joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405c54
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x405ca9
push dword [esp + 0x10]
push 0x405bd3
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [0x45a23c]
test esi, esi
je 0x405d02
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x405ca1
cmp byte [esi + 0x10], 0
je 0x405ca1
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x405c7d
jmp 0x405d02
mov esi, dword [0x45a23c]
test esi, esi
je 0x405d02
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x405cfb
cmp byte [esi + 0x11], 0
je 0x405cd7
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x405cee
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebp
push 0x45a23c
call fcn.0041220e
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x405cb6
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x405e28
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x45a46c]
call fcn.00411a3b
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x405f28
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x405e7e
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x405e76
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x405ebe
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x405f00
push 0x22
pop edx
cmp cx, dx
je 0x405eb0
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x405ea0
xor ecx, ecx
cmp word [eax], cx
je 0x405f00
mov ecx, eax
add eax, 2
jmp 0x405f02
test dx, dx
je 0x405f08
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x405eb0
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x405ef6
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x405f00
cmp cx, dx
je 0x405ef3
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x405ee3
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x405ec8
jmp 0x405eb0
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x405f0a
xor edx, edx
cmp dword [ebp], ebx
jne 0x405f13
test edi, edi
jne 0x405f30
test edx, edx
je 0x405f18
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x405e6c
test edi, edi
jne 0x405f41
mov eax, ebx
jmp 0x405f45
test esi, esi
je 0x405f41
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x405f45
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x409356
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0x45a4c8]
call fcn.00411aa4
mov ebx, eax
test ebx, ebx
je 0x4093ba
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x40937f
push dword [esp + 0xc]
push ebx
call eax
jmp 0x4093ba
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.00412510
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
sub edi, eax
push edi
call fcn.00412600
pop edi
pop esi
pop ebx
ret 8

Function at 0x40968c
Capabilities:
Check os version

Disassembly:
sub esp, 0x350
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x114
xor ebx, ebx
mov esi, 0xc8
and dword [esp + 0x10], ebx
xor edi, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x409802
mov eax, dword [esp + 0x24]
dec eax
je 0x4097e5
dec eax
jne 0x409802
lea eax, [esp + 0x128]
xor ebp, ebp
push eax
call fcn.00409645
pop ecx
test eax, eax
je 0x409743
mov ebx, dword [esp + 0x12c]
mov edi, dword [esp + 0x130]
mov eax, dword [esp + 0x134]
cmp byte [esp + 0x242], 1
jne 0x409706
xor ebp, ebp
inc ebp
sub ebx, 3
je 0x4097e1
dec ebx
je 0x4097dd
dec ebx
je 0x4097bc
dec ebx
je 0x409776
sub ebx, 4
jne 0x409802
test edi, edi
jne 0x409802
cmp eax, 0x55f0
sbb esi, esi
and esi, 0xfffffff6
add esi, 0x78
jmp 0x409802
lea eax, [esp + 0x244]
mov dword [esp + 0x244], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, dword [esp + 0x10]
je 0x409706
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
cmp byte [esp + 0x35e], 1
jmp 0x409701
sub edi, 0
je 0x4097ae
dec edi
je 0x4097a0
dec edi
je 0x409792
dec edi
jne 0x409802
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x69
jmp 0x409802
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x5f
jmp 0x409802
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x55
jmp 0x409802
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
jmp 0x409802
sub edi, 0
je 0x4097d9
dec edi
je 0x4097d5
dec edi
jne 0x409802
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x409802
push 0x3c
jmp 0x409801
push 0x32
jmp 0x409801
push 0x14
jmp 0x409801
push 5
jmp 0x409801
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4097ff
cmp eax, 0xa
je 0x4097fb
cmp eax, 0x5a
jne 0x409802
push 0x28
jmp 0x409801
push 0x1e
jmp 0x409801
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret
Function at 0x40aab9
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push str.PB_WindowID
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x40ab51
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x40ab4e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x40ab4e
lea eax, [esi - 1]
push eax
push dword [0x45a4d4]
call fcn.00411aa4
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x40ab50
mov edx, dword [edi + 4]
xor ecx, ecx
pop esi
cmp word [ecx + edx + 2], si
jne 0x40ab45
mov esi, 0xfa01
push 9
cmp word [ecx + edx + 4], si
je 0x40ac38
pop esi
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x40ab2b
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x40abf7
push eax
call esi
test al, al
jns 0x40abf7
push 0x11
call esi
test al, al
js 0x40abf7
push 0x10
call esi
test al, al
js 0x40abf7
push 0x12
call esi
test al, al
js 0x40abf7
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x40abf7
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x40abcb
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x40abe2
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x40ac42
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x40ac42
test ebp, ebp
je 0x40ac1b
push 0x11
call esi
test al, al
js 0x40ac13
push 0x10
call esi
test al, al
js 0x40ac13
push 0x12
call esi
test al, al
jns 0x40ac1b
push 1
push ebp
call fcn.0040ac4e
test ebx, ebx
je 0x40ac2f
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x40ac42
test edi, edi
je 0x40ac42
mov eax, dword [edi + 8]
jmp 0x40ac44
and dword [esp + 0x14], 0
jmp 0x40ab50
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x40aee9
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x40b031
xor ecx, ecx
cmp word [eax], cx
je 0x40b031
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x40af42
cmp eax, 3
jne 0x40af7c
cmp word [esp + 0xa], 0x3a
jne 0x40af7c
cmp eax, 2
jne 0x40af60
lea eax, [esp + 8]
push 0x44e2f0
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x40b031
push 0xfffffffffffffffe
pop edi
jmp 0x40b031
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x40af91
cmp ax, bx
jne 0x40af9b
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x40af84
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x40afda
test byte [esp + 0x21c], 0x10
je 0x40afc1
push 0xfffffffffffffffe
pop edi
jmp 0x40afd1
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40b02f
cmp word [esp + 0x10], bp
jne 0x40afe8
cmp word [esp + 0x12], bp
je 0x40b007
cmp word [esp + 0x10], bx
jne 0x40aff6
cmp word [esp + 0x12], bx
je 0x40b007
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x40b02f
cmp word [esp + 0x12], ax
jne 0x40b02f
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x40b01c
test al, 0x10
je 0x40b02f
jmp 0x40b02c
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x40b02f
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4

Function at 0x40c6e8
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
push esi
push edi
xor edi, edi
push edi
push pe_nt_image_headers32
push 3
push edi
push 1
push 0x80000000
push dword [esp + 0x2c]
mov ebp, edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40c76c
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
push edi
push dword [0x45a078]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40c764
push ebp
lea eax, [esp + 0x1c]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40c755
cmp dword [esp + 0x18], ebx
jne 0x40c755
push ebx
push edi
push dword [esp + 0x1c]
call fcn.0040c86f
mov ebp, eax
push edi
push 0
push dword [0x45a078]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
ret 0xc
Function at 0x40d6ec
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x45a38c], eax
test eax, eax
je 0x40d71a
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x45a388], eax
lea eax, [ebp - 0x114]
mov dword [0x45a390], 1
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40d77c
cmp dword [ebp - 0x104], 1
jne 0x40d751
and dword [0x45a390], 0
jmp 0x40d794
cmp dword [ebp - 0x104], 2
jne 0x40d77c
cmp dword [ebp - 0x110], 5
jb 0x40d748
jne 0x40d77c
mov eax, dword [ebp - 0x10c]
neg eax
sbb eax, eax
and eax, dword [0x45a390]
mov dword [0x45a390], eax
jmp 0x40d781
mov eax, dword [0x45a390]
test eax, eax
je 0x40d794
call fcn.0040d4e6
neg eax
sbb eax, eax
and dword [0x45a390], eax
mov esp, ebp
pop ebp
ret

Function at 0x40e630
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x40e662
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40e65d
cmp dword [esp + 0xc], esi
je 0x40e679
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret

Function at 0x41a350
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x41a370
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x41a370
mov eax, dword [eax + 0x44]
test eax, eax
je 0x41a370
push dword [esp + 8]
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x42b1b0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x42b1df
push esi
call fcn.0042b390
add esp, 4
cmp byte [esi + 0x40], 0
je 0x42b1d8
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
push edi
cmp eax, 0xcb
jne 0x42b262
mov eax, dword [esi + 0x1a8]
cmp byte [eax + 0x10], 0
je 0x42b24d
mov eax, dword [esi + 8]
test eax, eax
je 0x42b205
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x1a8]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x42b248
cmp eax, 2
je 0x42b24d
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x42b1f6
cmp eax, 3
je 0x42b22d
cmp eax, 1
jne 0x42b1f6
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x42b1f6
mov eax, dword [esi + 0x128]
add eax, edi
mov dword [edx + 8], eax
jmp 0x42b1f6
pop edi
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.0042b290
add esp, 4
pop edi
pop esi
ret
cmp eax, 0xcc
je 0x42b284
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x15
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
push esi
call fcn.0042b290
add esp, 4
pop edi
pop esi
ret

Function at 0x42b290
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0xcc
je 0x42b2bc
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [esi + 0x78], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
je 0x42b342
lea ebx, [esi + 0x78]
jmp 0x42b2d0
mov eax, dword [ebx]
cmp eax, dword [esi + 0x60]
jae 0x42b316
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x42b2f5
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [esi + 0x19c]
mov edi, dword [ebx]
push 0
push ebx
mov eax, dword [eax + 4]
push 0
push esi
call eax
mov eax, dword [ebx]
add esp, 0x10
cmp eax, edi
je 0x42b358
cmp eax, dword [esi + 0x60]
jb 0x42b2d7
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
add esp, 8
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
jne 0x42b2d0
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebx
ret
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x42c4d0
Capabilities:
Query environment variable

Disassembly:
push ecx
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
mov dword [edi + 4], 0
call fcn.004386f0
push 0x54
push edi
mov dword [esp + 0x14], eax
call fcn.004386c0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x42c517
push edi
call fcn.00438700
mov ecx, dword [edi]
push edi
mov dword [ecx + 0x14], 0x38
mov ecx, dword [edi]
mov dword [ecx + 0x18], esi
mov eax, dword [edi]
mov eax, dword [eax]
call eax
add esp, 8
mov dword [esi], fcn.0042c160
mov dword [esi + 4], fcn.0042bff0
mov dword [esi + 8], fcn.0042c0c0
mov dword [esi + 0xc], fcn.0042bf40
mov dword [esi + 0x10], 0x42c830
mov dword [esi + 0x14], 0x42c7c0
mov dword [esi + 0x18], 0x42c620
mov dword [esi + 0x1c], 0x42bdf0
mov dword [esi + 0x20], 0x42bca0
mov dword [esi + 0x24], 0x42c3d0
mov dword [esi + 0x28], 0x42c8a0
mov dword [esi + 0x30], 0x3b9aca00
mov eax, dword [esp + 8]
mov dword [esi + 0x2c], eax
mov dword [esi + 0x38], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x54
push str.JPEGMEM
mov dword [edi + 4], esi
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
test eax, eax
je 0x42c5fa
lea ecx, [esp + 0x10]
mov byte [esp + 0x10], 0x78
push ecx
lea ecx, [esp + 0xc]
push ecx
push str._ld_c
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0x10
test eax, eax
jle 0x42c5fa
mov al, byte [esp + 0x10]
cmp al, 0x6d
je 0x42c5e9
cmp al, 0x4d
mov eax, dword [esp + 8]
jne 0x42c5f1
imul eax, dword [esp + 8], 0x3e8
imul eax, eax, 0x3e8
mov dword [esi + 0x2c], eax
pop edi
pop esi
pop ecx
ret
Function at 0x42fdc0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
cmp dword [ebp + 0x4c], 1
mov ebx, dword [ebp + 0x1c0]
mov dword [esp + 0x1c], ebx
jne 0x42fde5
mov esi, 0x1fe
mov byte [ebx + 0x1c], 1
jmp 0x42fdeb
xor esi, esi
mov byte [ebx + 0x1c], 0
push dword [ebp + 0x64]
mov ecx, dword [ebp + 4]
lea eax, [esi + 0x100]
push eax
push 1
push ebp
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], esi
call eax
xor ecx, ecx
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x14]
add esp, 0x10
mov dword [esp + 0x14], ecx
cmp dword [ebp + 0x64], ecx
jle 0x42ff00
push edi
lea ecx, [ecx]
mov edi, dword [ebx + ecx*4 + 0x20]
cdq
idiv edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], eax
test esi, esi
je 0x42fe3d
mov eax, dword [ebx + 0x18]
add dword [eax + ecx*4], 0xff
mov eax, dword [ebx + 0x18]
xor ebx, ebx
mov ebp, dword [eax + ecx*4]
lea eax, [edi + 0xfe]
lea ecx, [edi*2 - 2]
cdq
idiv ecx
xor esi, esi
mov edx, eax
lea esp, [esp]
cmp esi, edx
jle 0x42fe96
mov ecx, dword [esp + 0x10]
lea edi, [edi*2 - 2]
imul eax, ebx, 0x1fe
add ecx, 0xfe
add ecx, eax
lea ecx, [ecx]
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x42fe80
mov edi, dword [esp + 0x10]
mov al, byte [esp + 0x1c]
imul bl
mov byte [esi + ebp], al
inc esi
cmp esi, 0xff
jle 0x42fe60
mov esi, dword [esp + 0x14]
test esi, esi
je 0x42fee1
mov ecx, 1
lea edx, [ebp - 1]
jmp 0x42fec0
movzx eax, byte [ebp]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebp + 0xff]
mov byte [ecx + ebp + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x42fec0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, dword [eax + 0x64]
mov eax, dword [esp + 0x1c]
jl 0x42fe20
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4448a0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [ebx + 0x48]
mov eax, dword [edi + 0x18]
cmp eax, 0xc
jle 0x4448bd
pop edi
mov dword [ebx + 0x40], 0x70
xor eax, eax
pop ebx
ret
push ebp
push esi
cmp dword [edi + 0x2c], eax
jge 0x444981
lea esi, [edi + 0x44]
jmp 0x4448d0
mov dl, byte [esi]
test dl, dl
jne 0x444955
mov ecx, dword [ebx + 0x48]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x4448eb
push 1
push esi
push ebx
call eax
add esp, 0xc
jmp 0x4448fc
push dword [ecx + 0x38]
push 1
push 1
push esi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x4449dc
mov al, byte [esi]
test al, al
je 0x4449ce
mov edx, dword [ebx + 0x48]
lea ebp, [esi + 1]
movzx eax, al
mov ecx, dword [edx + 0x3c]
test ecx, ecx
je 0x444929
push eax
push ebp
push ebx
call ecx
add esp, 0xc
jmp 0x444939
push dword [edx + 0x38]
push eax
push 1
push ebp
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov cl, byte [esi]
mov edx, eax
movzx eax, cl
cmp edx, eax
jne 0x4449dc
mov al, byte [ebp]
dec cl
mov byte [ebp], 2
mov byte [esi], cl
jmp 0x444967
mov cl, byte [esi + 1]
movzx eax, cl
inc cl
dec dl
mov al, byte [eax + esi]
mov byte [esi + 1], cl
mov byte [esi], dl
mov ecx, dword [edi + 0x2c]
movzx eax, al
shl eax, cl
or dword [edi + 0x30], eax
lea eax, [ecx + 8]
mov dword [edi + 0x2c], eax
cmp eax, dword [edi + 0x18]
jl 0x4448d0
mov eax, dword [edi + 0x18]
movzx ecx, word [eax*2 + 0x453718]
mov eax, dword [esp + 0x18]
and ecx, dword [edi + 0x30]
mov dword [eax], ecx
mov ecx, dword [edi + 0x18]
shr dword [edi + 0x30], cl
sub dword [edi + 0x2c], ecx
mov eax, dword [edi + 0x14]
cmp eax, 0x1001
jge 0x4449c4
mov edx, dword [edi + 0x1c]
inc eax
mov dword [edi + 0x14], eax
cmp eax, edx
jle 0x4449c4
cmp ecx, 0xc
jge 0x4449c4
lea eax, [edx + edx]
mov dword [edi + 0x1c], eax
lea eax, [ecx + 1]
mov dword [edi + 0x18], eax
pop esi
pop ebp
pop edi
mov eax, 1
pop ebx
ret
pop esi
pop ebp
pop edi
mov dword [ebx + 0x40], 0x70
xor eax, eax
pop ebx
ret
pop esi
pop ebp
pop edi
mov dword [ebx + 0x40], 0x66
xor eax, eax
pop ebx
ret
Function at 0x444cb0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esi + 0x48]
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x444ccf
push 1
lea ecx, [esp + 0x10]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x444ce4
push dword [edi + 0x38]
lea eax, [esp + 0x10]
push 1
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x444d3b
mov cl, byte [esp + 0xc]
test cl, cl
je 0x444d47
mov edx, dword [esp + 0x10]
lea eax, [edi + 0x44]
mov dword [edx], eax
mov byte [eax], cl
mov eax, dword [esi + 0x48]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x444d18
movzx eax, byte [esp + 0xc]
push eax
mov eax, dword [edx]
inc eax
push eax
push esi
call ecx
add esp, 0xc
jmp 0x444d30
push dword [eax + 0x38]
movzx eax, byte [esp + 0x10]
push eax
mov eax, dword [edx]
inc eax
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov ecx, eax
movzx eax, byte [esp + 0xc]
cmp ecx, eax
je 0x444d5c
pop edi
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
ret
mov eax, dword [esp + 0x10]
mov dword [eax], 0
mov byte [edi + 0x44], 0
mov dword [edi + 0x34], 0
pop edi
mov eax, 1
pop esi
ret

Function at 0x444d70
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esi + 0x48]
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x444d8f
push 1
lea ecx, [esp + 0x10]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x444da4
push dword [edi + 0x38]
lea eax, [esp + 0x10]
push 1
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x444dfb
mov cl, byte [esp + 0xc]
test cl, cl
je 0x444e07
mov edx, dword [esp + 0x10]
lea eax, [edi + 0x44]
mov dword [edx], eax
mov byte [eax], cl
mov eax, dword [esi + 0x48]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x444dd8
movzx eax, byte [esp + 0xc]
push eax
mov eax, dword [edx]
inc eax
push eax
push esi
call ecx
add esp, 0xc
jmp 0x444df0
push dword [eax + 0x38]
movzx eax, byte [esp + 0x10]
push eax
mov eax, dword [edx]
inc eax
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov ecx, eax
movzx eax, byte [esp + 0xc]
cmp ecx, eax
je 0x444e11
pop edi
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
ret
mov eax, dword [esp + 0x10]
mov dword [eax], 0
pop edi
mov eax, 1
pop esi
ret
Function at 0x445160
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x48]
test byte [eax], 8
jne 0x445178
mov dword [esi + 0x40], 0x6f
xor eax, eax
pop esi
ret
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x44518e
push 1
lea eax, [esp + 0xc]
push eax
push esi
call ecx
add esp, 0xc
jmp 0x4451a3
push dword [eax + 0x38]
lea eax, [esp + 0xc]
push 1
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x4451b3
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
ret
mov al, byte [esp + 8]
cmp al, 0x21
je 0x4451f6
cmp al, 0x2c
je 0x4451e5
cmp al, 0x3b
mov eax, dword [esp + 0xc]
je 0x4451d8
mov dword [eax], 0
xor eax, eax
mov dword [esi + 0x40], 0x6b
pop esi
ret
mov dword [eax], 4
mov eax, 1
pop esi
ret
mov eax, dword [esp + 0xc]
pop esi
mov dword [eax], 2
mov eax, 1
ret
mov eax, dword [esp + 0xc]
pop esi
mov dword [eax], 3
mov eax, 1
ret