0xa], ax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push 4
push eax
call sym.test_embusb.exe__sys_order_flip_8
push 2
lea eax, [esp + 0xe]
push eax
call sym.test_embusb.exe__sys_order_flip_8
push dword [0x42fd64]
lea eax, [esp + 0xc]
push eax
push dword [esi + 4]
call sub.WS2_32.dll_bind
test eax, eax
jne 0x4202a2
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x10
push eax
lea eax, [esp + 0xc]
push eax
push dword [esi + 4]
call sub.WS2_32.dll_getsockname
test eax, eax
jne 0x4202a2
push 4
lea eax, [esp + 0x10]
push eax
call sym.test_embusb.exe__sys_order_flip_8
push 2
lea eax, [esp + 0xe]
push eax
call sym.test_embusb.exe__sys_order_flip_8
mov ax, word [esp + 0xa]
push 8
push dword [esi + 4]
mov word [esi], ax
call sub.WS2_32.dll_listen
test eax, eax
je 0x4202b2
call sub.WS2_32.dll_WSAGetLastError
mov dword [edi + 0xc], eax
push dword [esi + 4]
call sub.WS2_32.dll_closesocket
pop edi
pop esi
add esp, 0x10
ret 0x10
Function at 0x4202e0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x24]
push edi
push esi
call sym.test_embusb.exe__sys_error_none_4
call sym.test_embusb.exe__sys_sys_netstart_0
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov edi, eax
cmp edi, 0xffffffff
jne 0x420316
call sub.WS2_32.dll_WSAGetLastError
pop edi
mov dword [esi + 0xc], eax
pop esi
add esp, 0x10
ret 0x10
lea eax, [esp + 8]
push eax
call sym.test_embusb.exe__file_inet_sockaddr_init_4
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
mov ax, word [esp + 0x20]
mov word [esp + 0xa], ax
lea eax, [esp + 0xc]
push 4
push eax
call sym.test_embusb.exe__sys_order_flip_8
push 2
lea eax, [esp + 0xe]
push eax
call sym.test_embusb.exe__sys_order_flip_8
push dword [0x42fd68]
lea eax, [esp + 0xc]
push eax
push edi
call sub.WS2_32.dll_connect
test eax, eax
jne 0x420306
mov esi, dword [esp + 0x24]
push esi
call fcn.00420130
mov dword [esi + 0x920], edi
pop edi
pop esi
add esp, 0x10
ret 0x10
Function at 0x420710
Capabilities:
Clear file content
Delete file
Write file on windows

Disassembly:
mov eax, 0x2510
call fcn.004054e0
mov eax, 0x400
mov word [esp + 0x108], ax
mov eax, pe_nt_image_headers32
push esi
push edi
mov edi, dword [esp + 0x2528]
mov word [esp + 0xc], ax
mov eax, 0x2000
push edi
mov word [esp + 0x518], ax
call sym.test_embusb.exe__sys_error_none_4
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x114]
push eax
push dword [esp + 0x2524]
call sym.test_embusb.exe__string_pathname_split_12
lea eax, [esp + 0x110]
push eax
push eax
call sym.test_embusb.exe__string_treename_8
lea eax, [esp + 0x514]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x118]
push eax
call sym.test_embusb.exe__string_pathname_join_12
test byte [esp + 0x2524], 1
mov esi, 1
je 0x4207d6
lea eax, [esp + 0x514]
mov esi, 2
push eax
call sym.test_embusb.exe__string_terminate_null_4
lea eax, [esp + 0x518]
push eax
call sub.KERNEL32.dll_DeleteFileA
test al, al
jne 0x4207d6
call sub.KERNEL32.dll_GetLastError
push edi
mov dword [edi + 0xc], eax
call sym.test_embusb.exe__file_not_found_4
test al, al
je 0x42086b
movzx eax, word [0x42fe04]
push eax
push 0x42fe00
lea eax, [esp + 0x51c]
push eax
call sym.test_embusb.exe__string_appendn_12
lea eax, [esp + 0x514]
push eax
call sym.test_embusb.exe__string_terminate_null_4
push dword [0x431ff4]
lea eax, [esp + 0x51c]
push 0x8000080
push esi
push dword [0x431ff0]
push 1
push 0x40000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x420863
push dword [0x431ff8]
mov eax, dword [esp + 0x2524]
lea edx, [esp + 0xc]
push edx
movsx ecx, word [eax + 2]
add eax, 4
push ecx
push eax
push esi
call sub.KERNEL32.dll_WriteFile
test al, al
je 0x420876
push esi
call sub.KERNEL32.dll_SetEndOfFile
test al, al
je 0x420876
push esi
call fcn.00405e0a
test al, al
jne 0x42086b
call sub.KERNEL32.dll_GetLastError
mov dword [edi + 0xc], eax
pop edi
pop esi
add esp, 0x2510
ret 0x10
call sub.KERNEL32.dll_GetLastError
push esi
mov dword [edi + 0xc], eax
call fcn.00405e0a
lea eax, [esp + 0x518]
push eax
call sub.KERNEL32.dll_DeleteFileA
pop edi
pop esi
add esp, 0x2510
ret 0x10
Function at 0x4208a0
Capabilities:
Delete file

Disassembly:
mov eax, 0x250c
call fcn.004054e0
mov eax, 0x400
mov word [esp + 0x104], ax
mov eax, pe_nt_image_headers32
push esi
mov esi, dword [esp + 0x2518]
mov word [esp + 4], ax
mov eax, 0x2000
push esi
mov word [esp + 0x510], ax
call sym.test_embusb.exe__sys_error_none_4
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x10c]
push eax
push dword [esp + 0x251c]
call sym.test_embusb.exe__string_pathname_split_12
lea eax, [esp + 0x108]
push eax
push eax
call sym.test_embusb.exe__string_treename_8
lea eax, [esp + 0x50c]
push eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x110]
push eax
call sym.test_embusb.exe__string_pathname_join_12
movzx eax, word [0x42fe0c]
push eax
push 0x42fe08
lea eax, [esp + 0x514]
push eax
call sym.test_embusb.exe__string_appendn_12
lea eax, [esp + 0x50c]
push eax
call sym.test_embusb.exe__string_terminate_null_4
lea eax, [esp + 0x510]
push eax
call sub.KERNEL32.dll_DeleteFileA
test al, al
jne 0x42095d
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0xc], eax
pop esi
add esp, 0x250c
ret 8

Function at 0x420970
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x2008
call fcn.004054e0
push esi
mov esi, dword [esp + 0x2018]
mov eax, 0x2000
push edi
push esi
mov word [esp + 0x10], ax
call sym.test_embusb.exe__sys_error_none_4
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x2018]
call sym.test_embusb.exe__string_copy_8
movzx eax, word [0x42fe14]
push eax
push 0x42fe10
lea eax, [esp + 0x14]
push eax
call sym.test_embusb.exe__string_appendn_12
lea eax, [esp + 0xc]
push eax
call sym.test_embusb.exe__string_terminate_null_4
push dword [0x432000]
lea eax, [esp + 0x14]
push 0x8000080
push 3
push dword [0x431ffc]
push 1
push connect
push eax
call sub.KERNEL32.dll_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x420a03
call sub.KERNEL32.dll_GetLastError
pop edi
mov dword [esi + 0xc], eax
pop esi
add esp, 0x2008
ret 0xc
push dword [0x432004]
movsx eax, word [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
push eax
lea eax, [esp + 0x1c]
push eax
push edi
call sub.KERNEL32.dll_ReadFile
test al, al
jne 0x420a3c
call sub.KERNEL32.dll_GetLastError
push edi
mov dword [esi + 0xc], eax
call fcn.00405e0a
pop edi
pop esi
add esp, 0x2008
ret 0xc
movsx edx, word [esp + 0xc]
mov ecx, dword [esp + 8]
cmp edx, ecx
movzx eax, word [esp + 0xc]
movzx esi, cx
cmovb esi, eax
push edi
mov word [esp + 0x12], si
call fcn.00405e0a
mov edx, dword [esp + 0x2018]
mov cx, word [esp + 0xe]
movzx eax, word [edx]
cmp ax, cx
cwde
jl 0x420a75
movsx eax, cx
movzx eax, ax
mov ecx, 1
movsx esi, ax
mov word [edx + 2], ax
cmp esi, ecx
jl 0x420aaf
mov al, byte [esp + ecx + 0xf]
cmp al, 0x1f
jbe 0x420aa8
cmp al, 0x7f
je 0x420aa8
mov byte [ecx + edx + 3], al
inc ecx
cmp ecx, esi
jle 0x420a88
pop edi
pop esi
add esp, 0x2008
ret 0xc
lea eax, [ecx - 1]
mov word [edx + 2], ax
pop edi
pop esi
add esp, 0x2008
ret 0xc
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40633c
pop dword [ebp - 0x18]
mov eax, 0x40633c
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x749ac291
add dword [ebp - 0x28], 0xd9b782ba
mov dword [ebp - 0x24], 0x7bb0aeae
add dword [ebp - 0x24], 0xb6829d97
mov dword [ebp - 0x20], 0xe81bb479
sub dword [ebp - 0x20], 0x9bcf704b
mov dword [ebp - 0x1c], 0x7497b2e8
sub dword [ebp - 0x1c], 0x7497b2e8
lea eax, [ebp - 0x28]
push eax
mov eax, 0xa03f4c1b
add eax, 0x60012445
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x2e9fb4ea
add dword [ebp - 0x28], 0x45d2b46c
mov dword [ebp - 0x24], 0xd65c6ba3
sub dword [ebp - 0x24], 0x94f00a2e
mov dword [ebp - 0x20], 0xc32a3bb9
sub dword [ebp - 0x20], 0x5fbacf4d
mov dword [ebp - 0x1c], 0x6ee77053
add dword [ebp - 0x1c], 0x91188fad
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xfa941832
add eax, 0x5ac58ce
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x36371
push 0
call eax
mov ecx, 0xab9b4e62
add ecx, 0x5464f801
xor edx, edx
add edx, eax
mov edi, 0x3f1b2d67
add edi, 0xc125d299
add edi, dword [ebp - 0x18]
mov esi, 0xc5b88b5c
sub esi, 0x901eb6f6
xor dword [ebp - 4], 0x67d15abf
mov ebx, dword [edi]
sub dword [ebp - 0xc], 0xd96c8d25
xor ebx, esi
add dword [ebp - 0x14], ecx
mov dword [edx], ebx
mov dword [ebp - 0x10], 0xa54be042
add edx, 4
add edi, 4
loop 0x40645b
add eax, 0xe1da125f
add eax, 0x1e26fa00
mov ebx, eax
add eax, 0xf3eb1264
sub eax, 0xf3eb125f
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x4b1eac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x4b1ebb
pop dword [ebp - 0x50]
mov eax, 0x4b1ebb
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x6741a
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x528e
mov edi, eax
mov ebx, 0x514400
add ebx, dword [ebp - 0x50]
mov edx, 0x5ccba5a4
add edx, 0x9a143caa
add dword [ebp - 0x18], eax
mov esi, dword [ebx]
add dword [ebp - 0x3c], 0xac74184
sub esi, edx
sub dword [ebp - 0x18], ebx
mov dword [edi], esi
xor dword [ebp - 0x30], 0x9adc63e9
add edi, 4
add ebx, 0x5235c78e
add ebx, 0xadca3876
loop 0x4b1f04
add eax, 0xca4b6b63
add eax, 0x35b5d1a8
mov ebx, eax
add eax, 0x2f8d2828
add eax, 0xd072d7dd
mov ecx, 0xc1e38ed8
add ecx, 0x3e5c7128
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4013ff
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 1
mov eax, str.SeDebugPrivilege
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp + 8]
call fcn.00401441
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x401433
push ebx
call fcn.004058de
add esp, 4
mov eax, dword [ebp - 8]
jmp 0x40143b
mov esp, ebp
pop ebp
ret 8