joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4035e0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov bl, dl
push edi
mov edi, ecx
push edi
call esi
cmp eax, 0xffffffff
jne 0x403602
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
test bl, bl
jne 0x403638
push edi
call esi
cmp eax, 0xffffffff
je 0x403625
test al, 0x10
je 0x403625
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
test eax, eax
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
test eax, eax
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, edi
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x403640
sub esi, ecx
add esi, 0x17
lea eax, [esi + 0x10]
push eax
call fcn.0044ecb6
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
add esp, 4
mov dword [eax], esi
mov eax, dword [ebp - 4]
push 0x15
push str.cmd.exe__c_rd__s__q__
mov dword [eax + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 1
call fcn.00401a60
mov edx, edi
lea esi, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x403685
sub edx, esi
mov ecx, eax
push edx
push edi
call fcn.00401a60
mov esi, eax
mov ecx, dword [esi]
test ecx, ecx
je 0x4036b9
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
inc ecx
cmp eax, ecx
jae 0x4036dd
lea eax, [eax + eax*2]
mov ecx, esi
shr eax, 1
inc eax
push eax
call fcn.004019f0
jmp 0x4036dd
push 0x20
call fcn.0044ecb6
mov dword [esi], eax
add esp, 4
mov dword [eax], 0x10
mov eax, dword [esi]
mov dword [eax + 4], 0
mov eax, dword [esi]
mov dword [eax + 8], 1
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
mov byte [eax + ecx + 0x10], 0x22
lea ecx, [ebp - 4]
mov eax, dword [esi]
inc dword [eax + 4]
call fcn.004039a0
cmp eax, 0xffffffff
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x403718
add eax, 8
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x403718
push dword [ebp - 4]
call fcn.0044ec66
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4039a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
mov esi, ecx
mov dword [ebp - 0x40], 0x3c
xorps xmm0, xmm0
mov dword [ebp - 0x3c], 0x40
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0x14], xmm0
mov eax, dword [esi]
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], str.open
mov dword [ebp - 0x30], str.cmd.exe
test eax, eax
je 0x403a04
mov eax, dword [eax + 4]
inc eax
push eax
call fcn.004019f0
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
cmp byte [eax + ecx + 0x10], 0
je 0x403a01
mov byte [eax + ecx + 0x10], 0
mov ecx, dword [esi]
lea esi, [ecx + 0x10]
mov eax, dword [0x47ecd8]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
push 0xffffffffffffffff
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403b40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0xc]
test esi, esi
je 0x403b97
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x403b97
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x403b7f
push 0
lea edx, [ebp - 4]
mov dword [ebp - 4], 0
push edx
push ecx
push dword [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, dword [edi + 0xc]
mov dword [edi + 4], 0
test esi, esi
je 0x403b97
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x403b97
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0xffffffff
mov esi, dword [edi + 0xc]
test esi, esi
je 0x403bf0
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x403bb5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0xffffffff
mov esi, dword [edi + 0xc]
test esi, esi
je 0x403be9
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x403bde
add ecx, 8
or eax, 0xffffffff
lock xadd dword [ecx], eax
jne 0x403bd7
push dword [esi + 4]
call fcn.0044ec66
add esp, 4
mov dword [esi + 4], 0
push 8
push esi
call fcn.00414d4e
add esp, 8
mov dword [edi + 0xc], 0
mov eax, dword [edi + 8]
pop edi
pop esi
test eax, eax
je 0x403c02
push eax
call fcn.0044ec66
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x403c10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0xc]
test esi, esi
je 0x403c67
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x403c67
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x403c4f
push 0
lea edx, [ebp - 4]
mov dword [ebp - 4], 0
push edx
push ecx
push dword [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, dword [edi + 0xc]
mov dword [edi + 4], 0
test esi, esi
je 0x403c67
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x403c67
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0xffffffff
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x403c70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [esi + 4]
mov edx, ebx
mov ecx, dword [esi]
lea eax, [ebx + edi]
cmp ecx, eax
jae 0x403cb8
test ebx, ebx
je 0x403cb8
push 0
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push eax
mov eax, dword [esi + 0xc]
push ebx
push dword [esi + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [eax]
call ebx
mov ecx, dword [esi]
xor edx, edx
mov dword [esi + 4], 0
jmp 0x403cbe
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp edi, ecx
ja 0x403d06
lea eax, [edx + edi]
cmp ecx, eax
jae 0x403ce8
lea ebx, [ecx + ecx*2]
shr ebx, 1
add ebx, edi
cmp ecx, ebx
jae 0x403ce8
push ebx
push dword [esi + 8]
call fcn.0044ec0e
mov edx, dword [esi + 4]
add esp, 8
mov dword [esi + 8], eax
mov dword [esi], ebx
mov eax, dword [esi + 8]
push edi
push dword [ebp + 8]
add eax, edx
push eax
call fcn.0044cb90
add esp, 0xc
mov eax, esi
add dword [esi + 4], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
push 0
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push eax
mov eax, dword [esi + 0xc]
push edi
push dword [ebp + 8]
push dword [eax]
call ebx
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x403dc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x467800
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x47d00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov esi, dword [eax + 4]
mov ebx, esi
mov ecx, dword [esi + 4]
mov edx, dword [esi]
lea eax, [ecx + 1]
cmp edx, eax
jae 0x403e28
lea edi, [edx + edx*2]
shr edi, 1
inc edi
cmp edx, edi
jae 0x403e28
push edi
push dword [esi + 8]
call fcn.0044ec0e
mov edx, dword [ebp - 0x10]
add esp, 8
mov ecx, dword [esi + 4]
mov dword [esi + 8], eax
mov dword [esi], edi
mov ebx, dword [edx + 4]
jmp 0x403e2b
mov edx, dword [ebp - 0x10]
mov eax, dword [esi + 8]
mov byte [ecx + eax], 0xa
inc dword [esi + 4]
mov eax, dword [0x488978]
cmp eax, dword [edx + 8]
jle 0x403e79
push 0x488978
call fcn.004149ad
add esp, 4
cmp dword [0x488978], 0xffffffff
jne 0x403e79
push 0x468000
mov dword [0x488974], 0
call fcn.00414d09
push 0x488978
call fcn.00414963
add esp, 8
mov eax, dword [0x488974]
test eax, eax
je 0x403e87
cmp dword [eax], 0xffffffff
jne 0x403e96
mov ecx, 0x488974
call fcn.004027f0
mov eax, dword [0x488974]
push 0
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push ecx
push dword [ebx + 4]
push dword [ebx + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404a40
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x467880
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x47d00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
call dword [eax + 0x18]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov byte [ebp - 0x11], 0
mov eax, dword [esi]
test eax, eax
jne 0x404a8d
mov eax, esi
jmp 0x404aaf
mov eax, dword [eax + 4]
mov ecx, esi
inc eax
push eax
call fcn.004019f0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
cmp byte [ecx + eax + 0x10], 0
je 0x404aac
mov byte [ecx + eax + 0x10], 0
mov eax, dword [esi]
add eax, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x404aea
mov eax, dword [esi]
mov ecx, esi
test eax, eax
je 0x404ae3
mov eax, dword [eax + 4]
inc eax
push eax
call fcn.004019f0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
cmp byte [ecx + eax + 0x10], 0
je 0x404ae0
mov byte [ecx + eax + 0x10], 0
mov eax, dword [esi]
lea ecx, [eax + 0x10]
xor dl, dl
call fcn.004035e0
mov eax, dword [esi]
test eax, eax
jne 0x404af4
mov eax, esi
jmp 0x404b16
mov eax, dword [eax + 4]
mov ecx, esi
inc eax
push eax
call fcn.004019f0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
cmp byte [ecx + eax + 0x10], 0
je 0x404b13
mov byte [ecx + eax + 0x10], 0
mov eax, dword [esi]
add eax, 0x10
push 0x77
lea ebx, [edi + 0x14]
push eax
mov ecx, ebx
call fcn.00403790
mov eax, dword [ebx]
test eax, eax
je 0x404bdc
cmp dword [eax], 0xffffffff
je 0x404bdc
mov eax, dword [edi]
mov ecx, edi
push 0
push dword [ebp + 8]
mov dword [edi + 4], 0
mov eax, dword [eax + 0xc]
call eax
mov bl, al
jmp 0x404b81
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0x18]
test bl, bl
jne 0x404bc0
mov eax, dword [esi]
test eax, eax
je 0x404bb9
mov eax, dword [eax + 4]
mov ecx, esi
inc eax
push eax
call fcn.004019f0
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
cmp byte [eax + ecx + 0x10], bl
je 0x404bb6
mov byte [eax + ecx + 0x10], bl
mov ecx, dword [esi]
lea esi, [ecx + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x47b71c
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 8
push eax
call fcn.0044c78e
int3
Function at 0x404cd0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4678bd
mov eax, dword fs:[0]
push eax
sub esp, 0x1a0
mov eax, dword [0x47d00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor esi, esi
sub edx, esi
je 0x404e23
sub edx, 1
je 0x404d9f
sub edx, 1
jne 0x404ef0
push 0x38
call fcn.00414d1e
mov esi, eax
add esp, 4
mov dword [ebp - 0x1a4], esi
mov dword [esi], vtable.HttpBase.0
mov dword [esi + 4], 0xffffffff
push 0x2000
mov dword [esi + 8], 0x2000
mov dword [esi + 0xc], 0
call fcn.0044ecb6
mov dword [esi + 0x10], eax
add esp, 4
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi], vtable.WininetHttp.0
mov byte [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
jmp 0x404ef0
push 0x2c
call fcn.00414d1e
mov esi, eax
add esp, 4
mov dword [ebp - 0x1a4], esi
mov dword [esi], vtable.HttpBase.0
mov dword [esi + 4], 0xffffffff
push 0x2000
mov dword [esi + 8], 0x2000
mov dword [esi + 0xc], 0
call fcn.0044ecb6
mov dword [esi + 0x10], eax
add esp, 4
mov dword [esi + 0x14], 0
lea eax, [ebp - 0x1a0]
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
push eax
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
push 0x202
mov dword [esi], vtable.SocketHttp.0
mov dword [esi + 0x28], 0xffffffff
call dword [sym.imp.WS2_32.dll_WSAStartup]
jmp 0x404ef0
push 0x40
call fcn.00414d1e
mov esi, eax
add esp, 4
mov dword [ebp - 0x1a8], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.HttpBase.0
mov dword [esi + 4], 0xffffffff
push 0x2000
mov dword [esi + 8], 0x2000
mov dword [esi + 0xc], 0
call fcn.0044ecb6
mov dword [esi + 0x10], eax
add esp, 4
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov byte [ebp - 4], 1
cmp dword [0x47ed14], 0
mov dword [esi], vtable.CurlHttp.0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
jle 0x404ed4
call fcn.00415900
inc dword [0x47ed14]
jmp 0x404eed
push 3
call fcn.004159d0
add esp, 4
test eax, eax
jne 0x404f12
inc dword [0x47ed14]
call fcn.00415900
mov dword [esi + 0x28], eax
test esi, esi
mov dword [edi], esi
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00414803
mov esp, ebp
pop ebp
ret
push 0x47b71c
lea eax, [ebp - 0x1a4]
mov dword [esi + 0x24], 1
push eax
mov dword [ebp - 0x1a4], 1
call fcn.0044c78e
int3
Function at 0x404f40
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebx
push esi
mov esi, ecx
mov bl, dl
mov eax, dword [esi]
test eax, eax
je 0x404f6d
mov eax, dword [eax + 4]
inc eax
push eax
call fcn.004019f0
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add eax, 0x10
add eax, ecx
cmp byte [eax], 0
je 0x404f6a
mov byte [eax], 0
mov ecx, dword [esi]
lea esi, [ecx + 0x10]
mov ecx, esi
mov dl, bl
pop esi
pop ebx
jmp fcn.004035e0

Function at 0x405a10
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x467970
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x47d00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [esi]
test eax, eax
je 0x405a72
mov eax, dword [eax + 4]
mov ecx, esi
inc eax
push eax
call fcn.004019f0
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
cmp byte [eax + ecx + 0x10], 0
je 0x405a6f
mov byte [eax + ecx + 0x10], 0
mov ecx, dword [esi]
lea esi, [ecx + 0x10]
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x405b4d
xorps xmm0, xmm0
movups xmmword [ebp - 0x24], xmm0
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
movzx eax, byte [ecx + 3]
push eax
movzx eax, byte [ecx + 2]
push eax
movzx eax, byte [ecx + 1]
push eax
movzx eax, byte [ecx]
push eax
lea eax, [ebp - 0x24]
push str._d._d._d._d
push eax
call fcn.004075a0
mov eax, dword [edi + 0x28]
add esp, 0x18
cmp eax, 0xffffffff
je 0x405ac0
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi + 0x28], eax
cmp eax, 0xffffffff
je 0x405b62
push 4
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], 0x2710
push ecx
push 0x1006
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
push dword [ebp + 0xc]
mov eax, 2
mov word [ebp - 0x34], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x32], ax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
push 0x10
push eax
push dword [edi + 0x28]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x405b77
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00414803
mov esp, ebp
pop ebp
ret 8
push 0x47b71c
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0xb
push eax
call fcn.0044c78e
push 0x47b71c
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0xc
push eax
call fcn.0044c78e
push 0x47b71c
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 2
push eax
call fcn.0044c78e
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
push 0x47b71c
push eax
call fcn.0044c78e
int3
Function at 0x40cb00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x40cb0b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x40cbc7
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x477f10]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x477f10]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x477f10]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x477f10]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x477f10]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x477f10]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x477f10]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x477f10]
sub edi, 1
jne 0x40cb20
pop edi
test esi, esi
je 0x40cbea
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x477f10]
sub esi, 1
jne 0x40cbd0
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x40d360
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edx
mov ebx, esi
mov dword [ebp - 8], esi
imul ebx, dword [ebp + 8]
mov eax, ecx
mov dword [ebp - 4], eax
cmp byte [edi], 0
je 0x40d3a8
push 0
lea ecx, [ebp + 8]
push ecx
push ebx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40d39a
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
xor edx, edx
pop edi
div esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x1c]
mov esi, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
sub esi, edx
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x18]
cmovbe esi, ebx
add ecx, edx
push esi
push ecx
push dword [ebp - 4]
call fcn.0044cb90
add dword [edi + 0x1c], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d3e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 8], ebx
mov edi, 1
cmp byte [esi], 0
je 0x40d41b
push 0
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40d416
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x40d448
mov ebx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x40d42c
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x14]
add eax, ebx
push edi
push eax
lea eax, [ebp - 1]
push eax
call fcn.0044cb90
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 8]
mov dword [esi + 0x1c], eax
cmp edi, 1
jne 0x40d45c
movzx eax, byte [ebp - 1]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x40d453
cmp byte [esi + 8], 0
je 0x40d453
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d580
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
mov cl, byte [ebx]
test cl, cl
je 0x40d5b2
cmp byte [ebx + 1], 0
je 0x40d603
push 2
push 0
push 0
push dword [ebx + 4]
call edx
mov cl, byte [ebx]
mov edx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x40d5b8
mov eax, dword [ebx + 0x18]
mov dword [ebx + 0x1c], eax
test cl, cl
je 0x40d5d9
cmp byte [ebx + 1], 0
je 0x40d5d2
push 1
push 0
push 0
push dword [ebx + 4]
call edx
sub eax, dword [ebx + 0xc]
jmp 0x40d5dc
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x40d5eb
mov eax, dword [ebx + 0x1c]
mov esi, 0xffff
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esi
cmp eax, esi
jae 0x40d5f0
mov esi, eax
mov dword [ebp - 0x10], eax
push 0x404
call fcn.0044ecb6
mov edi, eax
add esp, 4
test edi, edi
jne 0x40d60d
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 4
mov dword [ebp - 4], 0xffffffff
cmp esi, eax
jbe 0x40d707
mov edx, dword [ebp - 8]
add eax, 0x400
cmp eax, esi
mov ecx, esi
cmovbe ecx, eax
mov eax, 0x404
sub edx, ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x404
mov dword [ebp - 0x18], edx
mov esi, ecx
cmova esi, eax
mov al, byte [ebx]
mov dword [ebp - 0xc], esi
test al, al
je 0x40d672
cmp byte [ebx + 1], 0
je 0x40d707
mov eax, dword [ebx + 0xc]
push 0
push 0
add eax, edx
push eax
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov al, byte [ebx]
jmp 0x40d675
mov dword [ebx + 0x1c], edx
test al, al
je 0x40d697
push 0
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40d692
mov byte [ebx + 8], 1
mov eax, dword [ebp - 0x14]
jmp 0x40d6c1
mov edx, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x14]
lea eax, [edx + esi]
mov esi, dword [ebx + 0x18]
sub esi, edx
cmp eax, dword [ebx + 0x18]
cmovbe esi, dword [ebp - 0xc]
add ecx, edx
push esi
push ecx
push edi
call fcn.0044cb90
add esp, 0xc
mov eax, esi
add dword [ebx + 0x1c], esi
mov esi, dword [ebp - 0xc]
xor edx, edx
div esi
cmp eax, 1
jne 0x40d707
lea eax, [esi - 3]
test eax, eax
js 0x40d6f2
mov ecx, eax
dec eax
cmp byte [eax + edi], 0x50
jne 0x40d6ee
cmp byte [ecx + edi], 0x4b
jne 0x40d6ee
cmp byte [eax + edi + 2], 5
jne 0x40d6ee
cmp byte [eax + edi + 3], 6
je 0x40d71a
test eax, eax
jns 0x40d6d1
mov eax, dword [ebp - 4]
test eax, eax
jne 0x40d707
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x10]
cmp eax, esi
jb 0x40d621
push edi
call fcn.0044ec66
mov eax, dword [ebp - 4]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
jmp 0x40d6f5