joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425620
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, 0x101c
call fcn.00459b10
mov eax, dword [0x488e40]
xor eax, esp
mov dword [esp + 0x1018], eax
push ebp
lea eax, [esp + 0xc]
push eax
xor ebp, ebp
push 1
push ebp
push str.SYSTEMCurrentControlSetControlSessionManagerKnownDLLs
push SysReAllocStringLen
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42567b
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x1018]
xor ecx, esp
call fcn.00454016
add esp, 0x101c
ret
mov eax, dword [esp + 0xc]
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x81c]
push edx
push ebp
push ebp
push str.DllDirectory
push eax
mov dword [esp + 0x1c], 0x800
mov byte [esp + 0x1030], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42580a
push 0x800
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x820]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp eax, ebp
mov dword [esp + 8], eax
jne 0x4256e2
push 0x800
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, 0x800
jb 0x4256eb
xor eax, eax
mov byte [esp + eax + 0x18], 0
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4256f7
sub eax, edx
lea ecx, [eax - 1]
cmp ecx, 0x7fd
ja 0x42571e
cmp byte [esp + eax + 0x17], 0x5c
je 0x42571e
mov byte [esp + eax + 0x18], 0x5c
mov byte [esp + eax + 0x19], 0
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x425725
push esi
push edi
sub eax, edx
lea edi, [esp + eax + 0x20]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x18]
push edi
push ebp
push ebp
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x834]
push ecx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
lea esi, [esp + 0x83c]
sub esi, edi
push edx
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], 0x801
call ebp
test eax, eax
jne 0x4257e3
add dword [esp + 0x18], 1
lea eax, [esp + 0x820]
push str.DllDirectory
push eax
call fcn.00454706
add esp, 8
test eax, eax
je 0x4257b0
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x820]
push ecx
lea edx, [esp + 0x24]
push edx
push 0xc
push eax
call fcn.00424f20
add esp, 0x10
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
push edi
push 0
push 0
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x834]
push eax
push ecx
push edx
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], 0x801
call ebp
test eax, eax
je 0x425772
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1024]
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00454016
add esp, 0x101c
ret
mov dword [esp + 8], ebp
jmp 0x4256d2
Function at 0x426990
Capabilities:
Terminate process

Disassembly:
mov eax, dword [ebx + 0x58]
push ebp
push esi
push edi
xor edi, edi
cmp eax, edi
je 0x4269a8
push eax
call fcn.00454dd4
add esp, 4
mov dword [ebx + 0x58], edi
mov eax, dword [ebx + 0x60]
cmp eax, edi
je 0x4269bb
push eax
call fcn.00454dd4
add esp, 4
mov dword [ebx + 0x60], edi
mov eax, dword [ebx + 0x6c]
cmp eax, edi
je 0x4269fc
mov dword [eax + 0x14], edi
mov esi, dword [ebx + 0x6c]
cmp dword [esi + 0x37c], edi
je 0x4269f1
push edi
mov byte [esi + 0x308], 1
call fcn.00404e50
mov eax, dword [esi + 0x37c]
push 0xdead
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x4269f9
mov edx, dword [esi + 4]
call fcn.00402800
mov dword [ebx + 0x6c], edi
mov ebp, dword [ebx + 0x50]
cmp ebp, edi
je 0x426a5f
mov ecx, dword [ebp + 8]
push 1
push ecx
mov ecx, ebx
call fcn.004299a0
mov edx, dword [ebp]
push 1
push edx
mov ecx, ebx
call fcn.004299a0
mov esi, ebp
call fcn.00429a20
mov eax, dword [ebp + 0x10]
shr eax, 0xe
not al
test al, 1
je 0x426a53
mov edi, dword [ebp + 0x20]
call fcn.00429a50
mov esi, dword [ebp + 0x20]
test esi, esi
je 0x426a4d
call fcn.00425d60
push esi
call fcn.0042f8ec
add esp, 4
add dword [ebx + 0x40], 0xffffffff
xor edi, edi
push ebp
call fcn.0042f8ec
add esp, 4
mov dword [ebx + 0x50], edi
mov eax, dword [ebx + 0x30]
cmp eax, edi
je 0x426a7f
push eax
call fcn.0042f8ec
mov ecx, dword [ebx + 0x38]
add esp, 4
or dword [0x48d518], ecx
mov dword [ebx + 0x30], edi
pop edi
pop esi
pop ebp
ret
mov edx, dword [ebx + 0x38]
or dword [0x48d518], edx
pop edi
pop esi
pop ebp
ret
Function at 0x427420
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x158]
sub esp, 0x158
push 0xfffffffffffffffe
push 0x484458
push 0x457800
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x488e40]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x154], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov edi, edx
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov byte [ebp - 0x19], bl
mov dword [ebp - 4], ebx
mov ecx, 0x154
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_
lea edx, [ebp]
call fcn.00416b40
call fcn.00416cb0
mov ecx, 0x154
lea edx, [ebp]
call fcn.00416b70
lea eax, [ebp - 0x24]
push eax
push 1
push ebx
lea ecx, [ebp]
push ecx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x427594
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x427594
mov dword [ebp - 0x20], ebx
lea edx, [ebp - 0x20]
push edx
push ebx
push ebx
push ebx
push 0x47630c
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x427594
cmp dword [ebp - 0x20], ebx
je 0x427594
push ebx
push ebx
push 0x47630c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp eax, ebx
je 0x427594
mov ecx, dword [ebp - 0x20]
lea ebx, [eax + ecx + 4]
test ebx, ebx
je 0x427512
mov eax, ebx
call fcn.00416a70
mov esi, eax
jmp 0x427514
xor esi, esi
mov dword [ebp - 0x28], esi
mov byte [esi], 0
mov dword [ebp - 0x20], ebx
lea edx, [ebp - 0x20]
push edx
push esi
push 0
push 0
push 0x47630c
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x427594
cmp dword [ebp - 0x20], ebx
ja 0x427594
cmp byte [esi], al
je 0x427594
mov byte [esi + ebx - 1], al
mov eax, esi
lea ecx, [eax + 1]
jmp 0x427550
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x427550
sub eax, ecx
add eax, esi
mov dword [edi], eax
mov byte [eax], 0x3b
add dword [edi], 1
mov eax, dword [edi]
mov ecx, esi
sub ecx, eax
add ecx, ebx
push ecx
push eax
push 0x47630c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, dword [edi]
sub esi, ecx
add esi, ebx
cmp eax, esi
jb 0x42758c
mov dword [edi], 0
jmp 0x427594
mov byte [ecx + eax], 0
mov byte [ebp - 0x19], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.004275c8
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x154]
xor ecx, ebp
call fcn.00454016
add ebp, 0x158
mov esp, ebp
pop ebp
ret
Function at 0x427690
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x398
mov eax, dword [0x488e40]
xor eax, esp
mov dword [esp + 0x390], eax
push ebp
push esi
push edi
mov eax, 2
xor esi, esi
push esi
mov word [esp + 0x1a], ax
mov word [esp + 0x1c], ax
lea eax, [esp + 0x10]
push eax
mov edi, ecx
push 0x10
lea ecx, [esp + 0x1c]
push ecx
push ebx
mov dword [esp + 0x24], 0x495744
mov word [esp + 0x28], 1
mov word [esp + 0x2e], 0x1770
mov word [esp + 0x30], si
mov word [esp + 0x32], si
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x427705
cmp dword [esp + 0xc], 0x10
je 0x42771f
push 0x1d
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x390]
xor ecx, esp
call fcn.00454016
add esp, 0x398
ret
mov ebp, dword [edi + 0x30]
cmp ebp, esi
jne 0x427733
lea ebp, [esp + 0x38]
mov esi, ebp
call fcn.004186e0
xor esi, esi
push esi
lea edx, [esp + 0x10]
push edx
push 0x360
push ebp
push ebx
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x427705
cmp dword [esp + 0xc], 0x360
jne 0x4276fd
mov eax, dword [edi + 0x34]
mov ecx, dword [edi + 0x38]
mov edx, dword [edi + 0x3c]
push 1
push esi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
call esi
push 1
push 0
push 0x18
push ebx
mov ebp, eax
call esi
push ebx
mov eax, edi
call fcn.00427840
cmp eax, 0xffffffff
mov dword [esp + 0x2c], eax
je 0x427705
mov eax, dword [edi + 0x50]
push eax
push ebx
mov ecx, edi
call fcn.00427a10
cmp eax, 0xffffffff
mov dword [esp + 0x30], eax
je 0x427705
mov ecx, dword [edi + 0x50]
push ecx
push ebx
mov ecx, edi
call fcn.00427c10
cmp eax, 0xffffffff
mov dword [esp + 0x34], eax
je 0x427705
push 1
push 0
push 0
push ebx
call esi
push 0
push 0
push ebp
push ebx
mov dword [esp + 0x1c], eax
call esi
cmp eax, 0xffffffff
je 0x427705
push ebx
mov eax, 0x18
lea edi, [esp + 0x24]
call fcn.00416cd0
add esp, 4
test al, al
je 0x427705
mov edx, dword [esp + 0xc]
push 0
push 0
push edx
push ebx
call esi
cmp eax, 0xffffffff
je 0x427705
mov ecx, dword [esp + 0x39c]
pop edi
pop esi
pop ebp
xor ecx, esp
mov al, 1
call fcn.00454016
add esp, 0x398
ret
Function at 0x427840
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
sub esp, 0x10
mov ecx, dword [eax + 0x70]
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
xor edi, edi
cmp ecx, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ecx
je 0x4279fb
mov ax, word [ecx + 4]
mov edx, 1
xor bl, bl
cmp ax, dx
mov word [esp + 0x24], ax
mov word [esp + 0x26], di
jne 0x427888
mov word [esp + 0x24], di
mov word [esp + 0x26], dx
mov bl, dl
jmp 0x427896
cmp ax, di
je 0x427896
add ax, 0xffff
mov word [esp + 0x24], ax
mov eax, dword [ecx + 8]
cmp eax, edi
je 0x4278ab
lea ecx, [ecx]
add word [esp + 0x26], dx
mov eax, dword [eax]
cmp eax, edi
jne 0x4278a0
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
lea ecx, [esp + 0x20]
push ecx
push 4
lea edx, [esp + 0x30]
push edx
push ebp
mov dword [esp + 0x30], edi
call esi
test eax, eax
je 0x4279e2
mov eax, 4
cmp dword [esp + 0x1c], eax
jne 0x4279da
test bl, bl
je 0x427920
push edi
lea ecx, [esp + 0x20]
push ecx
push eax
lea edx, [esp + 0x1c]
push edx
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], edi
call esi
test eax, eax
je 0x4279e2
cmp dword [esp + 0x1c], 4
jne 0x4279da
mov ecx, str._Side_by_Side_Components_
mov ebx, ebp
call fcn.00416e70
test eax, eax
je 0x4279e2
xor edi, edi
mov eax, dword [esp + 0x14]
mov esi, dword [eax + 8]
cmp esi, edi
je 0x4279c0
nop
test byte [esi + 4], 1
jne 0x427963
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42795e
movzx ecx, word [esi + 4]
shr eax, 2
xor eax, ecx
test al, 4
je 0x42795e
and ecx, 0xfffd
mov word [esi + 4], cx
jmp 0x427963
or word [esi + 4], 2
movzx edx, word [esi + 4]
push edi
lea eax, [esp + 0x20]
push eax
push 4
lea ecx, [esp + 0x1c]
push ecx
push ebp
mov dword [esp + 0x24], edx
mov dword [esp + 0x30], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4279e2
cmp dword [esp + 0x1c], 4
jne 0x4279da
lea ecx, [esi + 8]
mov ebx, ebp
call fcn.00416e70
test eax, eax
je 0x4279e2
test byte [esp + 0x10], 8
je 0x4279b4
movzx edx, word [esi + 6]
lea ecx, [edx + esi + 8]
call fcn.00416e70
test eax, eax
je 0x4279ef
mov esi, dword [esi]
xor edi, edi
test esi, esi
jne 0x427930
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
add dword [esp + 0x18], 1
cmp eax, edi
mov dword [esp + 0x14], eax
je 0x4279fb
mov ecx, eax
jmp 0x427860
push 0x1d
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x10
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 4
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x427a90
Capabilities:
Resolve function by parsing pe exports
Write file on windows

Disassembly:
sub esp, 0x84
push ebx
push esi
mov esi, eax
cdq
mov dword [esp + 0x10], eax
mov eax, dword [esi + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x14]
mov ebx, ecx
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x14], edx
mov edx, dword [esi + 0x30]
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0x20]
mov dword [esp + 0x20], ecx
mov ecx, dword [esi + 0x18]
mov dword [esp + 0x24], edx
mov edx, dword [esi + 0x1c]
mov dword [esp + 0x34], eax
mov eax, dword [esi + 0x2c]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esi + 0x24]
mov dword [esp + 0x30], edx
mov edx, dword [esi + 0x28]
mov dword [esp + 0x40], eax
mov eax, dword [esi + 0x3c]
mov dword [esp + 0x38], ecx
mov ecx, dword [esi + 0x34]
mov dword [esp + 0x3c], edx
mov edx, dword [esi + 0x38]
mov dword [esp + 0x4c], eax
mov eax, dword [esi + 0x48]
mov dword [esp + 0x44], ecx
mov ecx, dword [esi + 0x40]
mov dword [esp + 0x48], edx
mov edx, dword [esi + 0x44]
mov dword [esp + 0x58], eax
mov eax, dword [esi + 0x10]
mov dword [esp + 0x50], ecx
mov ecx, dword [esi + 0x4c]
mov dword [esp + 0x54], edx
mov edx, dword [esi + 0x50]
mov dword [esp + 0x64], eax
mov eax, dword [esi + 0x5c]
mov dword [esp + 0x5c], ecx
mov ecx, dword [esi + 0x54]
mov dword [esp + 0x60], edx
mov edx, dword [esi + 0x58]
mov dword [esp + 0x70], eax
mov eax, dword [esi + 0x68]
mov dword [esp + 0x68], ecx
mov ecx, dword [esi + 0x60]
mov dword [esp + 0x6c], edx
mov edx, dword [esi + 0x64]
mov dword [esp + 0x7c], eax
mov eax, dword [esi + 0x7c]
test eax, eax
mov dword [esp + 0x74], ecx
mov ecx, dword [esi + 0x6c]
mov dword [esp + 0x78], edx
mov edx, dword [esi + 0x70]
mov dword [esp + 0x80], ecx
mov dword [esp + 0x84], edx
mov dword [esp + 0x18], 0
je 0x427b82
add dword [esp + 0x18], 1
mov eax, dword [eax]
test eax, eax
jne 0x427b77
push 0
lea eax, [esp + 0x10]
push eax
push 0x78
lea ecx, [esp + 0x1c]
push ecx
push ebx
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x427bb2
cmp dword [esp + 0xc], 0x78
je 0x427bbd
push 0x1d
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
pop ebx
add esp, 0x84
ret
mov ecx, dword [esi + 0x88]
call fcn.00416e70
test eax, eax
je 0x427bb2
mov ecx, dword [esi + 0x80]
call fcn.00416e70
test eax, eax
je 0x427bb2
mov esi, dword [esi + 0x7c]
test esi, esi
je 0x427bf3
mov eax, ebx
call fcn.00427d20
test eax, eax
je 0x427bb2
mov esi, dword [esi]
test esi, esi
jne 0x427be2
pop esi
mov eax, 1
pop ebx
add esp, 0x84
ret
Function at 0x427c80
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x18
push esi
mov esi, eax
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
cdq
mov dword [esp + 8], eax
mov eax, dword [esi + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x18]
test eax, eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], 0
je 0x427cbb
nop
add dword [esp + 0x10], 1
mov eax, dword [eax]
test eax, eax
jne 0x427cb0
push 0
lea edx, [esp + 8]
push edx
push 0x14
lea eax, [esp + 0x14]
push eax
push edi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x427ceb
cmp dword [esp + 4], 0x14
je 0x427cf2
push 0x1d
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
add esp, 0x18
ret
mov esi, dword [esi + 0x18]
test esi, esi
je 0x427d11
lea esp, [esp]
mov eax, edi
call fcn.00427d20
test eax, eax
je 0x427ceb
mov esi, dword [esi]
test esi, esi
jne 0x427d00
mov eax, 1
pop esi
add esp, 0x18
ret
Function at 0x427d20
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x18
mov cx, word [esi + 8]
mov dx, word [esi + 0xa]
push ebx
mov ebx, eax
mov eax, dword [esi + 4]
test al, 1
push ebp
push edi
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], cx
mov word [esp + 0x1e], dx
je 0x427d4d
and dword [esp + 0x18], 0xffffff7f
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
xor ebp, ebp
push ebp
lea eax, [esp + 0x10]
push eax
push 8
lea ecx, [esp + 0x24]
push ecx
push ebx
mov dword [esp + 0x20], ebp
call edi
test eax, eax
je 0x427dd8
cmp dword [esp + 0xc], 8
jne 0x427dd0
mov eax, dword [esp + 0x18]
test eax, 0x8000
je 0x427de1
mov eax, dword [esi + 4]
test eax, 0x4000
je 0x427d92
mov edx, dword [esi + 0x10]
mov dword [esp + 0x10], edx
jmp 0x427dad
test eax, 0x8000
je 0x427da9
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
jmp 0x427db1
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
push ebp
lea edx, [esp + 0x10]
push edx
push 8
lea eax, [esp + 0x1c]
push eax
push ebx
mov dword [esp + 0x20], ebp
call edi
test eax, eax
je 0x427dd8
cmp dword [esp + 0xc], 8
je 0x427e37
push 0x1d
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop ebp
pop ebx
add esp, 0x18
ret
test eax, 0x4000
je 0x427e37
mov eax, dword [esi + 4]
test eax, 0x4000
je 0x427dfb
mov ecx, dword [esi + 0x10]
mov dword [esp + 0xc], ecx
jmp 0x427e18
test eax, 0x8000
je 0x427e0e
mov edx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
mov dword [esp + 0x14], edx
jmp 0x427e14
xor eax, eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0xc], eax
push ebp
lea eax, [esp + 0x14]
push eax
push 4
lea ecx, [esp + 0x18]
push ecx
push ebx
mov dword [esp + 0x24], ebp
call edi
test eax, eax
je 0x427dd8
cmp dword [esp + 0x10], 4
jmp 0x427dce
mov al, byte [esp + 0x18]
test al, 8
je 0x427e77
mov eax, dword [esi + 4]
test al, 8
jne 0x427e4d
mov ecx, 0x4727f1
jmp 0x427e66
test eax, 0x4000
je 0x427e59
lea ecx, [esi + 0x14]
jmp 0x427e66
test eax, 0x8000
lea ecx, [esi + 0x18]
jne 0x427e66
lea ecx, [esi + 0x10]
call fcn.00416e70
test eax, eax
je 0x427dd8
mov al, byte [esp + 0x18]
test al, 1
je 0x427e8f
test al, 0x20
je 0x427e8f
mov ecx, dword [esi + 0xc]
call fcn.00416e70
test eax, eax
je 0x427dd8
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 0x18
ret
Function at 0x427ea0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
mov edi, eax
xor ebp, ebp
push ebp
lea eax, [esp + 0x10]
push eax
push 8
lea ecx, [esp + 0x2c]
push ecx
push edi
mov dword [esp + 0x20], ebp
call esi
test eax, eax
je 0x427f09
cmp dword [esp + 0xc], 8
jne 0x427f01
mov eax, dword [esp + 0x20]
test eax, 0x8000
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
je 0x427f12
push ebp
lea edx, [esp + 0x10]
push edx
push 8
lea eax, [esp + 0x20]
push eax
push edi
mov dword [esp + 0x20], ebp
call esi
test eax, eax
je 0x427f09
cmp dword [esp + 0xc], 8
je 0x427f44
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x20
ret
test eax, 0x4000
je 0x427f48
push ebp
lea ecx, [esp + 0x10]
push ecx
push 4
lea edx, [esp + 0x1c]
push edx
push edi
mov dword [esp + 0x20], ebp
call esi
test eax, eax
je 0x427f09
cmp dword [esp + 0xc], 4
jne 0x427f01
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebp
mov eax, dword [esp + 0x20]
xor esi, esi
test al, 8
mov dword [esp + 0xc], esi
je 0x427f6b
push edi
lea eax, [esp + 0x10]
call fcn.00416d30
add esp, 4
test eax, eax
je 0x427f09
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 0x20]
test al, 1
mov dword [esp + 0x10], ebp
je 0x427f9e
test al, 0x20
je 0x427f9e
push edi
lea eax, [esp + 0x14]
call fcn.00416d30
add esp, 4
test eax, eax
jne 0x427f9a
lea esi, [esp + 0xc]
call fcn.00416a90
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x20
ret
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
push 1
push ecx
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x32]
push ecx
mov ecx, dword [esp + 0x34]
push esi
push edx
push ecx
and eax, 0xffff3fff
push eax
call fcn.0042a090
cmp esi, ebp
mov edi, eax
je 0x427fd4
push esi
call fcn.00454dd4
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x20
ret
Function at 0x428970
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
xor esi, esi
push esi
mov ebx, eax
lea eax, [esp + 0x30]
push eax
push 0x14
lea ecx, [esp + 0x20]
push ecx
push ebp
xor edi, edi
mov dword [esp + 0x40], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x428a8b
cmp dword [esp + 0x2c], 0x14
je 0x4289bc
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
push 0x24
call fcn.0042f8c1
add esp, 4
cmp eax, esi
je 0x4289ea
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov esi, eax
jmp 0x4289fb
push 0
push 0
push 1
push 0xc0000017
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov edx, dword [esp + 0x20]
mov dword [esi + 0x10], edx
mov eax, dword [esp + 0x24]
mov dword [esi + 0x1c], eax
cmp dword [esp + 0x1c], edi
jbe 0x428a2f
nop
mov eax, ebp
call fcn.00427ea0
test eax, eax
je 0x428a54
test edi, edi
je 0x428a23
mov dword [edi], eax
jmp 0x428a26
mov dword [esi + 0x18], eax
sub dword [esp + 0x1c], 1
mov edi, eax
jne 0x428a10
test ebx, ebx
je 0x428a54
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
jmp 0x428a40
mov edx, dword [ebx + 8]
cmp edx, ecx
jne 0x428a4e
mov edx, dword [ebx + 0xc]
cmp edx, eax
je 0x428a97
mov ebx, dword [ebx]
test ebx, ebx
jne 0x428a40
cmp dword [esi + 0x18], 0
je 0x428a82
lea ebx, [ebx]
mov ecx, dword [esi + 0x18]
mov edi, dword [ecx]
mov eax, ecx
test eax, eax
je 0x428a7b
push eax
call fcn.00454dd4
add esp, 4
mov dword [esi + 0x18], 0
test edi, edi
mov dword [esi + 0x18], edi
jne 0x428a60
push esi
call fcn.0042f8ec
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
test dword [esi + 0x10], 0x4000
mov eax, dword [ebx + 4]
mov dword [esi + 0x20], eax
jne 0x428aaf
mov dword [eax], esi
mov eax, dword [esi + 0x20]
mov byte [eax + 4], 1
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x42b350
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [edi + 0xc]
cmp edx, 0x40
mov ecx, dword [edi + 0x18]
push esi
mov esi, eax
jb 0x42b490
cmp word [ecx], 0x5a4d
jne 0x42b490
push ebx
mov ebx, dword [ecx + 0x3c]
add edx, 0xffffff08
lea eax, [ebx + ecx]
cmp ebx, edx
pop ebx
ja 0x42b3ec
cmp dword [eax], 0x4550
jne 0x42b3ec
lea ecx, [eax + 0x18]
mov byte [edi + 0x1c], 0
movzx edx, word [ecx]
cmp dx, 0x20b
jne 0x42b3c5
or dword [edi + 0x34], 2
mov esi, dword [esi + 0x20]
or dword [esi + 8], 0x2000
mov byte [edi + 0x1c], 1
lea edx, [eax + 4]
mov dword [edi + 0x20], edx
mov dword [edi + 0x24], ecx
movzx ecx, word [eax + 0x14]
lea edx, [ecx + eax + 0x18]
mov dword [edi + 0x28], edx
mov eax, 1
pop esi
ret
cmp dx, 0x10b
je 0x42b3aa
mov eax, dword [esi + 0x20]
cmp dword [eax + 0x80], 0
jne 0x42b3e4
mov ecx, str.This_file_contains_a_PE_header__but_has_an_unknown_format.
xor eax, eax
call fcn.0042aa20
or dword [edi + 0x38], 0x10
xor eax, eax
pop esi
ret
or dword [edi + 0x38], 0x100
mov edx, dword [esi + 0x20]
or dword [edx + 8], 0x40000
mov edx, dword [edi + 0xc]
sub edx, 0x40
cmp dword [ecx + 0x3c], edx
ja 0x42b45e
cmp word [eax], 0x454e
jne 0x42b45e
mov al, byte [eax + 0x36]
cmp al, 1
jne 0x42b436
mov eax, dword [esi + 0x20]
cmp dword [eax + 0x80], 0
jne 0x42b4cf
mov ecx, str.No_PE_signature_found._This_file_appears_to_be_a_16_bit_OS_2_module.
xor eax, eax
call fcn.0042aa20
xor eax, eax
pop esi
ret
cmp al, 4
je 0x42b43e
cmp al, 2
jne 0x42b45e
mov ecx, dword [esi + 0x20]
cmp dword [ecx + 0x80], 0
jne 0x42b4cf
mov ecx, str.No_PE_signature_found._This_file_appears_to_be_a_16_bit_Windows_module.
xor eax, eax
call fcn.0042aa20
xor eax, eax
pop esi
ret
mov edx, dword [esi + 0x20]
cmp dword [edx + 0x80], 0
jne 0x42b4cf
push 0
mov ecx, str.No_PE_signature_found._This_file_appears_to_be_a_16_bit_DOS_module.
call fcn.00417350
mov ecx, dword [esi + 0x20]
mov dword [ecx + 0x80], eax
mov esi, dword [esi + 0x20]
or dword [esi + 8], 0x10000
add esp, 4
xor eax, eax
pop esi
ret
mov edx, dword [esi + 0x20]
cmp dword [edx + 0x80], 0
jne 0x42b4be
push 0
mov ecx, str.No_DOS_or_PE_signature_found._This_file_is_not_a_valid_32_bit_or_64_bit_Windows_module.
call fcn.00417350
mov ecx, dword [esi + 0x20]
mov dword [ecx + 0x80], eax
mov eax, dword [esi + 0x20]
add esp, 4
or dword [eax + 8], 0x10000
or dword [edi + 0x38], 0x100
mov esi, dword [esi + 0x20]
or dword [esi + 8], 0x40000
xor eax, eax
pop esi
ret