joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1809dd43
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
call fcn.1801f60c
mov edi, eax
call fcn.18011c3e
xor ebx, ebx
push ebx
push 0x989680
push edx
push eax
call fcn.18153220
mov ecx, str.HKLMSoftwareMicrosoftEdgeUpdate_
lea esi, [eax + 0x49ef6f00]
cmp byte [ebp - 8], bl
jne 0x1809dd89
mov ecx, str.HKCUSoftwareMicrosoftEdgeUpdate_
push ebx
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
push 4
mov edx, str.RetryAfter
call fcn.1801a171
mov ecx, dword [ebp - 0xc]
add esp, 0xc
test eax, eax
jns 0x1809dda9
mov ecx, ebx
cmp esi, ecx
jae 0x1809ddb7
lea eax, [esi + 0x15180]
cmp ecx, eax
jbe 0x1809de06
push ebx
lea eax, [ebp - 0xe]
mov byte [ebp - 0xe], bl
push eax
mov ecx, edi
call fcn.18021379
mov esi, eax
test esi, esi
jne 0x1809de0d
movzx ecx, byte [0x181cc106]
neg ecx
sbb ecx, ecx
and ecx, 0x181cc000
je 0x1809de06
push 7
pop edx
inc eax
mov dword [ebp - 0x20], ecx
push eax
push edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
call fcn.18008bfd
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push str._ShouldCheckForUpdates_returned_0__checks_disabled_
push eax
call fcn.180072d0
pop ecx
pop ecx
xor al, al
jmp 0x1809deaa
push dword [ebp - 8]
call fcn.180216b9
mov edi, eax
call fcn.1801f60c
push ebx
lea ecx, [ebp - 0xd]
mov dword [ebp - 0x1c], ebx
push ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x18], ebx
push ecx
mov ecx, eax
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0xd], bl
call fcn.180238e2
test eax, eax
js 0x1809de41
cmp byte [ebp - 0xd], bl
jne 0x1809dea8
cmp edi, esi
jl 0x1809dea8
lea eax, [esi + 0xe10]
cmp edi, eax
jge 0x1809dea6
cmp byte [ebp - 0xe], bl
jne 0x1809dea6
push ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push 4
mov edx, str.DisableUpdateAppsHourlyJitter
mov ecx, str.HKLMSoftwareMicrosoftEdgeUpdateDev_
call fcn.1801a171
add esp, 0xc
test eax, eax
js 0x1809de7e
cmp dword [ebp - 8], ebx
setne al
test al, al
jne 0x1809dea6
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
movzx eax, al
neg eax
push 0x64
sbb eax, eax
xor edx, edx
and eax, dword [ebp - 8]
pop ecx
div ecx
cmp edx, 0x5a
setb bl
jmp 0x1809dea8
mov bl, 1
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18117a58
leave
ret
Function at 0x180cffad
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x181c600c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
xor edi, edi
push edi
push 0x18198834
mov dword [esi], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], 0xf
call fcn.1801e2c8
push 0x20a
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.1812c700
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x180d00ad
lea eax, [ebp - 0x218]
mov dword [ebp - 0x238], edi
push eax
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x224], 7
call fcn.1800f9fb
lea edx, [ebp - 0x238]
lea ecx, [ebp - 0x250]
call fcn.180d5693
push eax
mov ecx, esi
call fcn.18037aa5
lea ecx, [ebp - 0x250]
call fcn.1801476d
mov eax, dword [ebp - 0x224]
cmp eax, 8
jb 0x180d00ad
mov ecx, dword [ebp - 0x238]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x220], ecx
cmp eax, 0x1000
jb 0x180d00a4
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.18007c32
mov eax, dword [ebp - 0x21c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x220]
push eax
push ecx
call fcn.18117f86
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.18117a58
leave
ret

Function at 0x180d8565
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
invalid
inc ebp

Function at 0x180d897d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec dword [ecx - 0x6737b]
inc edi
test dword [esp + edi*8 - 1], edi
inc dword [eax + eax]
add byte [eax], al
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
invalid
invalid
push edx

Function at 0x180da281
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.180d80be
pop esi
jge 0x180da289
invalid
aas
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
Function at 0x407e17
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push edi
mov edi, ecx
push edi
call dword [sym.imp.kernel32.dll_lstrlenW]
push 0
mov ebx, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x407e86
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ebx, [ebx*2 + 2]
push ebx
push 0x2002
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.kernel32.dll_GlobalLock]
test eax, eax
je 0x407e62
push ebx
push edi
push eax
call fcn.0040ba60
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x407e7d
push esi
call dword [sym.imp.kernel32.dll_GlobalFree]
pop esi
pop edi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
ret

Function at 0x40a1be
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40a1cd
pop dword [ebp - 0x14]
mov eax, 0x40a1cd
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x42127
push 0
mov eax, 0xe0c04bdd
add eax, 0x1f81964f
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0xec4c7639
add ecx, 0x13b3e36a
xor esi, esi
add esi, eax
mov edi, 0x58159722
add edi, 0xa82e1ade
add edi, dword [ebp - 0x14]
mov edx, 0x8ba056ef
sub edx, 0x97b65c0d
add dword [ebp - 4], 0xf496f825
mov ebx, dword [edi]
xor dword [ebp - 4], 0x6c10ae8d
xor ebx, edx
mov dword [ebp - 0x10], 0x23095a96
mov dword [esi], ebx
add dword [ebp - 0xc], eax
add esi, 0x42d40986
add esi, 0xbd2bf67e
add edi, 0x218d34b8
sub edi, 0x218d34b4
loop 0x40a229
add eax, 0x1595f
mov ebx, eax
add eax, 0x23497545
add eax, 0xdcb68ac0
mov ecx, 0xef87d2da
sub ecx, 0xef47d2da
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x402ee4
pop dword [ebp - 0xc]
mov eax, 0x402ee4
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x6f1a376a
sub dword [ebp - 0x1c], 0x20c7f21f
mov dword [ebp - 0x18], 0x2d00c3d4
add dword [ebp - 0x18], 0x5328871
mov dword [ebp - 0x14], 0xd783630
sub dword [ebp - 0x14], 0xc12bf202
mov dword [ebp - 0x10], 0x540d425e
sub dword [ebp - 0x10], 0x540d425e
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xb77ec891
sub eax, 0xb73e478d
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xcd9e79a6
sub dword [ebp - 0x1c], 0x592c1050
mov dword [ebp - 0x18], 0xd3549cb
add dword [ebp - 0x18], 0x343717aa
mov dword [ebp - 0x14], 0x7ab5b48f
add dword [ebp - 0x14], 0xe8b9b7dd
mov dword [ebp - 0x10], 0x6d73fc34
add dword [ebp - 0x10], 0x928c03cc
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xad5d1d3e
add eax, 0x52e363c2
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3546f
push 0
call eax
mov ecx, 0x4fee34d1
add ecx, 0xb0120c26
xor edi, edi
add edi, eax
mov ebx, 0xf41052ee
sub ebx, 0xf3c96eee
add ebx, dword [ebp - 0xc]
mov esi, 0xce496042
sub esi, 0x36ebc1dc
sub dword [ebp - 8], ecx
mov edx, dword [ebx]
mov dword [ebp - 8], 0xc5ab889e
add edx, esi
xor dword [ebp - 8], 0xd83b467a
mov dword [edi], edx
sub dword [ebp - 8], 0x4cf687a7
add edi, 4
add ebx, 4
loop 0x403003
add eax, 0x536ec05e
add eax, 0xac923651
xor ebx, ebx
add ebx, eax
add eax, 0x1d0d65af
add eax, 0xe2f29a56
mov ecx, 0x3a8822a3
add ecx, 0xc5b7dd5d
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x401c27
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x220
mov eax, dword [0x472500]
xor eax, esp
mov dword [esp + 0x21c], eax
mov eax, dword [esp + 0x224]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x238]
xor ebp, ebp
push edi
mov dword [esp + 0x28], eax
mov ecx, ebp
mov ebx, 0x100
mov eax, ecx
mov byte [esp + ecx + 0x2c], cl
cdq
idiv dword [esp + 0x240]
mov al, byte [edx + esi]
mov byte [esp + ecx + 0x12c], al
inc ecx
cmp ecx, ebx
jl 0x401c5a
mov esi, ebp
mov edi, ebp
mov dl, byte [esp + esi + 0x2c]
movzx eax, byte [esp + esi + 0x12c]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x401c9e
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [esp + edi + 0x2c]
mov byte [esp + esi + 0x2c], al
inc esi
mov byte [esp + edi + 0x2c], dl
cmp esi, ebx
jl 0x401c7b
mov ecx, ebp
mov edx, ebp
mov edi, ebp
cmp dword [esp + 0x238], ecx
jle 0x401d9d
mov dword [esp + 0x24], ebp
inc ecx
and ecx, 0x800000ff
jns 0x401cd7
dec ecx
or ecx, 0xffffff00
inc ecx
mov bl, byte [esp + ecx + 0x2c]
movzx esi, bl
add edx, esi
mov dword [esp + 0x1c], ecx
and edx, 0x800000ff
jns 0x401cf4
dec edx
or edx, 0xffffff00
inc edx
lea eax, [esp + 0x24]
mov dword [esp + 0x20], edx
push eax
push ebp
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
call fcn.004013ee
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
sub eax, ebp
sar eax, 2
mov eax, dword [ebp + eax*4 - 4]
add eax, 0x41c300
push eax
push 0x473388
call fcn.004010d0
mov edx, dword [esp + 0x28]
pop ecx
pop ecx
mov ecx, dword [esp + 0x1c]
mov al, byte [esp + edx + 0x2c]
mov byte [esp + ecx + 0x2c], al
mov byte [esp + edx + 0x2c], bl
movzx eax, byte [esp + ecx + 0x2c]
mov ebx, dword [esp + 0x28]
add eax, esi
movzx eax, al
mov al, byte [esp + eax + 0x2c]
xor byte [ebx + edi], al
test ebp, ebp
je 0x401d8d
mov eax, dword [esp + 0x18]
sub eax, ebp
and eax, 0xfffffffc
push eax
push ebp
call fcn.004013c2
mov edx, dword [esp + 0x28]
xor ebp, ebp
pop ecx
pop ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
jmp 0x401d8f
xor ebp, ebp
inc edi
cmp edi, dword [esp + 0x238]
jl 0x401cc6
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00404ae9
add esp, 0x220
ret

Function at 0x4020fc
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x402127
mov al, byte [edx + ecx]
xor al, 0x73
sub al, 0x6c
xor al, 0x74
add al, 0x4e
xor al, 0x70
sub al, 0x65
xor al, 0x22
sub al, 0x73
xor al, 0x2a
mov byte [edx + ecx], al
inc ecx
cmp ecx, dword [esp + 8]
jb 0x402108
ret
Function at 0x40230a
Capabilities:
Allocate or change rwx memory
Create process on windows
Create thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x472500]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.006:107_4:_00007:277_0:_004:_04:_008:_08:_08:_8:_7:2_3:_9:193_4:_
lea ecx, [ebp - 0x1c]
call fcn.00401648
push 0xc
call fcn.00404aab
pop ecx
test eax, eax
je 0x402343
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.004016a1
jmp 0x402345
xor eax, eax
mov esi, dword [eax + 4]
shl esi, 2
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
lea eax, [ebp - 0x20]
mov ebx, 0x4ac
mov edi, 0x472028
sub esi, 0x40
push eax
push 0x40
push ebx
push edi
push 0xffffffffffffffff
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push ebx
push edi
mov dword [ebp - 0x24], esi
call fcn.004020fc
push 0x23
push section..data
push 0x4c000
mov esi, 0x426028
push esi
call fcn.00401c27
add esp, 0x18
lea eax, [ebp - 0x24]
push eax
xor eax, eax
push eax
push esi
push 0x4721b0
push eax
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateCaret]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
lea ecx, [ebp - 0x1c]
call fcn.00401fb0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404ae9
leave
ret

Function at 0x4039ed
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x403a0e
jl 0x403a05
test edi, edi
jne 0x403a0e
xor eax, eax
xor edx, edx
jmp 0x403acf
cmp dword [ebx + 0x38], 0
je 0x403a23
push eax
push edi
push dword [ebp + 8]
call fcn.00403ad5
jmp 0x403acf
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x403a6a
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x403a6a
cmp eax, edi
jb 0x403a44
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00405610
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x403a70
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x403ac4
mov ecx, ebx
call fcn.00403116
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x403aaf
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.0040a942
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x403ac4
jmp 0x403a82
test edx, edx
je 0x403ac4
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0040a942
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x411093
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00410f04

Function at 0x41148d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004055e0
mov eax, dword [0x472500]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004100f9
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4114cf
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41162b
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0041b320
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x473e20]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00412484
mov ecx, dword [esi*4 + 0x473e20]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x411624
cmp eax, dword [edi + ecx + 0x24]
jne 0x411624
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x411624
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00412484
add esp, 0x14
test edx, edx
jl 0x411624
jg 0x41159a
test eax, eax
jb 0x411624
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x411624
jl 0x4115b4
cmp dword [ebp - 0x1008], eax
ja 0x411624
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4115d2
test ebx, ebx
je 0x41160b
cmp ecx, edi
jae 0x41160b
mov al, byte [ecx]
cmp al, 0xd
jne 0x4115ec
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4115f8
cmp byte [ecx + 1], 0xa
jne 0x4115f8
inc ecx
jmp 0x4115f8
movzx eax, al
movsx eax, byte [eax + 0x4727b8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4115d2
cmp edx, ebx
jne 0x4115d2
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x411629
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00404ae9
leave
ret
Function at 0x411922
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x473e20]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x411962
cmp byte [ebx], 0xa
jne 0x411962
or byte [eax + edi + 0x28], 4
jmp 0x411967
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x411a65
mov al, byte [edx]
cmp al, 0x1a
je 0x411a47
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x411996
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4119bb
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x4119c5
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x411978
jmp 0x411a65
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x411a42
cmp dword [ebp - 0xc], 0
je 0x411a42
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x473e20]
test byte [eax + edi + 0x28], 0x48
je 0x411a1c
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x411a07
mov byte [esi], dl
jmp 0x411a18
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x473e20]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x411a65
cmp byte [ebp - 1], 0xa
jne 0x411a2b
cmp esi, ebx
jne 0x411a2b
mov byte [esi], 0xa
jmp 0x411a64
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004124a2
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x411a65
mov byte [esi], 0xd
jmp 0x411a64
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x473e20]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x411a61
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x411a65
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x411a6e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x473e20]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x411ab1
cmp word [esi], dx
jne 0x411ab1
or byte [edi + eax + 0x28], 4
jmp 0x411ab6
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x411c09
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x411be9
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x411af8
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x411b2e
cmp eax, edx
jae 0x411b3a
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x411ad0
jmp 0x411c09
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x411be5
cmp dword [ebp - 0x14], 0
je 0x411be5
mov eax, dword [ebx*4 + 0x473e20]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x411bbd
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x411b86
mov word [esi], cx
jmp 0x411bb9
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x473e20]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x473e20]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x473e20]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x411c09
pop ebx
cmp word [ebp - 4], bx
jne 0x411bce
cmp esi, dword [ebp + 0xc]
jne 0x411bce
mov word [esi], bx
jmp 0x411c06
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004124a2
add esp, 0x10
cmp word [ebp - 4], bx
je 0x411c09
push 0xd
jmp 0x411c02
mov ecx, dword [ebx*4 + 0x473e20]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x411c00
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x411c09
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret