joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a3c0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000a433
lea ecx, [esp + 4]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x1000a433
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
push 0
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 8]
push 0x10
push ecx
push 0
push edx
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 4
push 8
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x1c
ret
Function at 0x100242f6
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
je 0x10038029
pushfd
bswap cx
mov ecx, 0x10002590
jmp 0x10024b8d
bswap edx
push 0xd9d589eb
lea edx, [esp + 0x18]
pushfd
lea esp, [esp + 0xc]
jmp fcn.1002e6d5

Function at 0x1002437a
Capabilities:
Packed with generic packer

Disassembly:
bt di, 7
cmp ecx, dword [0x100194bc]
jmp fcn.1002c6f9

Function at 0x10026cc4
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp], 0xf9
lea esp, [esp + 4]
je 0x100296a3
lea edx, [esi - 0x278d7453]
movzx ecx, bl
pushal
mov ecx, 0x10002420
rcr dh, cl
shl dx, cl
bsr dx, sp
rcl dl, 4
lea edx, [esp + 0x30]
stc
push dword [esp]
bt bp, ax
jmp 0x1003c1cb
sub ecx, eax
cmc
mov word [esp + 4], 0x8202
pushfd
mov dword [esp + 0x24], edx
call fcn.100297b6

Function at 0x10026e9f
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x34], 0x1002f00e
pushfd
call fcn.100380f8
pushal
mov dword [esp + 0x1c], 0
pushfd
mov dword [esp + 0x1c], str.MapleStoryClass
mov dword [esp], eax
push edi
lea esp, [esp + 0x20]
jmp fcn.10024798

Function at 0x1002aa57
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x10]
je 0x100296a3
mov dx, ax
xor dh, dh
mov ecx, 0x10002420
shl dl, 6
lea edx, [esp + 0x10]
stc
pushfd
stc
pushfd
sub ecx, eax
pushal
call fcn.10029404
pushal
call fcn.1002e865

Function at 0x1002bffd
Capabilities:
Packed with generic packer

Disassembly:
pushfd
jmp 0x1003b18c
cmp eax, 0x217e76b
pushfd
mov byte [esp], bl
jmp loc.100243b5
lea esp, [esp + 0xc]
je 0x10041acd
jmp 0x1003965c

Function at 0x1002c6ad
Capabilities:
Packed with generic packer

Disassembly:
pushfd
lea esp, [esp + 0x3c]
je 0x10038029
bswap cx
lea edx, [edx - 0x15f0b539]
pushal
mov ecx, 0x10002590
movzx edx, dl
pop edx
lea edx, [esp + 0x2c]
pushfd
mov dword [esp + 8], 0xdeaa62a7
lea esp, [esp + 0x20]
jmp fcn.1002e6d5

Function at 0x1002ef96
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x28], edx
call fcn.10031af2
lea esp, [esp + 0x10]
je 0x1003beb7
sar ch, 1
mov dl, 0x57
shld dx, si, 4
mov ecx, 0x10002550
btr edx, 0x12
btc dx, dx
pushal
lea edx, [esp + 0x30]
pushfd
push ebx
mov word [esp], ax
sub ecx, eax
cmp edx, eax
cmc
pushfd
mov dword [esp + 0x28], edx
call fcn.1002af43

Function at 0x1002f4aa
Capabilities:
Packed with generic packer

Disassembly:
pushal
lea esp, [esp + 0x24]
je fcn.1002a478
clc
pushal
cmp dword [0x10015544], 0
push 0xf60a2b83
call fcn.10031687
lea edi, [ebx - 0x7f1bd18]
lea esp, [esp + 4]
popal
jmp 0x1003d0a8
push 0xbc9f6927
cwde
movsx cx, bl
pushal
mov eax, dword [0x100194f0]
mov cl, ah
pushfd
movsx cx, al
pop ecx
mov dword [esp + 0x20], eax
jmp fcn.10033cb5
bswap cx
jl 0x10033d87
cwde
mov eax, dword [0x100194f0]
mov ch, cl
bswap cx
movsx ecx, dl
push eax
movsx ecx, al
pushal
setbe ch
lea ecx, [esi + 0xc]
pushfd
pushfd
push dword [esp]
mov dword [esp + 0x28], 0x100299b8
push dword [esp + 0xc]
pushfd
mov byte [esp + 4], ch
push dword [0x10015570]
pop dword [esp + 0x2c]
pushfd
mov byte [esp], dl
push dword [esp + 0x30]
ret 0x34
Function at 0x10033c44
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp + 0x14], al
mov byte [esp + 0x6a], 0x90
push 0xd61e750
call fcn.1003c229
lahf
popal

Function at 0x10034855
Capabilities:
Packed with generic packer

Disassembly:
lea eax, [esp + 0x14]
call fcn.1002c280
movzx eax, dl
stc
mov eax, dword [0x100154b4]
test dh, dh
cmc
test eax, eax
pushal
pushfd
lea esp, [esp + 0x24]
je 0x10034960
not dh
mov ch, bh
inc dl
mov ecx, 0x10001900
stc
lea edx, [eax - 0x2572dc4d]
neg dx
lea edx, [esp + 0x10]
push edx
cmc
push esp
mov word [esp], 0xc42d
sub ecx, eax
call fcn.10026eff

Function at 0x1003da4a
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0xc]
je 0x1002fcff
inc cx
rol dh, 4
shld dx, dx, cl
mov ecx, 0x10002490
bts dx, bp
test dx, dx
lea edx, [esp + 0x10]
test si, di
sub ecx, eax
stc
test ah, 0xeb
push edx
push 0xf20c2d74
clc
mov dword [esp], 0x40
push edx
test ah, 0xfc
test bh, 0xd2
call fcn.10025061
lahf
movzx ax, cl
mov esi, dword [0x1001a4b4]
mov ah, 0x7f
movzx cx, cl
mov al, cl
mov esi, dword [esi]
lea eax, [eax - 0x77efc3ec]
mov ecx, esi
push 0xd76800fe
lahf
setne ah
mov eax, dword [ebp + 8]
pushfd
xchg dword [esp + 4], eax
pushal
push dword [esp + 0x1c]
mov ax, 0xb0b9
mov eax, 0x6b8c90
push eax
push edi
call fcn.1003a2de

Function at 0x1003ead8
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushfd
mov dword [esp + 0x24], str.MapleStoryClass
pushfd
lea esp, [esp + 0x28]
jmp loc.100244b2

Function at 0x10040446
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x2c], edx
push 0x1a34dad2
lea esp, [esp + 0x30]
jge 0x1003b246
push 0xbd8425ab
mov dword [esp], 0xbd20cc34
mov dword [esp], eax
call fcn.100411d6
mov dword [0x10019650], ecx
pushfd
pushfd
pushal
pop ecx
lea esp, [esp + 0x28]
popal
pushal
mov word [esp], 0x2214
pushal
nop
pushfd
lea esp, [esp + 0x44]
jmp loc.100081c8
push 0xebf2894
call fcn.10026218
push 0x4ea21b94
mov dword [esp + 4], eax
mov byte [esp], 0x21
pushal
mov dword [esp + 0x20], ecx
pushal
mov dword [esp + 0x3c], 6
call fcn.1002a1b1
mov dword [esp + 0x2c], 2
push 0xe7b25ab5
jmp 0x100299fb

Function at 0x10041033
Capabilities:
Packed with generic packer

Disassembly:
push 0xd6e9f4e6
mov word [esp], bx
mov dword [esp + 0x20], str.MapleStoryClass
pushfd
pushal
pushfd
lea esp, [esp + 0x48]
jmp fcn.10024798
pushfd
lea esp, [esp + 0x14]
je 0x100326b2
bsf edx, edi
btr edx, 0x1c
mov ecx, 0x10002390
mov dl, bh
cmp bx, di
mov dh, 0xa0
lea edx, [esp + 0x10]
push 0x5ef1f797
mov byte [esp], al
sub ecx, eax
jmp 0x1003a34a
lea esp, [esp + 0xc]
je 0x1003fd8e
jmp 0x1004102e
pushal
mov dword [esp + 0x20], edx
test ch, dh
test dl, cl
mov dword [esp + 0x1c], 0x40
pushal
call fcn.1002f51d
push ebp
jmp 0x1003755a
call fcn.100247d2
pushfd
mov dword [esp], 0
pushal
jmp 0x10026199
Function at 0x100414ee
Capabilities:
Packed with generic packer

Disassembly:
push eax
call fcn.100405bd
push 0xdd2e63cd
bswap cx
lea ecx, [esp + 0x1c]
push dword [esp]
call fcn.10039e3b
mov byte [esp], 0x72
stc
test ch, 0x24
mov dword [esp + 4], edx
stc
mov dword [esp], 0x40
clc
sub ecx, 5
pushal
lea esp, [esp + 0x20]
jne 0x10030149
pushfd
call fcn.100264c7
pushfd
lea esp, [esp + 4]
je 0x1003ff91
lea ecx, [edi*2 + 0x26260f48]
mov ecx, 0x100024d0
bsf dx, dx
lea edx, [esp + 0x10]
call fcn.1003ec37
rol ah, 5
bts ax, 4
aad 0xe0
mov eax, dword [0x100194cc]
clc
stc
test eax, eax
jmp 0x1002ef72
push edx
mov dword [esp], 7
jmp 0x1003b8e4
jmp 0x1003e487
jmp 0x1002acde
lea esp, [esp + 0x50]
je 0x1003f9b7
cmc
pushfd
xchg ecx, edx
setle ch
mov ecx, 0x10002450
shld dx, sp, 0xc
clc
cmc
lea edx, [esp + 0x14]
pushfd
cmc
sub ecx, eax
jmp 0x1002e34b
adc eax, esi
rcl al, 7
shl al, 7
mov eax, dword [0x100194d0]
test bl, dl
pushfd
test eax, eax
pushfd
lea esp, [esp + 8]
je 0x1002fcff
xchg cl, dl
and cl, 0x94
cmp al, bl
pushal
mov ecx, 0x10002490
setg dh
cmp dh, 0xd
lea edx, [esp + 0x30]
cmc
call fcn.10028242
add ax, dx
cwde
bsr ax, ax
mov eax, dword [0x100194c8]
clc
test dx, 0xec17
stc
bt cx, 0xf
test eax, eax
call fcn.10026cc4
jmp 0x10036a48
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x431030
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x4016e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x114], str.55222
mov eax, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x11c], eax
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [ebp - 0x114]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [ebp - 0x11c]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x40175a
cmp dword [ebp - 0x118], 0
je 0x40175a
jmp 0x4017bc
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
je 0x4017bc
mov dword [ebp - 0x120], 0x1046a
mov eax, dword [ebp + 8]
add eax, 8
mov dword [0x4380b4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [0x4380d0], edx
mov dword [ebp - 0x120], 0x1046a
mov dword [ebp - 0x120], 0x1046a
call fcn.004011f0
mov eax, dword [ebp + 8]
mov dword [0x4380cc], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
call fcn.00401a90
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x40175a
mov esp, ebp
pop ebp
ret

Function at 0x4017c0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x401810
xor eax, eax
jmp 0x4018f1
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
jne 0x401828
xor eax, eax
jmp 0x4018f1
push ebp
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
call fcn.00401330
mov esp, ebp
pop ebp
ret
Function at 0x401ad0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x4380c0], 0x24e1
mov eax, dword [0x4380c0]
sub eax, 0x24e1
mov dword [0x4380c0], eax
mov ecx, 1
test ecx, ecx
je 0x401b7b
mov edx, dword [0x4380c0]
cmp edx, dword [ebp + 0xc]
jb 0x401b07
jmp 0x401b7b
cmp dword [0x4380c0], 0
jne 0x401b25
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x401b25
xor eax, eax
jmp 0x401b7b
mov eax, dword [ebp + 8]
add eax, dword [0x4380c0]
mov ecx, dword [eax]
add ecx, dword [0x4380c0]
mov edx, dword [ebp + 8]
add edx, dword [0x4380c0]
mov dword [edx], ecx
mov dword [ebp - 4], 0x64b60
mov eax, dword [0x4380c0]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x4380c0]
push eax
call fcn.00401200
add esp, 8
mov ecx, dword [0x4380c0]
add ecx, 4
mov dword [0x4380c0], ecx
jmp 0x401aed
mov esp, ebp
pop ebp
ret
Function at 0x406f79
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x406f9a
jl 0x406f91
test edi, edi
jne 0x406f9a
xor eax, eax
xor edx, edx
jmp 0x40705b
cmp dword [ebx + 0x38], 0
je 0x406faf
push eax
push edi
push dword [ebp + 8]
call fcn.00407061
jmp 0x40705b
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x406ff6
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x406ff6
cmp eax, edi
jb 0x406fd0
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00408bb0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x406ffc
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x407050
mov ecx, ebx
call fcn.00406757
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x40703b
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.0040f84f
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x407050
jmp 0x40700e
test edx, edx
je 0x407050
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0040f84f
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x408354
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x408393
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x408393
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x408393
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x408393
cmp dword [ecx + 0x74], 0xe
jbe 0x408393
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41631e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x427318
push 0x427310
push str.FlsAlloc
push 0x1f
call fcn.00416205
mov esi, eax
add esp, 0x10
test esi, esi
je 0x416352
push dword [ebp + 8]
mov ecx, esi
call dword [0x42321c]
call esi
jmp 0x416358
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41639c
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x427328
push 0x427320
push str.FlsGetValue
push 0x21
call fcn.00416205
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4163d3
push dword [ebp + 8]
mov ecx, esi
call dword [0x42321c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x4163db
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x427330
push 0x427328
push str.FlsSetValue
push 0x22
call fcn.00416205
mov esi, eax
add esp, 0x10
test esi, esi
je 0x416415
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42321c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4187b7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004086b0
mov eax, dword [0x42e020]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00415c0a
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4187f9
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x418955
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00421e10
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x42fad0]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.004197b4
mov ecx, dword [esi*4 + 0x42fad0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x41894e
cmp eax, dword [ecx + edi + 0x24]
jne 0x41894e
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41894e
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004197b4
add esp, 0x14
test edx, edx
jl 0x41894e
jg 0x4188c4
test eax, eax
jb 0x41894e
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41894e
jl 0x4188de
cmp dword [ebp - 0x1008], eax
ja 0x41894e
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4188fc
test ebx, ebx
je 0x418935
cmp ecx, edi
jae 0x418935
mov al, byte [ecx]
cmp al, 0xd
jne 0x418916
lea eax, [edi - 1]
cmp ecx, eax
jae 0x418922
cmp byte [ecx + 1], 0xa
jne 0x418922
inc ecx
jmp 0x418922
movzx eax, al
movsx eax, byte [eax + 0x42e2a8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4188fc
cmp edx, ebx
jne 0x4188fc
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x418953
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00407d7b
leave
ret
Function at 0x418c4c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x42fad0]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x418c8c
cmp byte [ebx], 0xa
jne 0x418c8c
or byte [edi + eax + 0x28], 4
jmp 0x418c91
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x418d90
mov dl, byte [eax]
cmp dl, 0x1a
je 0x418d73
inc eax
cmp dl, 0xd
je 0x418cbd
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x418ce3
cmp eax, ecx
jae 0x418cf1
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x418ca5
jmp 0x418d90
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x418d6e
cmp dword [ebp - 0x10], 0
je 0x418d6e
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x42fad0]
test byte [eax + edi + 0x28], 0x48
je 0x418d48
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x418d33
mov byte [esi], dl
jmp 0x418d44
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x42fad0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x418d90
cmp byte [ebp - 1], 0xa
jne 0x418d57
cmp esi, ebx
jne 0x418d57
mov byte [esi], 0xa
jmp 0x418d8f
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004197d2
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x418d90
mov byte [esi], 0xd
jmp 0x418d8f
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x42fad0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x418d8d
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x418d90
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x418d99
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x42fad0]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x418ddf
cmp word [ebx], dx
jne 0x418ddf
or byte [eax + edi + 0x28], 4
jmp 0x418de4
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x418f47
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x418f27
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x418e25
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x418e5b
cmp eax, edx
jae 0x418e69
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x418e00
jmp 0x418f47
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x418f22
cmp dword [ebp - 0x18], 0
je 0x418f22
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x42fad0]
test byte [eax + edi + 0x28], 0x48
je 0x418ef8
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x418ebc
mov word [esi], cx
jmp 0x418ef3
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x42fad0]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x42fad0]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x42fad0]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x418f47
pop eax
cmp word [ebp - 4], ax
jne 0x418f08
cmp esi, ebx
jne 0x418f08
mov word [esi], ax
jmp 0x418f44
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004197d2
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x418f47
push 0xd
pop eax
jmp 0x418f03
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x42fad0]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x418f41
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x418f47
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret