joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cc4c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x50]
push 0x3c
push 0
push eax
mov esi, edx
mov ebx, ecx
or edi, 0x40
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 0x40], eax
xor eax, eax
cmp dword [ebp + 0xc], eax
mov dword [ebp - 0x50], 0x3c
sete al
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x24], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
test esi, esi
je 0x40ccaf
cmp dword [ebp - 0x18], 0
je 0x40ccaf
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [ebp - 0x14], vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
mov word [ebp - 8], ax
mov edx, 0x851
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], str.Param
push eax
push str.HevShellExecuteEx_
push ecx
push 0x64
mov ecx, 0x170b0c6
mov dword [ebp - 0xc], esi
call fcn.00401f81
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc

Function at 0x40e479
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push esi
mov esi, 0x811c9dc5
movzx eax, word [eax]
mov dword [ebp + 8], eax
movzx eax, byte [ebp + edx + 8]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
cmp edx, 2
jb 0x40e48d
mov eax, dword [ecx + 0x18]
and eax, esi
pop esi
pop ebp
ret 4

Function at 0x40ee71
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
mov ecx, 0x811c9dc5
cmp dword [ebp + 8], esi
jbe 0x40ee94
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc esi
cmp esi, dword [ebp + 8]
jb 0x40ee82
mov eax, ecx
pop esi
leave
ret 4

Function at 0x41376f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
and dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
push 0xffff
push edx
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, dword [ebp - 4]
mov ecx, eax
mov edx, dword [ebp + 0xc]
push 2
pop ebx
cmp esi, ebx
jae 0x4137b5
cmp edx, 1
je 0x4137b3
cmp edx, ebx
jne 0x4137b5
mov ecx, ebx
call fcn.00412c07
test eax, eax
jne 0x4137f6
test ecx, ecx
jne 0x4137f6
cmp edx, ebx
je 0x4137cb
cmp edx, 1
jne 0x4137d7
shr esi, 1
xor eax, eax
mov word [edi + esi*2 - 2], ax
mov edx, dword [ebp + 0xc]
movzx eax, byte [ebp + 0x10]
cmp edx, eax
je 0x4137f6
sub edx, 1
je 0x4137f0
sub edx, 1
jne 0x4137f4
cmp eax, 1
jne 0x4137f4
jmp 0x4137f6
cmp eax, ebx
je 0x4137f6
mov ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
leave
ret 0xc
Function at 0x413d2b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
and dword [ebp - 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x18], edx
mov ebx, ecx
mov edi, 0x4356d8
mov cl, byte [edi]
or esi, 0xffffffff
mov edx, ebx
mov dword [ebp - 0xc], esi
call fcn.0041381a
mov dword [ebp - 0x14], eax
cmp eax, esi
je 0x413e4c
push ecx
push 0x45d488
lea ecx, [ebp - 0x34]
call fcn.0040dba0
xor esi, esi
cmp esi, 4
jge 0x413e41
mov edx, dword [ebx + 0x10]
and dword [ebp - 8], 0
push ecx
push dword [ebx + 0x18]
mov byte [ebp - 1], 0
push dword [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00412d9d
lea ecx, [ebp - 8]
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x20]
push eax
call fcn.004148f8
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x413db5
and dword [ebp - 0x24], 0
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0xc], 0
jne 0x413e26
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ecx
push dword [ebp - 0x18]
mov dword [ecx], eax
lea ecx, [ebp - 0x10]
mov eax, dword [ebp - 8]
push ecx
push 0
push dword [ebx]
push dword [eax + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
mov dword [ebp - 0xc], ecx
call fcn.00412c07
test eax, eax
je 0x413df7
mov ecx, dword [ebx + 0x10]
call fcn.00412c23
mov byte [ebp - 1], 1
jmp 0x413e26
test ecx, ecx
jne 0x413e26
movzx ecx, word [ebx + 0x14]
mov eax, ecx
and eax, 0xf
cmp dword [ebp - 0x10], eax
je 0x413e62
cmp dword [ebp - 0x10], 3
jne 0x413e1f
mov eax, dword [ebp + 0xc]
cmp dword [eax], 4
jne 0x413e1f
and cl, 0xf
cmp cl, 4
je 0x413e62
mov dword [ebp - 0xc], 2
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x413e36
and dword [ebp - 8], 0
mov eax, dword [ecx]
call dword [eax + 4]
inc esi
cmp byte [ebp - 1], 0
jne 0x413d6c
lea ecx, [ebp - 0x34]
call fcn.0040db7b
mov esi, dword [ebp - 0xc]
inc edi
cmp edi, 0x4356db
jne 0x413d42
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x413e72
and dword [ebp - 8], 0
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x34]
call fcn.0040db7b
xor eax, eax
jmp 0x413e5b
Function at 0x413fcb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
mov bl, dl
push edi
test esi, esi
je 0x414133
test bl, bl
je 0x413ff4
xor eax, eax
cmp dword [0x45cd78], eax
sete al
jmp 0x41400a
test byte [esi + 0x14], 0x10
jne 0x414008
call fcn.004137ff
test al, al
je 0x414008
xor eax, eax
inc eax
jmp 0x41400a
xor eax, eax
test eax, eax
jne 0x414133
and dword [esp + 0x10], eax
push ecx
push 0x45d488
lea ecx, [esp + 0x44]
call fcn.0040dba0
xor edi, edi
cmp edi, 4
jge 0x41411e
mov edx, dword [esi + 0x10]
xor bh, bh
and dword [esp + 0x14], 0
push ecx
push dword [esi + 0x18]
movzx eax, bl
mov dword [esp + 0x20], eax
shl eax, 5
push eax
push ecx
lea ecx, [esp + 0x34]
call fcn.00412d9d
lea ecx, [esp + 0x14]
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x1c]
push eax
call fcn.004148f8
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x41407f
and dword [esp + 0x28], 0
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [esp + 0x10], 0
je 0x4140d5
test bl, bl
je 0x4140ce
mov eax, dword [esp + 0x18]
mov edx, dword [esi + 0x10]
add eax, eax
push ecx
push dword [esi + 0x18]
push eax
push ecx
lea ecx, [esp + 0x44]
call fcn.00412d9d
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x2c]
push eax
call fcn.004148f8
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x4140ce
and dword [esp + 0x38], 0
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [esp + 0x10], 0
jne 0x414103
mov eax, dword [esp + 0x14]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push dword [esi]
push dword [eax + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
mov dword [esp + 0x10], eax
call fcn.00412c07
test eax, eax
je 0x414103
mov ecx, dword [esi + 0x10]
call fcn.00412c23
mov bh, 1
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x414115
and dword [esp + 0x14], 0
mov eax, dword [ecx]
call dword [eax + 4]
inc edi
test bh, bh
jne 0x414027
cmp dword [esp + 0x10], 0
lea ecx, [esp + 0x3c]
sete bl
call fcn.0040db7b
mov al, bl
jmp 0x414135
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x415944
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
push 0x10
mov esi, ecx
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x415986
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x415986
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x415986
cmp word [eax + 2], 0
je 0x415986
cmp dword [eax + 0x28], 0xfeef04bd
jne 0x415986
add eax, 0x30
jmp 0x41598b
mov eax, 0x435bdc
pop edi
pop esi
ret

Function at 0x415a45
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 4], 0x20a
mov word [eax], dx
lea edx, [ebp - 4]
push edx
push eax
push 0
push 2
push str.mso.dll
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
neg eax
sbb al, al
inc al
leave
ret 8
Function at 0x41755a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x18], 1
xor ebx, ebx
mov dword [ebp - 0x1c], vtable.Mso::Registry::Key.0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x14], ebx
mov esi, edx
mov byte [ebp - 0x10], 1
call fcn.00415bf1
push eax
push ecx
mov ecx, 0x20019
call fcn.00415b9b
pop ecx
push eax
push ebx
push esi
push reloc.AppVIsvSubsystems32.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4175dd
lea eax, [ebp - 8]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0xc], ebx
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 4
push eax
push ebx
push dword [0x435b30]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4175dd
mov eax, dword [ebp - 4]
mov dword [edi], eax
mov byte [edi + 4], 1
jmp 0x4175e2
mov dword [edi], ebx
mov byte [edi + 4], bl
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], vtable.Mso::Registry::Key.0
call fcn.00415c07
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41b394
Capabilities:
Get thread local storage value

Disassembly:
push 8
mov eax, 0x43030f
call fcn.0042ece7
cmp byte [0x45c4dc], 0
push dword [0x45c4d8]
je 0x41b3b7
call dword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x41b3bd
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x41b406
push 0x14
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x41b40e
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [ebp - 4], edi
push 8
pop ecx
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
call fcn.0040a8c8
mov dword [esi], eax
push esi
mov dword [eax], edi
mov dword [eax + 4], edi
mov ecx, dword [esi]
mov dword [ecx], esi
mov ecx, 0x45c4d8
call fcn.0041846a
mov eax, esi
call fcn.0042ecc5
ret
call fcn.0042d1f4
int3

Function at 0x41f9e5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, ecx
push eax
push 0x20019
push 0
push str.CLSID
push Ordinal_1
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x41fa7c
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push ebx
push dword [ebp - 8]
call edi
test eax, eax
jne 0x41fa71
push 4
pop edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push str.InsecureQI
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41fa71
cmp dword [ebp - 0xc], edi
jne 0x41fa71
mov edi, dword [ebp - 0x10]
cmp edi, 3
ja 0x41fa71
cmp dword [ebp - 4], eax
je 0x41fa7e
push dword [ebp - 4]
call esi
jmp 0x41fa7e
cmp dword [ebp - 4], 0
je 0x41fa7c
push dword [ebp - 4]
call esi
xor edi, edi
cmp dword [ebp - 8], 0
je 0x41fa89
push dword [ebp - 8]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41fd5c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [0x45d874], 0
je 0x41fd71
mov eax, dword [0x45d878]
leave
ret
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwarePoliciesMicrosoftSecurity
push reloc.AppVIsvSubsystems32.dll_Ordinal_1
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41fdbf
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x45d878
push esi
push esi
push str.CLSIDInterfaceTest
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41fdbf
cmp dword [ebp - 8], 4
je 0x41fe18
mov eax, dword [ebp - 4]
mov dword [ebp - 4], esi
test eax, eax
je 0x41fdd0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftSecurity
push reloc.AppVIsvSubsystems32.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41fe20
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x45d878
push esi
push esi
push str.CLSIDInterfaceTest
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41fe20
cmp dword [ebp - 8], 4
jne 0x41fe20
mov esi, dword [0x45d878]
jmp 0x41fe26
mov dword [0x45d878], esi
cmp dword [ebp - 4], 0
mov byte [0x45d874], 1
je 0x41fe3c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x420028
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp byte [0x45c544], 0
push dword [0x45c540]
je 0x420045
call dword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x42004b
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
push edi
test eax, eax
je 0x420062
cmp dword [eax + 0x10], 0
je 0x420062
mov ecx, eax
call fcn.0041ffdd
mov esi, eax
jmp 0x42006e
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
lea esi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
leave
ret 4

Function at 0x425eab
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42fb98
mov eax, dword fs:[0]
push eax
mov eax, dword [0x45b070]
push ecx
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ecx + 0x100]
push eax
lea eax, [ecx + 0xe0]
push eax
lea eax, [ecx + 0xc4]
push eax
push ecx
push ecx
lea eax, [ecx + 0xa8]
push eax
lea eax, [ecx + 0x98]
push eax
lea eax, [ecx + 0x78]
push eax
lea eax, [ecx + 0x68]
push eax
lea eax, [ecx + 0x60]
push eax
lea eax, [ecx + 0x48]
push eax
lea eax, [ecx + 0x30]
push eax
lea eax, [ecx + 0x18]
lea edx, [ecx + 0x10]
mov ecx, dword [ebp + 8]
push eax
call fcn.00425a23
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret 4
Function at 0x412c2c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00407610
mov eax, dword [0x427040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00411873
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x412c6e
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x412dca
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0041c000
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0xe98058]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.00413c29
mov ecx, dword [esi*4 + 0xe98058]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x412dc3
cmp eax, dword [ecx + edi + 0x24]
jne 0x412dc3
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x412dc3
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00413c29
add esp, 0x14
test edx, edx
jl 0x412dc3
jg 0x412d39
test eax, eax
jb 0x412dc3
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x412dc3
jl 0x412d53
cmp dword [ebp - 0x1008], eax
ja 0x412dc3
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x412d71
test ebx, ebx
je 0x412daa
cmp ecx, edi
jae 0x412daa
mov al, byte [ecx]
cmp al, 0xd
jne 0x412d8b
lea eax, [edi - 1]
cmp ecx, eax
jae 0x412d97
cmp byte [ecx + 1], 0xa
jne 0x412d97
inc ecx
jmp 0x412d97
movzx eax, al
movsx eax, byte [eax + 0x4272f8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x412d71
cmp edx, ebx
jne 0x412d71
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x412dc8
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00406931
leave
ret
Function at 0x4130c1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0xe98058]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x413101
cmp byte [ebx], 0xa
jne 0x413101
or byte [edi + eax + 0x28], 4
jmp 0x413106
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x413205
mov dl, byte [eax]
cmp dl, 0x1a
je 0x4131e8
inc eax
cmp dl, 0xd
je 0x413132
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x413158
cmp eax, ecx
jae 0x413166
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x41311a
jmp 0x413205
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4131e3
cmp dword [ebp - 0x10], 0
je 0x4131e3
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0xe98058]
test byte [eax + edi + 0x28], 0x48
je 0x4131bd
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4131a8
mov byte [esi], dl
jmp 0x4131b9
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0xe98058]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x413205
cmp byte [ebp - 1], 0xa
jne 0x4131cc
cmp esi, ebx
jne 0x4131cc
mov byte [esi], 0xa
jmp 0x413204
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00413c47
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x413205
mov byte [esi], 0xd
jmp 0x413204
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0xe98058]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x413202
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x413205
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41320e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0xe98058]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x413254
cmp word [ebx], dx
jne 0x413254
or byte [eax + edi + 0x28], 4
jmp 0x413259
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x4133bc
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x41339c
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x41329a
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4132d0
cmp eax, edx
jae 0x4132de
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x413275
jmp 0x4133bc
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x413397
cmp dword [ebp - 0x18], 0
je 0x413397
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0xe98058]
test byte [eax + edi + 0x28], 0x48
je 0x41336d
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x413331
mov word [esi], cx
jmp 0x413368
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0xe98058]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0xe98058]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0xe98058]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x4133bc
pop eax
cmp word [ebp - 4], ax
jne 0x41337d
cmp esi, ebx
jne 0x41337d
mov word [esi], ax
jmp 0x4133b9
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00413c47
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x4133bc
push 0xd
pop eax
jmp 0x413378
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0xe98058]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x4133b6
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x4133bc
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x402d82
Capabilities:
Create pipe
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x2481a44]
mov ecx, dword [0x24814d4]
sub esp, 0xc04
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x402e5c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
mov ebx, ecx
mov dword [esp + 0xc], eax
cmp dword [0x2481a44], 0x959
jne 0x402e49
push esi
lea eax, [esp + 0x14]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push 0x4029e0
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
lea eax, [esp + 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push esi
push esi
call edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
push esi
call edi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
lea eax, [esp + 0x814]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
call fcn.00402b67
add ebx, 8
dec dword [esp + 0xc]
jne 0x402db5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret