joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415016
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [esp + 4], 0x414e8b
mov dword [esp], 0x43c774
call fcn.004145dd
mov eax, dword [0x43c0dc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x41505d
mov eax, dword [ebp - 0x20]
jmp 0x4151a8
call fcn.00413e4c
mov dword [ebp - 0x20], eax
mov eax, dword [entry3]
test eax, eax
je 0x415074
cmp dword [ebp - 0x20], 0
jne 0x41507e
mov eax, 0
jmp 0x4151a8
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x24], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 0x20]
lea edx, [eax + 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00413f43
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x415150
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x68], 0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x20]
and edx, 0xffffffcf
or edx, 0x10
mov byte [eax + 0x20], dl
mov eax, dword [0x43c0dc]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x4151a5
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x41526c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.00415016
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call fcn.00414eae
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x20]
and eax, 0x30
test al, al
jne 0x4152c5
mov eax, dword [ebp - 0x14]
add eax, 0x70
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_longjmp
mov eax, dword [0x43c0dc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4153ef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x415357
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x415314
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00413d60
mov dword [ebp - 0x10], 0
mov eax, dword [0x43c0dc]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
jmp 0x4153ef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x68], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x415387
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 4
test eax, eax
je 0x4153ef
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00413d60
mov dword [ebp - 0x10], 0
mov eax, dword [0x43c0dc]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthreadex]
call eax
Function at 0x419be0
Capabilities:
Parse pe header

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [ecx + 0x116c]
mov edi, ecx
mov esi, edx
mov ecx, dword [ebx + 4]
lea eax, [ecx + 0x20]
cmp eax, 0xff8
jb 0x419c1f
push 0x1000
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je 0x419c66
mov dword [eax], ebx
xor ecx, ecx
mov ebx, eax
mov dword [eax + 4], 0
mov dword [edi + 0x116c], eax
add ecx, 0x20
mov dword [ebx + 4], ecx
mov ebx, dword [edi + 0x116c]
mov ebp, dword [ebx + 4]
lea edi, [ebx + ebp - 0x18]
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov ecx, dword [esp + 0x14]
add eax, esi
mov ecx, dword [ecx]
mov dword [ebx + ebp - 0x14], 0x1010114
mov dword [ebx + ebp - 0x18], 0x4361cc
mov dword [ebx + ebp - 0x10], esi
mov dword [ebx + ebp - 0xc], eax
mov eax, edi
mov dword [ebx + ebp - 8], ecx
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0040db50
nop dword [eax + eax]
Function at 0x41b970
Capabilities:
Parse pe header

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov edx, ecx
sub edx, eax
je 0x41b9ca
movsx edi, byte [eax]
cmp edi, 0x4a
je 0x41b9f9
cmp edi, 0x4c
je 0x41b9d8
cmp edi, 0x58
jne 0x41b9ca
inc eax
mov ecx, esi
mov dword [esi], eax
call fcn.0041e0c0
mov ecx, eax
xor eax, eax
test ecx, ecx
je 0x41bb4b
mov edx, dword [esi]
cmp edx, dword [esi + 4]
je 0x41bb4b
cmp byte [edx], 0x45
jne 0x41bb4b
inc edx
mov eax, ecx
mov dword [esi], edx
jmp 0x41bb4b
mov ecx, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00419c70
cmp edx, 2
jb 0x41bab0
cmp byte [eax + 1], 0x5a
jne 0x41bab0
add eax, 2
mov ecx, esi
mov dword [esi], eax
call fcn.00419300
jmp 0x41b9a0
inc eax
lea edi, [esi + 0x14]
mov dword [esi], eax
mov edx, dword [esi + 0xc]
sub edx, dword [esi + 8]
sar edx, 2
mov dword [esp], edx
mov dword [esp + 8], edi
jmp 0x41ba55
push eax
push ecx
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
add esp, 8
mov ebx, eax
test eax, eax
mov dword [esi + 8], eax
je 0x41bb53
lea eax, [ebx + ebp]
sar ebp, 1
lea ecx, [ebx + ebp*4]
mov ebp, eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
lea eax, [ebp + 4]
mov dword [esi + 0xc], eax
mov dword [ebp], edi
mov eax, dword [esi]
mov ecx, dword [esi + 4]
cmp eax, ecx
je 0x41ba5e
cmp byte [eax], 0x45
je 0x41bac5
mov ecx, esi
call fcn.0041b970
test eax, eax
je 0x41babe
mov ebp, dword [esi + 0xc]
mov edi, eax
cmp ebp, dword [esi + 0x10]
jne 0x41ba47
mov ecx, dword [esi + 8]
sub ebp, ecx
cmp dword [esp + 8], ecx
lea eax, [ebp + ebp]
jne 0x41ba20
mov dword [esp + 4], ecx
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je 0x41bb53
mov ebx, eax
test ebp, ebp
je 0x41baab
push ebp
push dword [esp + 8]
push ebx
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
add esp, 0xc
mov dword [esi + 8], ebx
jmp 0x41ba37
mov ecx, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
jmp 0x41f2b0
xor eax, eax
jmp 0x41bb4b
inc eax
mov ebp, dword [esp]
mov ecx, esi
mov dword [esi], eax
mov edx, dword [esi + 8]
shl ebp, 2
add edx, ebp
push dword [esi + 0xc]
call fcn.004245c0
add esp, 4
add ebp, dword [esi + 8]
mov edi, eax
mov ebx, edx
mov dword [esi + 0xc], ebp
mov ebp, dword [esi + 0x116c]
mov ecx, dword [ebp + 4]
lea eax, [ecx + 0x10]
cmp eax, 0xff8
jb 0x41bb21
push 0x1000
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je 0x41bb53
mov dword [eax], ebp
xor ecx, ecx
mov ebp, eax
mov dword [eax + 4], 0
mov dword [esi + 0x116c], eax
add ecx, 0x10
mov dword [ebp + 4], ecx
mov ecx, dword [esi + 0x116c]
mov edx, dword [ecx + 4]
mov dword [ecx + edx - 4], 0x101011c
mov dword [ecx + edx - 8], 0x437c58
lea eax, [ecx + edx - 8]
mov dword [ecx + edx + 4], ebx
mov dword [ecx + edx], edi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0040db50
nop dword [eax + eax]
Function at 0x42b078
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], 0x43c0f0
call fcn.0042ae92
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax]
cmp eax, 0xbab1f0ed
jne 0x42b0a4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
test eax, eax
jg 0x42b0e6
mov dword [esp], 2
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
call eax
mov dword [esp + 0x10], 0x28
mov dword [esp + 0xc], str._buildbot_src_android_mingw_toolchain_mingw_mingw_w64_v6.x_mingw_w64_libraries_winpthreads_src_rwlock.c
mov dword [esp + 8], str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
mov dword [esp + 4], str.Assertion_failed:___s___file__s__line__d_n
mov dword [esp], eax
call fcn.004109d0
mov dword [esp], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [eax + 4]
sub edx, 1
mov dword [eax + 4], edx
mov dword [esp], 0x43c0f0
call fcn.0042aef0
mov eax, dword [ebp + 0xc]
leave
ret
Function at 0x1003d52
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x100609c]
push 0
mov dword [ebp - 4], eax
call dword [sym.imp.msvcrt.dll_time]
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x118]
mov dword [esp], 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x1003d96
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1003e59
lea eax, [ebp - 0x118]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003d9f
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub eax, edx
cmp dword [0x1006b0c], 0
push esi
lea eax, [ebp + eax - 0x118]
push edi
mov dword [ebp - 0x120], eax
je 0x1003df0
mov edi, eax
mov esi, 0x10012d4
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x118]
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1003df0
push 0x10012c4
push eax
call ebx
mov dword [0x1006b2c], eax
mov edi, dword [ebp - 0x120]
mov esi, 0x10012b4
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x118]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x1003e35
push 0x10012a0
push esi
call ebx
test eax, eax
mov dword [0x1006b24], eax
je 0x1003e35
push 0x100128c
push esi
call ebx
test eax, eax
mov dword [0x1006b28], eax
jne 0x1003e3a
push 2
pop eax
jmp 0x1003e56
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x124]
push eax
push dword [ebp - 0x11c]
call dword [0x1006b24]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
call fcn.010038e4
leave
ret
Function at 0x40324d
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0x224
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp - 0x22c]
push ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x403349
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4032b7
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x403363
push 0x224
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp - 0x228]
imul ecx, ecx, 0x224
mov edx, dword [ebp + 0xc]
add edx, ecx
push edx
call fcn.00413fb0
add esp, 0xc
mov eax, dword [ebp - 0x228]
add eax, 1
mov dword [ebp - 0x228], eax
lea ecx, [ebp - 0x224]
push ecx
mov edx, dword [ebp - 0x22c]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x403349
push 0x224
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp - 0x228]
imul ecx, ecx, 0x224
mov edx, dword [ebp + 0xc]
add edx, ecx
push edx
call fcn.00413fb0
add esp, 0xc
mov eax, dword [ebp - 0x228]
add eax, 1
mov dword [ebp - 0x228], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x228]
cmp edx, dword [ecx]
jb 0x403347
jmp 0x403349
jmp 0x4032ec
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x228]
mov dword [eax], ecx
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40511f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 4], 0
cmp dword [ebp + 8], 0
jne 0x405131
xor eax, eax
jmp 0x4051a8
push 0x104
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov byte [ebp - 4], al
mov ecx, dword [ebp - 4]
and ecx, 0xff
test ecx, ecx
je 0x4051a6
push 0x47a7b4
call fcn.00413e30
add esp, 4
push eax
push 0x47a7c4
mov edx, dword [ebp - 4]
and edx, 0xff
mov eax, dword [ebp + 8]
add eax, edx
push eax
call fcn.00413fb0
add esp, 0xc
push str._aimidware.cfg
call fcn.00413e30
add esp, 4
mov cl, byte [ebp - 4]
add cl, al
mov byte [ebp - 4], cl
mov edx, dword [ebp - 4]
and edx, 0xff
mov eax, dword [ebp + 8]
mov byte [eax + edx], 0
mov eax, 1
jmp 0x4051a8
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x407490
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [esp + 0x14]
push esi
push edi
test bl, bl
jne 0x4074d4
or edx, 0xffffffff
xor esi, esi
mov dword [0x47ec68], edx
mov ecx, 0x47e868
mov eax, esi
mov edi, 8
test al, 1
je 0x4074bf
shr eax, 1
xor eax, 0xedb88320
jmp 0x4074c1
shr eax, 1
dec edi
jne 0x4074b2
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x47ec68
jl 0x4074ab
jmp 0x4074da
mov edx, dword [0x47ec68]
mov esi, dword [esp + 0x14]
xor eax, eax
test esi, esi
jle 0x407510
mov edi, dword [esp + 0x10]
push ebp
xor ecx, ecx
mov ebp, edx
mov cl, byte [eax + edi]
and ebp, 0xff
xor ecx, ebp
shr edx, 8
mov ecx, dword [ecx*4 + 0x47e868]
xor edx, ecx
inc eax
cmp eax, esi
mov dword [0x47ec68], edx
jl 0x4074e9
pop ebp
pop edi
pop esi
cmp bl, 2
pop ebx
jne 0x407526
mov eax, dword [esp + 0xc]
not edx
mov dword [0x47ec68], edx
mov dword [eax], edx
ret

Function at 0x407880
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x47ab70]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x407893
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp word [esp + 0x10c], 1
je 0x4078d5
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x47ac18]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x407907
mov bl, byte [esp + ecx + 0x4c]
jmp 0x40790b
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x4078fc
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x407929
mov bl, byte [esp + ecx + 0x4c]
jmp 0x40792d
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x40791e
xor ecx, ecx
mov eax, 0x47ab80
xor ebx, ebx
mov bl, byte [ecx + 0x47ac28]
cmp byte [esp + ebx + 0x14], 0
je 0x407958
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x47ac40]
cmp byte [esp + ebx + 0x14], 0
je 0x40796f
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x40793f
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x4078c7
lea edx, [esp + 0x84]
push edx
call fcn.004079b0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x414dd6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x414f9c
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x481380]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x414f9c
test cl, 0x48
je 0x414e3c
mov al, byte [eax + 5]
cmp al, 0xa
je 0x414e3c
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x414e8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x414e76
call fcn.00418298
mov dword [eax], 9
call fcn.004182a1
mov dword [eax], esi
jmp 0x414e86
cmp eax, 0x6d
je 0x414f9c
push eax
call fcn.004182aa
pop ecx
or eax, 0xffffffff
jmp 0x414f9e
mov eax, dword [edi]
mov edx, dword [ebp - 0xc]
add dword [ebp - 8], edx
lea ecx, [eax + esi + 4]
mov al, byte [ecx]
test al, al
jns 0x414f97
test edx, edx
je 0x414eb1
cmp byte [ebx], 0xa
jne 0x414eb1
or al, 4
jmp 0x414eb3
and al, 0xfb
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x414f91
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x414f81
cmp al, 0xd
je 0x414ee7
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x414f73
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x414f01
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x414efc
add dword [ebp + 0x10], 2
jmp 0x414f55
mov dword [ebp + 0x10], eax
jmp 0x414f6f
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x414f29
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x414f6f
cmp dword [ebp - 0xc], 0
je 0x414f6f
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x414f4a
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x414f55
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x414f72
cmp ebx, dword [ebp + 0xc]
jne 0x414f5a
cmp byte [ebp - 1], 0xa
jne 0x414f5a
mov byte [ebx], 0xa
jmp 0x414f72
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00414cb7
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x414f73
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x414ecb
jmp 0x414f91
mov eax, dword [edi]
lea esi, [eax + esi + 4]
mov al, byte [esi]
test al, 0x40
jne 0x414f91
or al, 2
mov byte [esi], al
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x414f9e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415bbd
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x415bda
call fcn.00418298
mov dword [eax], 0x16
xor eax, eax
jmp 0x415c44
push esi
push 0x88
push 1
call fcn.0041d390
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x415c2f
push esi
call fcn.0041af46
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x415c0d
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x415b19
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x415c43
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.004137d8
test ebx, ebx
pop ecx
je 0x415c41
push ebx
call fcn.004182aa
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41b1fc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
xor eax, eax
cmp edx, dword [eax*8 + 0x47cc00]
je 0x41b21c
inc eax
cmp eax, 0x12
jb 0x41b20d
shl eax, 3
cmp edx, dword [eax + 0x47cc00]
mov dword [ebp + 8], eax
jne 0x41b3ba
mov ecx, dword [0x480e4c]
cmp ecx, 1
je 0x41b38f
test ecx, ecx
jne 0x41b24e
cmp dword [0x47c4f4], 1
je 0x41b38f
cmp edx, 0xfc
je 0x41b3ba
and byte [ebp - 8], 0
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41b289
push 5
pop ecx
mov esi, str._program_name_unknown_
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x10c]
lea ebx, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41b298
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x41b2d0
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41b2b0
sub eax, edx
push 3
lea ebx, [ebp + eax - 0x147]
push 0x46dee8
push ebx
call fcn.004204d0
add esp, 0xc
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41b2d5
sub eax, edx
mov ecx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x47cc04]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41b2ec
sub eax, esi
lea eax, [eax + ecx + 0x1c]
add eax, 3
and eax, 0xfffffffc
call fcn.00413eb0
mov edx, esp
push 6
pop ecx
mov esi, str.Runtime_Error__n_nProgram:
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41b318
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x41b324
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41b33d
mov eax, dword [ebp + 8]
mov esi, 0x46dec8
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [eax + 0x47cc04]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41b358
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x41b364
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.004203cf
add esp, 0xc
jmp 0x41b3ba
mov ecx, dword [eax + 0x47cc04]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41b39a
push 0
lea edx, [ebp - 4]
push edx
sub eax, esi
push eax
push ecx
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x118]
pop edi
pop esi
pop ebx
leave
ret