joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405df0
Capabilities:
Check if file exists
Enumerate files on windows
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x664
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x660], eax
push ebx
push esi
push edi
push 0x200
lea eax, [esp + 0x46c]
mov dword [esp + 0x18], ecx
push 0
or ebx, 0xffffffff
push eax
mov dword [esp + 0x1c], ebx
call fcn.0040bf00
push 0x200
lea eax, [esp + 0x278]
push 0
push eax
call fcn.0040bf00
push 0x250
lea eax, [esp + 0x34]
push 0
push eax
call fcn.0040bf00
add esp, 0x24
lea eax, [esp + 0x468]
or esi, ebx
push eax
push 0xff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor eax, eax
lea edi, [esp + 0x468]
mov dword [esp + 0x65e], eax
mov dword [esp + 0x662], eax
mov word [esp + 0x666], ax
cmp ax, word [esp + 0x468]
je 0x406023
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
nop dword [eax]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x405ffe
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
je 0x405fec
push 0xff
lea eax, [esp + 0x26c]
push edi
push eax
call fcn.0040e084
xor eax, eax
push 0xff
mov word [esp + 0x476], ax
lea eax, [esp + 0x278]
push 0x42e420
push eax
call fcn.0040de40
xor eax, eax
add esp, 0x18
mov word [esp + 0x466], ax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405fec
nop dword [eax + eax]
test dword [esp + 0x18], 0x10
je 0x405f83
lea eax, [esp + 0x44]
push str.uplay
push eax
call fcn.0040df83
add esp, 8
test eax, eax
jne 0x405f83
push 0xf3
mov word [esp + 0x284], ax
lea eax, [esp + 0x284]
push str.uplaydd_launcher.exe
push eax
call fcn.0040e084
xor eax, eax
add esp, 0xc
mov word [esp + 0x466], ax
lea eax, [esp + 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x405f83
test al, 0x10
je 0x405f91
lea eax, [esp + 0x18]
push eax
push esi
call ebx
test eax, eax
jne 0x405f20
jmp 0x405fe2
xor eax, eax
mov word [esp + 0x280], ax
lea eax, [esp + 0x268]
push 0x102
push eax
push dword [esp + 0x1c]
call fcn.0040e084
mov eax, dword [esp + 0x20]
xor ecx, ecx
push 0x102
push str.uplay
push eax
mov word [eax + 0x204], cx
call fcn.0040de40
mov eax, dword [esp + 0x2c]
add esp, 0x18
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov word [eax + 0x204], cx
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
or esi, 0xffffffff
add edi, 8
xor eax, eax
cmp ax, word [edi]
jne 0x405ea0
mov eax, dword [esp + 0x10]
cmp esi, 0xffffffff
je 0x406025
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x660]
xor ecx, esp
call fcn.0040a851
mov esp, ebp
pop ebp
ret
mov eax, ebx
mov ecx, dword [esp + 0x66c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040a851
mov esp, ebp
pop ebp
ret
Function at 0x406730
Capabilities:
Check if file exists
Enumerate files on windows
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x664
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x660], eax
push ebx
push esi
push edi
push 0x200
lea eax, [esp + 0x46c]
mov dword [esp + 0x18], ecx
push 0
or ebx, 0xffffffff
push eax
mov dword [esp + 0x1c], ebx
call fcn.0040bf00
push 0x200
lea eax, [esp + 0x278]
push 0
push eax
call fcn.0040bf00
push 0x250
lea eax, [esp + 0x34]
push 0
push eax
call fcn.0040bf00
add esp, 0x24
lea eax, [esp + 0x468]
or esi, ebx
push eax
push 0xff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor eax, eax
lea edi, [esp + 0x468]
mov dword [esp + 0x65e], eax
mov dword [esp + 0x662], eax
mov word [esp + 0x666], ax
cmp ax, word [esp + 0x468]
je 0x406963
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
nop dword [eax]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40693e
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
je 0x40692c
push 0xff
lea eax, [esp + 0x26c]
push edi
push eax
call fcn.0040e084
xor eax, eax
push 0xff
mov word [esp + 0x476], ax
lea eax, [esp + 0x278]
push 0x42e420
push eax
call fcn.0040de40
xor eax, eax
add esp, 0x18
mov word [esp + 0x466], ax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40692c
nop dword [eax + eax]
test dword [esp + 0x18], 0x10
je 0x4068c3
lea eax, [esp + 0x44]
push str.wegame
push eax
call fcn.0040df83
add esp, 8
test eax, eax
jne 0x4068c3
push 0xf3
mov word [esp + 0x284], ax
lea eax, [esp + 0x284]
push str.wegamedd_launcher.exe
push eax
call fcn.0040e084
xor eax, eax
add esp, 0xc
mov word [esp + 0x466], ax
lea eax, [esp + 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4068c3
test al, 0x10
je 0x4068d1
lea eax, [esp + 0x18]
push eax
push esi
call ebx
test eax, eax
jne 0x406860
jmp 0x406922
xor eax, eax
mov word [esp + 0x280], ax
lea eax, [esp + 0x268]
push 0x1fe
push eax
push dword [esp + 0x1c]
call fcn.0040e084
mov eax, dword [esp + 0x20]
xor ecx, ecx
push 0x1fe
push str.wegame
push eax
mov word [eax + 0x3fc], cx
call fcn.0040de40
mov eax, dword [esp + 0x2c]
add esp, 0x18
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov word [eax + 0x3fc], cx
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
or esi, 0xffffffff
add edi, 8
xor eax, eax
cmp ax, word [edi]
jne 0x4067e0
mov eax, dword [esp + 0x10]
cmp esi, 0xffffffff
je 0x406965
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x660]
xor ecx, esp
call fcn.0040a851
mov esp, ebp
pop ebp
ret
mov eax, ebx
mov ecx, dword [esp + 0x66c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040a851
mov esp, ebp
pop ebp
ret
Function at 0x406f70
Capabilities:
Create directory
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push esi
push edi
push 0x38
lea eax, [esp + 0x1c]
mov dword [esp + 0x14], edx
mov ebx, ecx
push 0
push eax
mov dword [esp + 0x20], ebx
call fcn.0040bf00
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x406fd5
lea eax, [esp + 0x18]
push eax
push ebx
call fcn.004161e0
add esp, 8
test eax, eax
jne 0x406fd5
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.0040a851
mov esp, ebp
pop ebp
ret
push 0x200
lea eax, [esp + 0x54]
push 0
push eax
call fcn.0040bf00
push 0x1ff
lea eax, [esp + 0x60]
push ebx
push eax
call fcn.0040e0d0
mov al, byte [esp + 0x68]
lea esi, [esp + 0x68]
add esp, 0x18
mov byte [esp + 0x24f], 0
test al, al
je 0x407033
nop dword [eax]
cmp al, 0x2f
je 0x407018
cmp al, 0x5c
jne 0x40702b
lea eax, [esp + 0x50]
mov byte [esi], 0
push eax
call fcn.004159af
add esp, 4
mov byte [esi], 0x2f
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x407010
push 0x100000
call fcn.004152ca
mov edi, eax
add esp, 4
test edi, edi
jne 0x40705e
lea eax, [edi - 2]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.0040a851
mov esp, ebp
pop ebp
ret
push 0x42e9f8
push dword [esp + 0x14]
call fcn.0040ed51
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x407098
push edi
lea esi, [eax - 3]
call fcn.0041501c
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.0040a851
mov esp, ebp
pop ebp
ret
push 0x42e9a8
push dword [esp + 0x18]
call fcn.0040ed51
add esp, 8
mov dword [esp + 0x10], eax
push ebx
test eax, eax
jne 0x4070dd
lea esi, [eax - 4]
call fcn.0040ea39
add esp, 4
push edi
call fcn.0041501c
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.0040a851
mov esp, ebp
pop ebp
ret
push 0x100000
push 1
push edi
call fcn.00415210
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40711e
push dword [esp + 0x10]
push esi
push 1
push edi
call fcn.0041136f
add esp, 0x10
cmp esi, eax
jne 0x40714f
push ebx
push 0x100000
push 1
push edi
call fcn.00415210
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x4070f3
xor esi, esi
push dword [esp + 0x10]
call fcn.0040ea39
push ebx
call fcn.0040ea39
push edi
call fcn.0041501c
mov ecx, dword [esp + 0x260]
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040a851
mov esp, ebp
pop ebp
ret
mov esi, 0xfffffffb
jmp 0x407120
Function at 0x4075c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x404]
push edi
xor ebx, ebx
mov dword [ebp - 0x410], edx
push 0x400
mov edi, ecx
mov dword [ebp - 0x408], ebx
push ebx
push eax
mov dword [ebp - 0x414], edi
call fcn.0040bf00
add esp, 0xc
xor eax, eax
mov word [edi], ax
lea eax, [ebp - 0x404]
push eax
push 0x1ff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor eax, eax
lea edi, [ebp - 0x404]
mov word [ebp - 6], ax
lea ecx, [edi + 2]
nop word [eax + eax]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x407630
sub edi, ecx
xor eax, eax
sar edi, 1
cmp ax, word [esi]
je 0x4076f0
mov ebx, dword [ebp - 0x414]
mov ecx, edi
mov dword [ebp - 0x40c], ecx
mov edx, 0x25
cmp eax, dword [ebp - 0x410]
jae 0x407722
cmp dx, word [esi]
jne 0x4076c3
push 4
push 0x42ea20
push esi
call fcn.00415890
add esp, 0xc
test eax, eax
jne 0x4076bd
mov eax, dword [ebp - 0x410]
cmp dword [ebp - 0x40c], eax
jae 0x407717
push edi
lea eax, [ebp - 0x404]
push eax
push ebx
call fcn.0040e084
mov eax, dword [ebp - 0x408]
lea ebx, [ebx + edi*2]
mov ecx, dword [ebp - 0x40c]
add esp, 0xc
add eax, edi
add ecx, edi
add esi, 6
jmp 0x4076d4
mov ecx, dword [ebp - 0x40c]
mov ax, word [esi]
inc ecx
mov word [ebx], ax
mov eax, dword [ebp - 0x408]
inc eax
add ebx, 2
add esi, 2
mov dword [ebp - 0x40c], ecx
xor edx, edx
mov dword [ebp - 0x408], eax
cmp dx, word [esi]
jne 0x407658
mov ebx, eax
cmp ebx, dword [ebp - 0x410]
jae 0x407722
xor eax, eax
mov ecx, dword [ebp - 0x414]
xor edx, edx
pop edi
pop esi
mov word [ecx + ebx*2], dx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a851
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x408]
or eax, 0xffffffff
jmp 0x4076fa
mov ecx, dword [ebp - 4]
mov eax, 0xfffffffe
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a851
mov esp, ebp
pop ebp
ret
Function at 0x4089e0
Capabilities:
Read file on windows

Disassembly:
push esi
push 0x43cdcc
push ecx
call fcn.0040ed51
mov esi, eax
add esp, 8
test esi, esi
jne 0x4089f7
pop esi
ret
push ebx
push edi
push 2
push 0
push esi
call fcn.00410588
push esi
call fcn.00410210
mov ebx, eax
add esp, 0x10
test ebx, ebx
js 0x408a72
push esi
call fcn.00416a1e
lea ecx, [ebx + 1]
push ecx
call fcn.004152ca
mov edi, eax
add esp, 8
test edi, edi
je 0x408a72
push esi
push ebx
push 1
push edi
call fcn.00415210
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x408a5d
push esi
call fcn.0041688c
add esp, 4
test eax, eax
jne 0x408a5d
push esi
call fcn.0040ea39
add esp, 4
mov byte [edi + ebx], 0
mov eax, edi
pop edi
pop ebx
pop esi
ret
push esi
call fcn.0040ea39
push edi
call fcn.0041501c
add esp, 8
xor eax, eax
pop edi
pop ebx
pop esi
ret
push esi
call fcn.0040ea39
add esp, 4
xor eax, eax
pop edi
pop ebx
pop esi
ret

Function at 0x40b156
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40b195
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40b195
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40b195
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40b195
cmp dword [ecx + 0x74], 0xe
jbe 0x40b195
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40ffd3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00427b00
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004195ef
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x410015
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x410171
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00427a50
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x440250]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.0041b112
mov ecx, dword [esi*4 + 0x440250]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x41016a
cmp eax, dword [ecx + edi + 0x24]
jne 0x41016a
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41016a
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041b112
add esp, 0x14
test edx, edx
jl 0x41016a
jg 0x4100e0
test eax, eax
jb 0x41016a
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41016a
jl 0x4100fa
cmp dword [ebp - 0x1008], eax
ja 0x41016a
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x410118
test ebx, ebx
je 0x410151
cmp ecx, edi
jae 0x410151
mov al, byte [ecx]
cmp al, 0xd
jne 0x410132
lea eax, [edi - 1]
cmp ecx, eax
jae 0x41013e
cmp byte [ecx + 1], 0xa
jne 0x41013e
inc ecx
jmp 0x41013e
movzx eax, al
movsx eax, byte [eax + 0x43f248]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x410118
cmp edx, ebx
jne 0x410118
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x41016f
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040a851
leave
ret

Function at 0x410f5e
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x410fa1
call fcn.00416ad2
mov dword [eax], 0xf
call fcn.00416ae5
mov dword [eax], 0xd
call fcn.00418507
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a851
leave
ret
test eax, eax
jne 0x410fa8
inc eax
jmp 0x410f95
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x410f93
xor eax, eax
cmp ecx, 1
setne al
jmp 0x410f95
Function at 0x416128
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x428eb0
push esi
call fcn.0041e07c
pop ecx
pop ecx
test eax, eax
jne 0x416156
xor al, al
jmp 0x4161d3
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.00415e5d
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x416190
push dword [ebp - 0x210]
call fcn.0041501c
xor al, al
jmp 0x4161d1
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x416196
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x4161b6
push edx
call fcn.0041605f
pop ecx
test al, al
je 0x416181
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x4161c4
mov bl, 1
push dword [ebp - 0x210]
call fcn.0041501c
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040a851
leave
ret

Function at 0x4192e3
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42a3d8
push 0x42a3d0
push str.FlsAlloc
push 0x1f
call fcn.004191a2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x419317
push dword [ebp + 8]
mov ecx, esi
call dword [0x4281e8]
call esi
jmp 0x41931d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x419361
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42a3e8
push 0x42a3e0
push str.FlsGetValue
push 0x21
call fcn.004191a2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x419398
push dword [ebp + 8]
mov ecx, esi
call dword [0x4281e8]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4193a0
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42a3f0
push 0x42a3e8
push str.FlsSetValue
push 0x22
call fcn.004191a2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4193da
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4281e8]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x41b18e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x440250]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41b1ce
cmp byte [ebx], 0xa
jne 0x41b1ce
or byte [edi + eax + 0x28], 4
jmp 0x41b1d3
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x41b2d2
mov dl, byte [eax]
cmp dl, 0x1a
je 0x41b2b5
inc eax
cmp dl, 0xd
je 0x41b1ff
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x41b225
cmp eax, ecx
jae 0x41b233
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x41b1e7
jmp 0x41b2d2
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41b2b0
cmp dword [ebp - 0x10], 0
je 0x41b2b0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x440250]
test byte [eax + edi + 0x28], 0x48
je 0x41b28a
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x41b275
mov byte [esi], dl
jmp 0x41b286
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x440250]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x41b2d2
cmp byte [ebp - 1], 0xa
jne 0x41b299
cmp esi, ebx
jne 0x41b299
mov byte [esi], 0xa
jmp 0x41b2d1
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041b130
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x41b2d2
mov byte [esi], 0xd
jmp 0x41b2d1
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x440250]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41b2cf
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41b2d2
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41b2db
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x440250]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41b321
cmp word [ebx], dx
jne 0x41b321
or byte [eax + edi + 0x28], 4
jmp 0x41b326
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x41b489
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x41b469
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x41b367
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41b39d
cmp eax, edx
jae 0x41b3ab
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x41b342
jmp 0x41b489
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41b464
cmp dword [ebp - 0x18], 0
je 0x41b464
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x440250]
test byte [eax + edi + 0x28], 0x48
je 0x41b43a
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x41b3fe
mov word [esi], cx
jmp 0x41b435
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x440250]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x440250]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x440250]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x41b489
pop eax
cmp word [ebp - 4], ax
jne 0x41b44a
cmp esi, ebx
jne 0x41b44a
mov word [esi], ax
jmp 0x41b486
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041b130
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x41b489
push 0xd
pop eax
jmp 0x41b445
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x440250]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x41b483
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x41b489
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4202b3
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x4202fe
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0042044e
test al, al
jne 0x4202f8
sub edx, 2
cmp edx, edi
jne 0x4202de
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x420320
lea eax, [edi + 2]
cmp edx, eax
je 0x420320
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.004201ff
add esp, 0x10
jmp 0x42041a
push esi
lea ecx, [ebp - 0x255]
call fcn.0042044e
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x420363
push dword [ebp - 0x25c]
jmp 0x420310
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x4203a0
cmp word [ebp - 0x226], 0
je 0x4203c1
cmp word [ebp - 0x226], ax
jne 0x4203a0
cmp word [ebp - 0x224], 0
je 0x4203c1
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.004201ff
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x42040d
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x42037a
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x4203f5
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x42041a
push 0x42002f
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00424c90
add esp, 0x10
jmp 0x4203ea
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a851
leave
ret